TL; DR
Iphakheji yePyPI egama lingu ulawulo lwe-gcli ithumele isixhobo esipheleleyo sokufikelela kude seWindows: ukuloga ii-keystroke, ukubamba i-webcam kunye ne-microphone, ukujonga i-clipboard, ukufikelela kwi-browser-credential, ulawulo lwesikrini, ukunyamezela, ukuphakanyiswa kwamalungelo, kunye "nemiyalelo engaphezu kwe-140" ezizibhengezayo. Ayizange iyifihle into eyayiyiyo: isishwankathelo sePyPI sephakheji siyichaze njenge "sixhobo sokufikelela kude nge npoint.io".
Inkcazelo ekufanele ihlale ivaliwe yile binzana "nge-npoint.io." Endaweni yokuba kuthiwe yiseva ezinikeleyo, kusetyenziswe i-implant inqaku [.]io (inkonzo yasimahla, esemthethweni yokusingatha amaxwebhu amancinci e-JSON) njengereyishini yayo yomyalelo nolawulo. Umsebenzisi ubhala imiyalelo kwibhini ye-JSON; uphononongo olufakelweyo olukhupha, oluphumeza, nolubhala iziphumo. Akukho domain ephethwe ngumhlaseli yokuyivimba, akukho IP entsha yokuyiphawula: ithrafikhi iya kwinkonzo esetyenziswa ngabaphuhlisi beenkonzo yonke imihla.
Iinguqulelo ezintandathu zapapashwa kwiiyure ezilishumi elinesithathu elinesiqingatha, nganye inamandla ngakumbi kuneyokugqibela. Zonke zazo zafumana amanqaku. ml_eqikelelweyo_ikhuselekile ngumhleli wezinto ozihlelayo ngaphambi kokuba uphononongo olwenziwe ngesandla luphinde lwahlulahlula usapho njengolunobungozi.
Uhlaselo lwe-anatomy
ulawulo lwe-gcli ifaka iphakheji yokungenisa i-gcli, ikhowudi yePython yeemodyuli ezingama-35. Akukho xesha lokufaka hooks — akukho nto ibalekayo ngexesha pip ufake. Ubuchule buhlala kwiimodyuli ngokwazo, bubizwa xa isixhobo sisebenza, kwaye uyilo lwemodyuli lufundeka njengephepha leenkcazo zemveliso:
Itshaneli yomyalelo yeyona nxalenye inomdla. Uninzi lwezixhobo zokufikelela kude zifikelela kwiseva elawulwa ngumsebenzisi - i-IP, i-domain, umboneleli we-hosting onokuxelwa aze asuswe kwi-intanethi. ulawulo lwe-gcli endaweni yoko iphatha inkonzo yasimahla ye-JSON-bin njenge-dead-drop. The inqaku imodyuli ifunda kwaye ibhala amaxwebhu amancinci e-JSON kwi inqaku [.]io ngaphezulu kwe-HTTPS eqhelekileyo; i crypto/kubhala Iimodyuli zisonga imithwalo yokuhlawula etshintshiweyo ukuze umxholo webhini ungabi yimiyalelo ecacileyo. Isiphumo si-relay edibeneyo, efihliweyo:
- Umsebenzisi ulahla umyalelo (ofihliweyo) kwibhini yeJSON.
- I-implant, esebenza kwi-host yexhoba, ihlola i-bin, i-decrypt, isebenzise omnye wabaphathi bayo bomyalelo, ize ibhale iziphumo (ezifihliweyo).
- Kwi-network monitor, ixhoba lithetha nje no inqaku [.]io — inkonzo enesizathu esivakalayo sokuvela kwitrafikhi yabaphuhlisi.
Akukho khupholo lwesigaba sesibini kwaye akukho loader ifihliweyo apha: amandla athunyelwa ngokupheleleyo, kwiPython efundekayo, kwaye "ukufihla" kuphela kukukhetha i-relay kunye nokubethela imithwalo yokuhlawula edluliselweyo.
Kutheni i-JSON-bin dead-drop inomtsalane ngokusebenza kufanelekile ukuyichaza, kuba ichaza isizathu sokuba silindele ukubona le patheni kwakhona:
- Akukho ndawo yokuphela ephethwe ngumsebenzisi. Akukho domain ye-C2 yokubhalisa, akukho VPS yokuqeshisa, kwaye akukho nto inokuthinjwa ngumkhuseli okanye ngumbhalisi. Ipakethe ayichukumisi itshaneli; ukususwa kwe channel kuthetha ukucela i-SaaS esetyenziswa ngokubanzi ukuba igcine uxwebhu olunye phakathi kwezigidi.
- Ukuhlamba impahla ngegama. I-HTTPS ephumayo kwinkonzo yomphuhlisi eyaziwayo ayinazo izohlwayo zodumo ezinokwenziwa yi-domain entsha okanye i-IP eluhlaza. Iisetingi ezininzi zokucoca i-egress zivumela oku ngokungangqalanga.
- Ukungavisisani kunye nokungamkeleki. Imodeli yokuvota — i-implant ilanda uxwebhu kwisithuba esithile endaweni yokubamba isokhethi evulekileyo — ivelisa ithrafikhi ebonakala ngathi yi-API yokuvota rhoqo, kungekhona iseshoni yokusebenzisana. Ukubethela umxholo woxwebhu kuthetha ukuba nomhlalutyi ofumana i-bin ubona i-ciphertext, kungekhona uluhlu lwemiyalelo.
- Ujikeleziso oluncinciUkuya kwindawo eyahlukileyo, okanye kwinkonzo eyahlukileyo yenothi/yokuncamathisela ngokupheleleyo, lutshintsho loqwalaselo lomgca omnye kumqhubi. Naluphi na uluhlu lwebhloko olufakwe kwi-relay ethile luphelelwa lixesha xa luthunyelwa.
Utshintshiselwano olufunyanwa ngumsebenzisi luyi-throughput kunye ne-latency: i-dead-drop relay ihamba kancinci kwaye iphantsi kune-direct connection. Kwi-implant yokujonga nokulawula ekhupha imiyalelo emifutshane kwaye iqokelela iziphumo ngokuhamba kwexesha, loo rhwebo kulula ukuyenza.
Ixesha
Usapho lwakhula ngokukhawuleza. Amaxesha okudala amatikiti kwiinguqulelo eziphawuliweyo abeka yonke i-arc ebonwe ngaphakathi malunga neeyure ezilishumi elinesithathu elinesiqingatha, kwaye inani lobungqina besikena landa kunye nekhowudi - ukusuka kwiindawo ezimbalwa eziphawulweyo kwinguqulelo yokuqala ukuya kwishumi elinesine kokugqibela.
Amanani eenguqulelo awapapashwanga ngokulandelelana okungqongqo, kodwa indlela esiya kuyo icacile: ukusika okuncinci kokuqala, emva koko ukuphindaphinda ngokukhawuleza ukuya kwi-0.7.1 ebonakala ngokupheleleyo. Olu luyilo lweprojekthi esaphuhliswayo etyhalelwa kwirejista kawonke-wonke njengoko ikhula, kungekhona ukuhla nje okukodwa.
Iimpawu zokuvumelana
Zonke izalathisi ezingezantsi ziqinisekisiwe ngokuchasene nomxholo wephakheji ekwidiski kunye neskeni yesalathiso esiqinisekileyo senguqulelo 0.7.1; akukho nanye eqikelelayo.
Inqaku lomdlali okhuselayo: isignali eqinileyo kakhulu asiyo domain (i-relay host ijikeleza kancinci) kodwa yi ukuma: iphakheji enye ehlanganisa izinto ezintathu okanye ngaphezulu ezahlukeneyo zokujonga umsingathi kwaye Ihambisa iluphu yomyalelo/yempendulo ngenkonzo kawonke-wonke yokubamba umxholo. inqaku [.]io Akunakwenzeka ngokupheleleyo kwiivenkile ezininzi; ukulumkisa ngenkqubo engalindelekanga ebamba izixhobo zokufaka kunye nentetho kwinkonzo ye-JSON-bin kunamandla ngakumbi.
Ukuziphatha okujongiweyo kunye nokubeka ifreyimu
Zimbini izinto ezenza le sampuli ingaqhelekanga, kwaye zombini ziinyaniso ezibonakalayo endaweni yokuba ziingqikelelo malunga nesizathu.
Yazibhengeza. Isishwankathelo sephakheji esasasazwa kwiPyPI sibala amandla ngolwimi olucacileyo — ukufikelela kude, ulawulo lwedesktop, ulawulo lomsebenzisi, ikhamera yewebhu, isandi, i-keylogger, ukunyamezela, idatha yesikhangeli, iWiFi, irejista, “imiyalelo eyi-140+.” Akukho mzamo wokudlulisa ikhowudi njengomncedisi wokwakha, isigqubuthelo se-CLI, okanye isixhobo se-AI-agent, esiyindlela eqhelekileyo esiyibonayo kwiirejista zikawonke-wonke. Nokuba loo nkululeko ibonisa isixhobo seqela elibomvu esipapashwe ngaphandle kolawulo lokufikelela okanye enye into ngumbuzo umxholo wephakheji wodwa ongawusombululiyo; into eqinisekileyo kukuba isixhobo sokufikelela kude esisebenzayo, esijolise ekufikeleleni kude kunye nokujonga sasinokufakelwa ngumntu onayo. kuba ekugqibeleni.
Yayixhomekeke ekuthembekeni kwinkonzo engenabungozi. usebenzisa inqaku [.]io njengoko i-relay yeyona ndlela ichazayo. Ngumzekelo wendlela ebanzi — ukuhambisa i-C2 kwi-SaaS esemthethweni (iiwebhusayithi zokuncamathisela, ii-JSON bins, iwebhu yencokohooks, amaxwebhu efu) ukuze ithrafikhi enobubi idibane nomsebenzi oqhelekileyo womphuhlisi kwaye kungabikho ndawo yokuphela ephethwe ngumsebenzisi yokuyibamba. Imithwalo ehlawulwayo kwireyila yayifihliwe, ngoko umxholo webhini wawungafundeki njengemiyalelo kumntu obukeleyo nje.
Iimpawu zomshicileli zincinci kwaye ziqhelekileyo. Le phakheji ibhengeze umbhali "abanikeli be-gcli" kunye nelayisensi ye-MIT, kwaye yabonisa iphepha layo lasekhaya kunye neendawo zokugcina izinto kwi github[.]com/gcli-control/gcliAkukho nanye kwezo zinto ingqinisiso: umtya wombhali ngumbhalo wasimahla, i-MIT license header ayibizi mali, kwaye i-URL yokugcina kwi-package metadata yibango, ayibobungqina bemvelaphi. Ipateni - igama elitsha, umbhali oqokelelweyo, kunye ne-self-referential org/repo eyenziweyo malunga nepakethe - yindlela ebonakala ngayo iprojekthi xa imiswe ngokukodwa ukuze ithwale ikhowudi, endaweni yesixhobo esimiselweyo esiye sakhulisa uphawu lolawulo olukude. Siphawula oku njengezinto eziqwalaselweyo; ziyahambelana, kodwa zodwa azimiseli, usasazo olwakhelwe injongo.
Sichaza ukuchithwa kwento njengento enobuqhetseba ngokusekelwe kubuchule kunye nokuhanjiswa kwayo: isixhobo esipheleleyo, esinokusetyenziswa kude nesifakelweyo sokujonga, esisasazwa kwisalathiso sephakheji kawonkewonke esine-relay efihlakeleyo. Asibaleli ithagethi okanye injongo.
Impembelelo, iindlela ezisetyenziswayo kunye noko abakhuseli banokukwenza
Indawo engabonakaliyo yokujonga imifanekiso efihlakeleyo. Izitshixo ze-triage zephakheji ezizenzekelayo kakhulu kwi ukuguqula iimpawu ze i-malware eqhelekileyo yobhaliso — iiblob ezifihliweyo, ixesha lokufaka hooks, ukuvuna iziqinisekiso enye. Iphakheji elula ngokucacileyo i-RAT, enekhowudi ecocekileyo efundekayo kwaye ingenalo ikhonkco lokufaka, ayibonisi nanye kwezo zinto kwaye inokugqitha i-heuristics elindele ukufihla. Iimpawu ezibamba ngokuthembekileyo olu didi zezolwakhiwo kunokuba zisekelwe ekufihleni: ukubalwa kwabantu (zingaphi ii-primitives ezahlukeneyo zokujonga umgcini-ndawonye ezikhoyo kwiphakheji enye) kunye nohlalutyo lwe-C2-shape (iluphu yomyalelo/impendulo ehanjiswa ngenkonzo yokubamba umxholo ngokubanzi). Ezo zijonga umlilo nokuba zinyanisekile okanye zinjani. ifumanekile upakisho lunjalo.
Indlela ye-SaaS-as-C2 esetyenziswa ngayo. Ukusebenzisa kakubi inkonzo yokubamba esemthethweni njengento engapheliyo akunto intsha, kodwa kuyaqhubeka nokusebenza kuba iindleko zokuzikhusela zokuthintela inkonzo ziphezulu kwaye iindleko zokuhlasela zokutshintsha iinkonzo ziphantse zibe zero. Lindela okungakumbi kuyo. Ukhuselo lwenethiwekhi olujoliswe kwiidomeyini ezithile ezimbi luyaphela ngoko nangoko; imithetho yokuziphatha (“le nkqubo ifunda ibhodi yokunamathisela kunye nekhamera yewebhu ize ithethe ne-API yokubamba amanqaku”) ayisebenzi.
Umzobo wokufumanisa izinto eziphathekayo. Umthetho ohlala ixesha elide awuchazi inqaku [.]io konke konke. Idibanisa izinto ezimbini ezibonwayo eziqhelekileyo kodwa ezingaqhelekanga xa zidibene kumphuhlisi oqhelekileyo okanye kwi-host ye-CI:
lumkisa xa inkqubo enye, ngaphakathi kweseshoni enye, zombini:
(A) ifikelela kwisixhobo sokuqala sokujonga umsingathi — isixhobo sokufaka (ikhibhodi/ihoko yemawusi), ikhamera, imakrofoni, ukubamba isikrini, i-clipboard read-loop, okanye ivenkile yeziqinisekiso zesikhangeli ("Login Idatha" / "Ilizwe leNgingqi" / i-DPAPI); KUNYE
(B) yenza izicelo eziphumayo kwinkonzo kawonke-wonke yokusingatha umxholo/ukuncamathisela/i-JSON-bin/i-chat-webhook aze ayiphakamise ukuze ihlolwe, nokuba yeyiphi na inkonzo ethile eku-(B).
Akukho nesinye isiqingatha esikrokrelayo sodwa: kukho izixhobo ezininzi ezisemthethweni eziboniswayo, kwaye kukho ezininzi ezithunyelwa kwi-JSON kwi-API yokubamba. Ukudibana kwenkqubo enye yexesha elifutshane luphawu, kwaye kusinda kuyo nayiphi na i-relay rotation.
Amanyathelo asebenzayo kumaqela:
- Phatha ukufakwa kweepakeji zikawonke-wonke kumphuhlisi kunye neehost ze-CI njengomda wokuphunyezwa, kungekhona lula - i-RAT kwiarhente yokwakha yi-RAT enemfihlo zakho.
- Khetha izibuko zangaphakathi ezidweliswe ngokwemvume; iphakheji ebizwa ngokuba yi-remote control kwaye echaza i-keylogger akufuneki igqitywe kwi-corporate index.
- Isilumkiso kwi Ukudibanisa — isixhobo sokufaka okanye ukufotwa kwesikrini kunye nethrafikhi ephumayo ukuya kwinkonzo yomxholo/yokuncamathisela/yeJSON-bin — endaweni yayo nayiphi na into yokuqala, enokusetyenziswa okungenabungozi xa ikwahlulwe.
- Musa ukuthembela kumanqaku “akhuselekileyo” azenzekelayo njengesigwebo sokugcina kwiipakethe ezinokukwazi ukufikelela kumncedisi ngokubanzi; zithumele kuphononongo lomntu.
Usapho lwephakheji lubekwe kuluhlu olunobungozi kwaye luthunyelwe ukuba lususwe kwirejistri. Ngenxa yokuba i-C2 esekelwe kwi-relay ayishiyi mphathi ophethwe ngumqhubi kwisinki, ixabiso lokuzikhusela elihlala ixesha elide likwiminwe yokuziphatha engentla, kungekhona kulo naluphi na ungeniso olulodwa kuluhlu lwebhloko.
