SHINOBOT/SHINOC2 MANUAL

Transcription

1 SHINOBOT/SHINOC2 MANUAL Sh1n0g1 V E R :

2 OVERVIEW ShinoBOT/ShinoC2 are penetration test tools for APT prevention. PURPOSE The purpose of ShinoBOT/ShinoC2 is to evaluate your protection against recent cyber attacks, like APT. ShinoBOT ShinoBOT is a RAT (remote administration tool). It connects to ShinoC2 via HTTP/HTTPS (newer version use HTTPS). ShinoC2 ShinoC2 is the C&C (command / control) server. You can create a job and send it to your ShinoBOT-affected devices. It has a web GUI so you can manipulate by your browser. ShinoBOT Access ShinoC2 Command 2

3 NOTICE TRY AT YOUR OWN RISK If you run ShinoBOT on your devices, be aware that it has the possibility to be controlled by anyone from the internet. there is a poor password protection to avoid it but don t overestimated them. I recommend not to try it on the machine which contains sensitive information has the permission to access on your file server / data server / active directory, etc. I have no responsibility for any machines affected by ShinoBOT, and any data leakage, any breakage. Again, try at your own risk. 3

4 HOW TO USE(1/4) 1. Prepare the target machine..net Framework 2.0 or later. Internet Accessibility 2. Download ShinoBOT on your target PC ( 3. Run. 4. Note the password (you can copy by the right box). 4

5 HOW TO USE(2/4) 1. Switch to your machine (still using target machine also ok). 2. Access to ShinoC2 Web GUI; recommended. 3. Click [HOST] link. 4. Find your target host by host name, IP address, user name and click [Assign a job] link. 5

6 HOW TO USE(3/4) 1. Select the Job (means command) you want to run target machine runs. e.g.)system Info 2. Put the password you noted before. 3. Press the [Assign] button. 6

7 HOW TO USE(4/4) 1. Check the status on the job history section. Status : [Generated] -> [Accepted] -> [Done] 2. After the status changed into Done, you can check the result of the task in the Loot column. 7

8 HOW TO CREATE A NEW JOB 1. Click the [JOB] icon. 2. Put the parameter and click [Add new job]. NOTE Command will be send to cmd.exe, except those special commands: SBOTshot means screenshot. SBOTwget means the client will download the file specified. e.g.) SBOTwget: SBOTfget means the client will upload the file specified. e.g.) SBOTfget:C: boot.ini SBOTrunA for running a process asynchronous; ShinoBot will not wait for the process end. e.g.) SBOTrunA:notepad.exe The job will be shared for everyone, so don t input any confidential data like credential info. If you try to execute a process will not end automatically, and don t use SBOTrunA, ShinoBOT will be stuck until the process end. For example Process with the GUI, notepad, calc. CUI Interactive Process like telnet, ftp. 8

9 Q&A Q. Does the ShinoBOT s C&C connection support proxy? A. Yes. But it does not support the auth-proxy. Specifically, if the user has already passed the authentication and no further authentication for new session, it will be able to access via auth -proxy. Q. How the password is managed? A. The password is generated when you run ShinoBOT the first time, then it is saved in the registry and uploaded to ShinoC2 in plain text. HKCU Software VB and VBA Program Settings ShinoBOT MachineInfo When the ShinoBot is executed again, it read the reg to use it as password. Q. Does it do anything else communicating and performing the command? A. Yes. it behaves like malware, create itself on the C:, write run reg, try to stop the Windows Firewall, McAfee & Symantec service. If it has no administrator priviledges, it fails. 9

10 Q&A Q. Does ShinoBOT need an administrative priviledges? A. It depends on the command (job) you want to run on it. Q. How the job is sent to the target machine? A. ShinoBOT polling to ShinoC2 every 10 seconds, if there is a new job, it will download and execute it. And send back the result to ShinoC2. 10

11 TIPS Stealth Mode Before running ShinoBOT at the first time, rename the ShinoBOT.exe into ShinoBOT_nosec.exe. The client GUI will be hidden. And the password will be admin

12 THANK YOU Thank you for using ShinoBOT/ShinoC2. If have any (technical) problem please contact Special Thanks to Tesshy for letting me attack his machine. 12