Cross platform backdoor using dns txt records.
What is ddor?
ddor is a cross platform light weight backdoor that uses txt records to execute commands on infected machines.
Features
- Allows a single txt record to have seperate commands for both linux and windows machines
- List of around 10 public DNS servers that it randomly chooses from
- Unpredictable call back times
- Encrypts txt record using xor with custom password
Linux Features:
- Anti-Debugging, if ptrace is detected as being attached to the process it will exit.
- Process Name/Thread names are cloaked, a fake name overwrites all of the system arguments and file name to make it seem like a legitimate program.
- Automatically Daemonizes
- Tries to set GUID/UID to 0 (root)
Windows Features:
- Hides Console Window
- Stub Size of around 20kb
Installation
To install the dependencies needed for the python generation script run.
pip3 install -r requirements.txt
Make sure to edit config.h and replace the provided domain with yours, you can change the fake name as well as the password.
To create a Linux binary:
Run the compile.sh script, this will create a file called binary in the bin folder.
To Create a Windows Binary:
This project was built using VS 2019, if you open the sln file using VS2019 select the release build and build it.
Usage
Run payload_manager.py with python3 to create a hex encoded payload, then update or create a txt record for your domain, make sure that the TTL is set to 300 seconds!!!
Payload Manager Usage:
$ ./payload_manager.py -h
@@@@@@@ @@@@@@@ @@@@@@ @@@@@@ @@@@@@@
@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@@@@@
@@! @@@ @@! @@@ @@! @@@ @@! @@@ @@! @@@
!@! @!@ !@! @!@ !@! @!@ !@! @!@ !@! @!@
@!@ !@! @!@ !@! @!@ !@! @!@ !@! @!@!!@!
!@! !!! !@! !!! !@! !!! !@! !!! !!@!@!
!!: !!! !!: !!! !!: !!! !!: !!! !!: :!!
:!: !:! :!: !:! :!: !:! :!: !:! :!: !:!
:::: :: :::: :: ::::: :: ::::: :: :: :::
:: : : :: : : : : : : : : : : :
usage: payload_manager.py [-h] [-l LINUX_CMD] [-w WINDOWS_CMD]
[-d DOMAIN_SEARCH]
ddor, crossplatform dns backdoor
Optional arguments:
-h, --help show this help message and exit
-l LINUX_CMD Linux Command
-w WINDOWS_CMD Windows Command
-d DOMAIN_SEARCH Domain to Check Commands On
Download Tool: https://github.com/rek7/ddoor
Other Hacking Tools
Explore All Hacking Tools »
Pftriage - Python Tool And Library To Help Analyze Files During Malware Triage And Analysis
Read Details »
ADAPT - Tool That Performs Automated Penetration Testing For WebApps
Read Details »
Stardox - Github Stargazers Information Gathering Tool
Read Details »
Modlishka - The Tool That Can Bypass Two-Factor Authentication Via Phishing
Read Details »
Stretcher - Tool Designed To Help Identify Open Elasticsearch Servers That Are Exposing Sensitive Information
Read Details »
Brosec – An Open Source Interactive Tool to Utilize Payloads and Commands
Read Details »
SpiderFoot - The Most Complete OSINT Collection And Reconnaissance Tool
Read Details »
Knock - Open Source Subdomain Scanner Tool
Read Details »
PhishX - Spear Phishing Tool for Capturing Credentials
Read Details »
Atlas - Quick SQLMap Tamper Suggester
Read Details »
XenoScan - Open Source Memory Scanner Written In C++
Read Details »
Ettercap - A Comprehensive Suite For Man In The Middle Attacks
Read Details »
BadKarma - Advanced Network Reconnaissance Toolkit
Read Details »
XAttacker Tool – Scan and Auto Exploit Web Vulnerabilities
Read Details »
PMapper - A Tool For Quickly Evaluating IAM Permissions In AWS
Read Details »
Ridrelay - Quick And Easy Way To Get Domain Usernames While On An Internal Network
Read Details »
PhpSploit - Stealth Post-Exploitation Framework
Read Details »
PE Linux - Linux Privilege Escalation Tool
Read Details »
VOOKI - Web Application Vulnerability Scanner
Read Details »
Black Owl - Tool To Gather Information, based On Operative-Framework
Read Details »
MSDAT - Microsoft SQL Database Attacking Tool
Read Details »
Autopwn v2.0 : Metasploit Automation Tool
Read Details »
GPON - Python Exploit For Remote Code Executuion On GPON Home Routers (CVE-2018-10562)
Read Details »
Mimic - A Tool For Covert Execution In Linux
Read Details »
Aircrack - the password cracking tool
Read Details »
CLOUDKiLL3R - Bypasses Cloudflare Protection Service Via TOR Browser
Read Details »
VoIP Sniffer: UCSniff
Read Details »
OWASP ZSC – Obfuscated Code Generator Tool
Read Details »
Sublist3r – Fast Python Subdomain Enumeration Tool
Read Details »
Acunetix WVS
Read Details »
Wireshark: Web vulnerability scanner
Read Details »
UFTP - UDP based FTP with encryption
Read Details »
Android hacking 'APK'
Read Details »
Executable Compression demystified
Read Details »
BitCracker – Password Cracking Tool
Read Details »
BloodHound – Red / Blue teaming tool for AD attacks
Read Details »Exclusive Blog
Read All Exclusive Blog »
With world working from home, it's time to make it enjoyable and effective.
Read DetailsBreaking News
Breaking News Of Each Month »
The recent pandemic was unexpected and unknown to most part of the world. It has changed our life and we are slowly adapting to our new lifestyle. The risks associated with the new lifestyle, both personal & corporate, are unknown to most of us.
Read Details