Build Your Own Botnet – BYOB

Introduction

BYOB (Build Your Own Botnet) is an open-source project that provides a framework for security researchers and developers to build and operate a basic botnet. This framework should help you in intentions to improve your ability for counter-measures development against malware and to deepen your understanding on how they works/infects a huge number of devices every year.

BYOB: Build Your Own Botnet

BYOB framework allows you to easily implement your own code and add new features without having to write a RAT (Remote Administration Tool) or a C2 (Command & Control server) from scratch.

Server

usage: server.py [-h] [-v] [--host HOST] [--port PORT] [--database DATABASE]

• Console-Based User-Interface: streamlined console interface for controlling client host machines remotely via reverse TCP shells. It provides direct terminal access to the client host machines.
• Persistent SQLite Database: lightweight database that stores identifying information about client host machines, which allows reverse TCP shell sessions to persist through disconnections of arbitrary duration and enabling long-term reconnaissance.
• Client-Server Architecture: all python packages/modules installed locally are automatically available. You don’t have to write them to the disk of the target machines.

Client

usage: client.py [-h] [-v] [--name NAME] [--icon ICON] [--pastebin API] [--encrypt] [--obfuscate] [--compress] [--compile] host port [module [module ...]]

• Remote Imports: you can remotely import third-party packages from the server. You don’t have to download/install or write them to the disk.
• Nothing Written To The Disk: clients never write anything to the disk – not even temporary files.
• Zero Dependencies: client runs with just the python standard library, remotely imports any non-standard packages/modules from the server. You can compile it with a standalone python.
• New Features With 1 Click: any python script, module, or package you to copy to the ./byob/modules/ directory automatically becomes remotely importable & directly usable by every client while your command & control server is running
• Write Your Own Modules: a basic module template is located in ./byob/modules/ directory where you can write your own modules.
• Run Unlimited Modules Without Bloating File Size: use remote imports to add unlimited features without adding a single byte to the client’s file size
• Fully Updatable: each client will periodically check the server for new content available for remote import. It will dynamically update its in-memory resources.
• Platform Independent: everything is written in Python. You can compile clients into portable executable or bundle them into an standalone application.
• Bypass Firewalls: clients connect to the command & control server via reverse TCP connections, which will bypass most firewalls because the default filter configurations primarily block incoming connections.
• Counter-Measure Against Antivirus: it will block all processes with names of well-known antiviruses from spawning
• Encrypt Payloads To Prevent Analysis: the main client payload is encrypted with a random 256-bit key which exists solely in the payload stager which is generated along with it
• Prevent Reverse-Engineering: clients will abort execution if detect a virtual machine or sandbox.

Modules

1. Keylogger (byob.modules.keylogger): logs the user’s keystrokes & the window name entered
2. Screenshot (byob.modules.screenshot): take a screenshot of current user’s desktop
3. Webcam (byob.modules.webcam): view a live stream or capture image/video from the webcam
4. Ransom (byob.modules.ransom): encrypt files & generate random BTC wallet for ransom payment
5. Outlook (byob.modules.outlook): read/search/upload emails from the local Outlook client
6. Packet Sniffer (byob.modules.packetsniffer): run a packet sniffer on the host network & upload .pcap file
7. Persistence (byob.modules.persistence): establish persistence on the host machine using 5 different methods
8. Phone (byob.modules.phone): read/search/upload text messages from the client smartphone
9. Escalate Privileges (byob.modules.escalate): attempt UAC bypass to gain unauthorized administrator privileges
10. Port Scanner (byob.modules.portscanner): scan the local network for other online devices & open ports
11. Process Control (byob.modules.process): list/search/kill/monitor currently running processes on the host

Core

1. Utilities (byob.core.util): miscellaneous utility functions that are used by many modules
2. Security (byob.core.security): Diffie-Hellman IKE & 3 encryption modes (AES-256-OCB, AES-256-CBC, XOR-128)
3. Loaders (byob.core.loaders): remotely import any package/module/scripts from the server
4. Payloads (byob.core.payloads): reverse TCP shell designed to remotely import dependencies, packages & modules
5. Stagers (byob.core.stagers): generate unique payload stagers to prevent analysis & detection
6. Generators (byob.core.generators): functions which all dynamically generate code for the client generator
7. Database (byob.core.database): handles interaction between command & control server and the SQLite database