Python low-interaction honeyclient

Related tags

Security related resourcespythonshellcodevirustotalsecurity-toolshoneyclientclient-honeypotlow-interaction
Overview

Thug

version badge github badge lgtm badge codefactor badge codecov badge bandit badge

The number of client-side attacks has grown significantly in the past few years shifting focus on poorly protected vulnerable clients. Just as the most known honeypot technologies enable research into server-side attacks, honeyclients allow the study of client-side attacks.

A complement to honeypots, a honeyclient is a tool designed to mimic the behavior of a user-driven network client application, such as a web browser, and be exploited by an attacker's content.

Thug is a Python low-interaction honeyclient aimed at mimicing the behavior of a web browser in order to detect and emulate malicious contents.

Documentation

docs badge

Documentation about Thug installation and usage can be found at http://thug-honeyclient.readthedocs.io/.

Contributions

donate badge

Thug is open source and we welcome contributions in all forms!

Thug is free to use for any purpose (even commercial ones). If you use and appreciate Thug, please consider supporting the project with a donation using Paypal.

Testing

To run the full test suite using tox, run the command:

tox

Since tox builds and installs dependencies from scratch, using pytest for faster testing is recommended:

pytest --cov thug

License information

Copyright (C) 2011-2021 Angelo Dell'Aera <[email protected]>

License: GNU General Public License, version 2

Comments
  • Add support for WScriptNetwork object.

    Add support for WScriptNetwork object.

    Adds support for the WScriptNetwork object which was used in some recent samples.

    Ideally the attributes shouldn't be static but retrieved using WScriptShell.ExpandEnvironmentStrings(). Any comments on how to do that?

    Also did some improvements on the Scripting.FileSystemObject module.

    enhancement 
    opened by tweemeterjop 17
  • Thug not properly handling redirects logging

    Thug not properly handling redirects logging

    Hi! Let's take a look at this situation: At hxxp://localhost:1337/ek_tests/dummy_redirect_chain/exploit.html some code was added by nasty hacker.

    <html>
<head>
<title>Dummy sploit</title>
</head>
<body>
<!-- malicious code start -->
<script src="javascript.php?option=0"></script>
<!-- malicious code end -->
</body>
</html>

    That code redirects (indirectly) to (imaginated) exploit kit's gate (that uses alert(1) from js as exploit). It creates some new scripts on the way to gate. At the backend side, it looks like this:

    <?php
/**
* javascript.php
*/
$i = $_GET['option'];
$to_write = "";
switch ($i) {
    case 0:
        $to_write =  "var script = document.createElement('script');
script.src = 'javascript.php?option=1';
document.body.appendChild(script);";
        break;
    case 1:
        header('Location: javascript.php?option=2');
        break;
    case 2:
        $to_write = "document.write(\"<iframe src='iframe.php?option=1'></iframe>\");";
        break;
   case 3:
        $to_write =  "var script = document.createElement('script');
script.src = 'javascript.php?option=4';";
    case 4:
       $to_write = "alert('1');";
}
echo $to_write;
?>

    Also uses iframes

    <?php
/**
* iframe.php
*/
$i = $_GET['option'];
$to_write = "";
switch ($i) {
    case 0:
        $to_write =  "var script = document.createElement('script');
script.src = 'javascript.php?option=1';";
        break;
    case 1:
        $to_write = "<script src='javascript.php?option=3'></script>";
        break;
    case 2:
        $to_write = "document.write(\"<iframe src='iframe.php?option=1'></iframe>\");";
        break;
   case 3:
        $to_write =  "var script = document.createElement('script');
script.src = 'javascript.php?option=4';";
    case 4:
       $to_write = "document.alert(1);";
}
echo '<html><head></head><body>';
echo $to_write;
echo '</body></html>';
?>

    When user (thug) enters that site, it produces some redirects with alert(1) at the end. It looks like this: http://svgur.com/i/1XW.svg - graph made by thug itself.

    The problem is: Even if one script leads to another, we are not informed about that. We cannot build proper redirect chains for that redirections. We get such output:

     | -> 1    / (2->3 redirected by HTTP Location header)
0| -> 2 -> 3
 | -> 4

    Even if that really should be:

    0 -> 1 -> 2 -> 3 -> 4

    I know that this is caused by, for example, that newly created scripts are executed within base (0's) DOM. I believe we could somehow get information about real source of some action from V8. It is critical aspect for analysis of web threats, because at the moment we don't really know what part of website is malicious, and what is not. Also, thanks for a great tool :)

    enhancement 
    opened by internaldefect 16
  • new version - missing graph.svg

    new version - missing graph.svg

    Using thug via docker installation, very good tool. Recently installed the new version but it seems the graph.svg file is not being created within the analysis folder.

    Is this feature removed completely or can it be enabled?

    Thanks

    configuration 
    opened by arunkhan1984 13
  • First time set-up problems.

    First time set-up problems.

    Hi, firstly I am on Ubuntu 16.04 and have gone through the Thug installation guide multiple time and am currently stuck as where to go from here. I installed all packages except HoneyAgent & VirusTotal (both optional). My problem is that when I run thug --list-ua I get this:

    
[2017-03-28 10:11:03] [HTML Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [HTML Classifier] Skipping not existing default filter file
[2017-03-28 10:11:03] [JS Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [JS Classifier] Skipping not existing default filter file
[2017-03-28 10:11:03] [VBS Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [VBS Classifier] Skipping not existing default filter file
[2017-03-28 10:11:03] [URL Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [URL Classifier] Skipping not existing default filter file
[2017-03-28 10:11:03] [Sample Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [Sample Classifier] Skipping not existing default filter file
[2017-03-28 10:11:03] [Text Classifier] Skipping not existing default classification rule file
[2017-03-28 10:11:03] [Text Classifier] Skipping not existing default filter file

Synopsis:
    Thug: Pure Python honeyclient implementation

    Available User-Agents:

    So lots of skipping, I don't know if that is a problem but no User-Agents? Also when I try to run Thug I get the following:

    [2017-03-28 10:15:41] [HTML Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [HTML Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [JS Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [JS Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [VBS Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [VBS Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [URL Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [URL Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [Sample Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [Sample Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [Text Classifier] Skipping not existing default classification rule file
[2017-03-28 10:15:41] [Text Classifier] Skipping not existing default filter file
[2017-03-28 10:15:41] [WARNING] VirusTotal disabled (no configuration file found)
[2017-03-28 10:15:41] [CRITICAL] Logging subsystem not initialized (configuration file not found)
Traceback (most recent call last):
  File "/usr/local/bin/thug", line 11, in <module>
    sys.exit(main())
  File "/usr/local/lib/python2.7/dist-packages/thug/thug.py", line 334, in main
    Thug(sys.argv[1:])()
  File "/usr/local/lib/python2.7/dist-packages/thug/ThugAPI/ThugAPI.py", line 86, in __call__
    self.analyze()
  File "/usr/local/lib/python2.7/dist-packages/thug/thug.py", line 324, in analyze
    ThugPlugins(PRE_ANALYSIS_PLUGINS, self)()
  File "/usr/local/lib/python2.7/dist-packages/thug/Plugins/ThugPlugins.py", line 44, in __init__
    self.get_plugins()
  File "/usr/local/lib/python2.7/dist-packages/thug/Plugins/ThugPlugins.py", line 68, in get_plugins
    for p in os.listdir(PLUGINS_PATH):
OSError: [Errno 2] No such file or directory: '/etc/thug/plugins'

    I have followed the installation guide step by step and it is now at the Usage section? Am I meant to install the Docker too or is there something else I have missed?

    Thank you for your help in advance!

    opened by Waffles-2 11
  • ReferenceError

    ReferenceError

    There is malicious code and normal code in javascript. If a reference error occurs in the normal code, the malicious code will not be analyzed in the future. Can I pass(skip) the reference error?... and then I want to continue analyzing the malicious code

    [2018-11-12 21:47:41] Traceback (most recent call last):    File "/usr/lib/python2.7/site-packages/thug-0.9.37-py2.7.egg/thug/Debugger/Shellcode.py", line 162, in run      result = self.ctxt.eval (self.script) ReferenceError: ReferenceError: functions is not defined (@ 1: 0) -> functions.validateAndSubmitForm ();

    not an issue 
    opened by parknom 10
  • Data in mongodb

    Data in mongodb

    Hi, I wonder how possible it would be to push most of the data in analysis.xml/avlog.json and graph.svg into mongodb so it can be used by eg. a web interface.

    I really want to use thug, but I find the lack of a web interface for viewing the reports quite the problem.

    Ideally I guess a JSON version of the MAEC schema would be the best, but that kinda goes against the MAEC specifications, for now.. :)

    An example of a web interface I could make with having all the data in mongodb could be something like http://two.mrfjo.org/02906d5b-a7cd-47f8-9885-6e80eecf967a/

    enhancement 
    opened by espenfjo 10
  • Fix infinite recursion problem in Window.__getattr__

    Fix infinite recursion problem in Window.__getattr__

    Window object has infinite recursion when the following two conditions:

    1. Check whether the V8 JSContext has been initialized through getattr(). It would be a lookup loop which always calls getattr() since the code uses self.context before initializing V8 JSContext.

    Fix by: Raise attribute error if getattribute() can't find "_context" variable.

    1. Get the nonexistent variable or function by "self.context.eval(name)". When V8 JSContext can't find the variable, it will call getattr() again. It also becomes a lookup loop.

    Fix by: Avoid to call getattr() from V8Context internal.

    > python -m cProfile thug.py -l ../samples/Events/testEvent10.html

    Before fix: ncalls tottime percall cumtime percall filename:lineno(function) 588/5 0.193 0.000 0.759 0.152 Window.py:138(getattr) 6825 0.003 0.000 0.003 0.000 Window.py:196(window) 616/344 0.378 0.001 0.599 0.002 Window.py:850(context)

    After fix: ncalls tottime percall cumtime percall filename:lineno(function) 55/37 0.014 0.000 0.014 0.000 Window.py:139(getattr) 35 0.000 0.000 0.000 0.000 Window.py:206(window) 82/4 0.004 0.000 0.020 0.005 Window.py:860(context)

    opened by Joseph-CHC 10
  • javascript that fools thug

    javascript that fools thug

    Saw this on a landing page, thug did not follow it:

    <script type="text/javascript">
    setTimeout("testTime()", 0);
    function testTime() {
        location = "/";
    }
 </script>
    defect 
    opened by evilscheme 10
  • ImportError: libemu.so.2: cannot open shared object file: No such file or directory

    ImportError: libemu.so.2: cannot open shared object file: No such file or directory

    I have successfully installed V8 and PyV8. i have tested it and the result is OK.

    but while i was executing python thug.py -h,, the error was appeared. the errors look like:

    [email protected]:/home/kafin/thug/src# sudo python thug.py -h Traceback (most recent call last): File "thug.py", line 31, in from DOM import Window, DFT, MIMEHandler, SchemeHandler File "/home/kafin/thug/src/DOM/Window.py", line 32, in from .Location import Location File "/home/kafin/thug/src/DOM/Location.py", line 22, in import DFT File "/home/kafin/thug/src/DOM/DFT.py", line 20, in import pylibemu ImportError: libemu.so.2: cannot open shared object file: No such file or directory

    anyone got also this error, or how do i solve this?

    thanks

    opened by kafin 10
  • Problem with shellcode encoding - MongoDB logging

    Problem with shellcode encoding - MongoDB logging

    Hello, I think that the shellcode is not properly handled and stored in MongoDB. I get error messages like this one when thug tries to decode the hex encoded shellcode:

    ...
  File "/usr/local/lib/python2.7/dist-packages/thug/Logging/ThugLogging.py", line 125, in add_shellcode_snippet
    m(snippet, language, relationship, tag.hex, method)
  File "/usr/local/lib/python2.7/dist-packages/thug/Logging/modules/MongoDB.py", line 416, in add_code_snippet
    'snippet'      : self.fix(snippet),
  File "/usr/local/lib/python2.7/dist-packages/thug/Logging/modules/MongoDB.py", line 408, in fix
    return thug_unicode(data).replace("\n", "").strip()
UnicodeDecodeError: 'ascii' codec can't decode byte 0xeb in position 4: ordinal not in range(128)

    The problem is that the shellcode contains non printable characters and thus can not be stored in decoded form. Also even when it is possible to decode the shellcode from unicode encoding the output is not as useful as the original hex encoded form. This exception also breaks the analysis and thus it is not properly finished. I think that the shellcode should not be decoded and should be stored in its original form. What do you think about that? Thank you.

    Stanislav

    defect 
    opened by standa4 9
  • Timeout option not working properly

    Timeout option not working properly

    Hello Is it possible that the timeout option (-T) is not working as intended? I was scanning some targets that take a long time or never finish at all (longer than the 600s default timeout), where I noticed that the runs actually don't finish after the default timeout. I still see the timeout message in the log: [2019-03-19 09:09:30] The analysis took more than 60 second(s). Aborting! however the run is not stopped as result, rather it continues as if nothing happened. The same behaviour was occurring after choosing different targets and a shorter timeout.

    I am running thug inside a docker container and am starting the scans with the following command (short timeout for testing purposes): docker run --rm -it buffer/thug thug -T 10 -d <target url>

    I am misinterpreting what the timeout option is for? I am assuming it should abort the scan as soon as the timeout is reached, but maybe that is not the case.

    defect docker 
    opened by PinkSheep 8
Releases(v4.7)
Owner
Angelo Dell'Aera
Linux kernel hacker, deeply interested in every facet of computer and information security, intensely involved in exploring and analyzing new emerging threats.
Angelo Dell'Aera
GitHub Repository
Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead (< v3.6.5) if the CGI is enabled and a CGI program is dynamically linked.

GoAhead RCE Exploit Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead ( v3.6.5) if the CGI is enabled and a CGI program is dynamic

Francisco Spínola 2 Dec 12, 2021
Midas ELF64 Injector is a tool that will help you inject a C program from source code into an ELF64 binary.

Midas ELF64 Injector Description Midas ELF64 Injector is a tool that will help you inject a C program from source code into an ELF64 binary. All you n

midas 20 Dec 24, 2022
Getting my gitlab commit history into github

🔰 ᵀᴱᴸᴱᴳᴿᴬᴹ ᴴᴬᶜᴷ ᴮᴼᵀ 🔰 The owner would not be responsible for any kind of bans due to the bot. • ⚡ INSTALLING ⚡ • • 🛠️ Lᴀɴɢᴜᴀɢᴇs Aɴᴅ Tᴏᴏʟs 🔰 • If

Santiago Chiesa 1 Dec 24, 2021
command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validatio

Aiminsun 165 Dec 21, 2022
Fetch Chrome, Firefox, WiFi password and system info

DISCLAIMER : OUR TOOLS ARE FOR EDUCATIONAL PURPOSES ONLY. DON'T USE THEM FOR ILLEGAL ACTIVITIES. YOU ARE THE ONLY RESPONSABLE FOR YOUR ACTIONS! OUR TO

Genos 59 Nov 17, 2022
C++ fully undetected shellcode launcher

charlotte c++ fully undetected shellcode launcher ;) releasing this to celebrate the birth of my newborn description 13/05/2021: c++ shellcode launche

894 Dec 25, 2022
Deobfuscate Log4Shell payloads with ease

Ox4Shell Deobfuscate Log4Shell payloads with ease. Description Since the release

Oxeye 137 Jan 02, 2023
Uma ferramenta de segurança da informação escrita em python3,capaz de dar acesso total ao computador de alguém!

shell-reverse Uma ferramenta de segurança da informação escrita em python3, capaz de dar acesso total ao computador de alguém! A cybersecurity tool wr

Marcus Vinícius Ribeiro Andrade 1 Nov 03, 2021
A web-app helping to create strong passwords that are easy to remember.

This is a simple Web-App that demonstrates a method of creating strong passwords that are still easy to remember. It also provides time estimates how long it would take an attacker to crack a passwor

2 Jun 04, 2021
TightVNC Vulnerability.

CVE-2022-23967 In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbprot

MaherAzzouzi 15 Jul 11, 2022
We protect the privacy of the data on your computer by using the camera of your Debian based Pardus operating system. 🕵️

Pardus Lookout We protect the privacy of the data on your computer by using the camera of your Debian based Pardus operating system. The application i

Ahmet Furkan DEMIR 19 Nov 18, 2022
Osint-Tool - Information collection tool in python

Osint-Tool Herramienta para la recolección de información Pronto más opciones In

3 Apr 09, 2022
Generate your own NFTs and their metadata based on your desired probabilities.

Generate your own NFTs and their metadata based on your desired probabilities. Use your own art assets too! Perfect for use with Candy Machine.

hex 7 Sep 16, 2022
Phoenix Framework is an environment for writing, testing and using exploit code.

Phoenix-Framework Phoenix Framework is an environment for writing, testing and using exploit code. 🖼 Screenshots 🎪 Community PwnWiki Forums 🔑 Licen

Felix 42 Aug 09, 2022
Scarecrow is a tool written in Python3 allowing you to protect your Python3 scripts.

🕷️ Scarecrow 🕷️ Scarecrow is a tool written in Python3 allowing you to protect your Python3 scripts. It looks for processes with specific names to v

Billy 33 Sep 28, 2022
PasswordManager is a command-line program that helps you manage your secret files like passwords

PasswordManager is a command-line program that helps you manage your secret files like passwords. It's very minimalistic and easy to use.

Michael 3 Dec 30, 2021
A bare-bones POC container runner in python

pybox A proof-of-concept bare-bones container written in 50 lines of python code. Provides namespace isolation and resource limit control Usage Insta

Anirudh Haritas Murali 5 Jun 03, 2021
Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading The script

Víctor García 187 Jan 03, 2023
Just another script for automatize boolean-based blind SQL injections.

SQL Blind Injection Tool A script for automatize boolean-based blind SQL injections. Works with SQLite at least, supports using cookies. It uses bitwi

RIM 51 Dec 15, 2022
Hack computer in the form of RAR files from all types of clients, even Linux

Program Features 📌 Hide malware 📌 Vulnerability software vulnerabilities RAR 📌 Creating malware 📌 Access client files 📌 Client Hacking 📌 Link Do

hack4lx 5 Nov 25, 2022