beetlechunks/redsails

RedSails is a Python based post-exploitation project aimed at bypassing host based security monitoring and logging. DerbyCon 2017 Talk: https://www.youtube.com/watch?v=Ul8uPvlOsug

Redsails

About

A post-exploitation tool capable of:

• maintaining persistence on a compromised machine
• subverting many common host event logs (both network and account logon)
• generating false logs / network traffic

Based on [PyDivert] (https://github.com/ffalcinelli/pydivert), a Python binding for WinDivert, a Windows driver that allows user-mode applications to capture/modify/drop network packets sent to/from the Windows network stack.

Built for Windows operating systems newer than Vista and Windows 2008 (including Windows 7, Windows 8 and Windows 10).

Dependencies

Redsails has dependencies PyDivert and WinDivert. You can resolve those dependencies by running:

pip install pydivert

pip install pbkdf2

Pycrypto is also needed.

easy_install pycrypto

Pycrypto may have a dependency on [Microsoft Visual C++ Compiler for Python 2.7] (http://aka.ms/vcpython27)

Usage

• Server (victim host you are attacking)

  redSails.py

  Or if the victim does not have python installed, you can run provided exe (or compile your own! instructions below)

  `redSails.exe

• Client (attacker)

  redSailsClient.py <ip> <port>

Creating an executable

To compile an exe (for deployment) inlieu of the python script, you will need pyinstaller:

pip install pyinstaller

Then you can create the exe:

pyinstaller-script.py -F --clean redSails.spec

License

Copyright (C) 2017 Robert J. McDown, Joshua Theimer

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.

redsails's Issues

Pyinstaller Generated Executable Fails on Windows 7

Installed prerequisites per README, building on Windows 7
Generated binary with unmodified repo using pyinstaller -F --clean redSails.spec [SUCCESS]
Running generated executable fails, and it looks like a problem with AES?:

C:\Repos\redsails\dist>dir
 Volume in drive C is OS
 Volume Serial Number is B053-3D1A

 Directory of C:\Repos\redsails\dist

09/28/2017  08:51 AM    <DIR>          .
09/28/2017  08:51 AM    <DIR>          ..
09/28/2017  08:51 AM    <DIR>          redSails
09/28/2017  08:51 AM         7,244,906 redSails.exe
               1 File(s)      7,244,906 bytes
               3 Dir(s)  40,497,778,688 bytes free

C:\Repos\redsails\dist>redSails.exe
Traceback (most recent call last):
  File "redSails.py", line 7, in <module>
  File "c:\users\user147\appdata\local\temp\pip-build-kpzegc\pyinstaller\PyInstaller\loader\pyimod03_importers.py", line
 396, in load_module
  File "rsRemote\rsConnections.py", line 7, in <module>
  File "c:\users\user147\appdata\local\temp\pip-build-kpzegc\pyinstaller\PyInstaller\loader\pyimod03_importers.py", line
 396, in load_module
  File "rsCrypto\rsCrypto.py", line 5, in <module>
  File "c:\users\user147\appdata\local\temp\pip-build-kpzegc\pyinstaller\PyInstaller\loader\pyimod03_importers.py", line
 396, in load_module
  File "build\bdist.win32\egg\Crypto\Cipher\AES.py", line 50, in <module>
  File "c:\users\user147\appdata\local\temp\pip-build-kpzegc\pyinstaller\PyInstaller\loader\pyimod03_importers.py", line
 396, in load_module
  File "build\bdist.win32\egg\Crypto\Cipher\_AES.py", line 7, in <module>
  File "build\bdist.win32\egg\Crypto\Cipher\_AES.py", line 6, in __bootstrap__
ImportError: DLL load failed: The specified module could not be found.
[6124] Failed to execute script redSails

Thanks,

GP147

Why I can not compile successfully run.

ImportError: DLL load failed: 找不到指定的模块。

windows 7 64-bit
python27
pyinstaller-script.py 4.0.dev0+9dd34bdfba