withsecurelabs/doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

doublepulsar-detection-script's Issues

SyntaxError on Centos 7

File "detect_doublepulsar_smb.py", line 7

^
SyntaxError: invalid syntax

I tired use python2 also get this error.

my python version :
Python 2.7.5 (default, Nov 6 2016, 00:28:07)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux2

any suggest or help ?

Thanks~

Error when running smb version

Traceback (most recent call last):
  File "detect_doublepulsar_smb.py", line 165, in <module>
    check_ip(ip)
  File "detect_doublepulsar_smb.py", line 117, in check_ip
    final_response = s.recv(1024)
socket.error: [Errno 104] Connection reset by peer

Doesn't matter if with or without root, doesn't matter which client.

error

am getting the below error

Kothapallys-MacBook-Pro:~ $ python detect_doublepulsar_smb.py --ip 10.40.17.204
[ERROR] [10.40.17.204] - [Errno 60] Operation timed out

any help?

INFECTED?

what need i do?

abload.de/img/cmdgss15.png

Sysntax Error

Hi
I get syntax error at line 58 when i want to run detect_doublepulsar_smb.py in Windows 8.1 command prompt.

File "C:\python\detect_doublepulsar_smb.py", line 58
print "[*] [%s] %s" % (ip, message)
^
SyntaxError: invalid syntax

timeout means?

sol@toughbook31:~/projects/doublepulsar-detection-script$ python detect_doublepulsar_smb.py --ip 184.105.4.108                                                                                                                                                                 
Traceback (most recent call last):                                                                                                                                                                                                                                             
  File "detect_doublepulsar_smb.py", line 124, in <module>                                                                                                                                                                                                                     
    check_ip(ip)                                                                                                                                                                                                                                                               
  File "detect_doublepulsar_smb.py", line 50, in check_ip                                                                                                                                                                                                                      
    s.connect((host, port))                                                                                                                                                                                                                                                    
  File "/usr/lib/python2.7/socket.py", line 228, in meth                                                                                                                                                                                                                       
    return getattr(self._sock,name)(*args)                                                                                                                                                                                                                                     
socket.error: [Errno 110] Connection timed out   

so i get a timeout. but does this mean this machine is infected or not?

tool is not working

Just downloaded and try to run this tool but getting this error on my Kali OS:

root@kali:/Desktop/doublepulsar# ./detect_doublepulsar_smb.py --ip 192.168.0.25
Traceback (most recent call last):
File "./detect_doublepulsar_smb.py", line 165, in
check_ip(ip)
File "./detect_doublepulsar_smb.py", line 117, in check_ip
final_response = s.recv(1024)
socket.error: [Errno 104] Connection reset by peer
root@kali:/Desktop/doublepulsar#

Fix ipc$ request

Please fix the ipc address.

error when running

C:\Users\dodo>C:\Users\dodo\Downloads\Compressed\doublepulsar-detection-script-master_2\doublepulsar-detection-script-master\detect_doublepulsar_smb.py --ip xxxxxxxxxx
Traceback (most recent call last):
File "C:\Users\dodo\Downloads\Compressed\doublepulsar-detection-script-master_2\doublepulsar-detection-script-master\detect_doublepulsar_smb.py", line 155, in
check_ip(ip)
File "C:\Users\dodo\Downloads\Compressed\doublepulsar-detection-script-master_2\doublepulsar-detection-script-master\detect_doublepulsar_smb.py", line 98, in check_ip
modified_trans2_session_setup[28] = tree_id[0]
IndexError: string index out of range

File formats

What file formats do the scripts work with?

I have tried it with an xml output from Masscan which throws up this error repeatedly

[Errno -2] Name or service not known

Unknown Status from Windows Server 2016

[*] [1.2.3.4] Sending negotiation request
[*] [1.2.3.4] Sending client data
[*] [1.2.3.4] Sending ping packet
[-] [1.2.3.4] Status Unknown - Response received but length was 0 not 288

Timeout when running

So I did see the other Issue about a timeout, I get a different message however.

I'm on a german Windows 10 so I will translate the error message by myself, I included the screenshot anyway.

(censored my IP)

"socket.error: [Errno 10060] An attempt to connect failed because the opposite didn't react after a certain period of time or the opened connection was faulty because the connected host didn't react"

Did I do something wrong? My internet is working, obviously.

Thanks

error when running #2

not an issue just a question !

is there any way to attack vuln hosts auto by using ip.list with metasploit ??

Validate finding by communicating with the host

So while the script finds hosts there have been several discussions on twitter regarding the authenticity of the findings. The easiest way to put these to bed is to actually utilize the ping functionality to do what it is designed to do, and to obtain some details about the host - which simply couldn't be done if the finding was a one-byte-false-positive.

The commandline version of the backdoor produces some fairly verbose output, and if this script could be modified to produce this same output, there would be zero question about false positives.

not reading ips

root@kali:~/doublepulsar-detection-script# python detect_doublepulsar_smb.py --ip 0.0.0.0
Traceback (most recent call last):
File "detect_doublepulsar_smb.py", line 124, in
check_ip(ip)
File "detect_doublepulsar_smb.py", line 50, in check_ip
s.connect((host, port))
File "/usr/local/lib/python2.7/socket.py", line 228, in meth
return getattr(self._sock,name)(*args)
socket.error: [Errno 111] Connection refused

hi can i please get will with this erros? thank you

[Errno 104] Connection reset by peer

Hello,

I have a problem when i start a scan, he return this error :

[Errno 104] Connection reset by peer

I try with different IP, small amount of IP work.

Do you know what is it ?

Script not working

It seems as though this script doesn't work for me. I'm on the most recent version of kali-rolling. Here is my input-output.

Input:
python detect_doublepulsar.py --ip 192.168.1.19

Output:
Traceback (most recent call last):
File "detect_doublepulsar.py", line 124, in
check_ip(ip)
File "detect_doublepulsar.py", line 98, in check_ip
final_response = s.recv(1024)
socket.error: [Errno 104] Connection reset by peer

Add exception handling when the --ip option is used

Both scripts barf badly if an exception occurs (e.g., a timeout) when scanning a single IP address using the --ip option. The reason is because while the check is surrounded by proper exception handling when scanning multiple IPs via the --file option, this exception handling is missing when scanning a single IP. Please add it; it's trivial.

if ip:
#    check_ip(ip)
    try:
        check_ip(ip)
    except Exception as e:
        with print_lock:
            print "[ERROR] [%s] - %s" % (ip, e) 

[Q] --timeout switch is not working properly !!??

script for scanning list of ip's, it unnessesarily waiting too much for the replay.