Notes

#!/usr/bin/env python3

import argparse
import requests
import hashlib
import json
import os
from urllib.parse import urlparse
import hashlib
import datetime

def xor(data, key):
"""xor function

Arguments:
- data(bytearray): data to XOR
- key(bytearray): key used to xor
"""
result = bytearray()
for (i, char) in enumerate(data):
result.append( char ^ key[ i % len(key)])

return result

class Cmd:
"""Skeleton class for basic CnC command structure

Attributes:
- cmd(str): Type of command
"""
def __init__(self, cmd="", args=None):
self.cmd = cmd
if args:
self.args = args
else:
self.args = []

def forge_data(self):
"""forge the commande for the request"""
return self.cmd + "|" + "|".join(self.args)

class CmdInjects(Cmd):
""" Web injects commands"""
def __init__(self):
Cmd.__init__(self, cmd="injects")

class CmdPing(Cmd):
""" Ping command"""
def __init__(self):
Cmd.__init__(self, cmd="ping")

class CmdBinary(Cmd):
""" request binaries"""
def __init__(self, args):
Cmd.__init__(self, cmd="bin", args=args)

class TinyNuke:
""" Class used to communicate with the CnC

Attributes:
- panel(str): Client panel url
- directory(str): Dump directory for all retrieve information
- key(str): key used to encrypt/decrypt the communication
"""
def __init__(self, panel, args):

self.args = args
self.panel = panel
self.urlparse = urlparse(self.panel)
self.directory = self.args.dir
self.uhid = b"92E63FCC5C3B43DD"

sha1 = hashlib.sha1()
sha1.update(self.uhid)
self.key = sha1.hexdigest().encode("utf8")

# Directory check
self.directory = os.path.join(args.dir, self.urlparse.netloc)
self.directory = os.path.join(self.directory, datetime.datetime.now().strftime("%Y-%m-%d_%H:%M"))

try:
os.stat(self.directory)
except:
os.makedirs(self.directory, exist_ok=True)

self.report = Report(self.directory)

def dump(self, name, data):
"""Dumps data in a file

Attributes:
- name(str): filename
- data(bytearray): Data to save
"""
path = os.path.join(self.directory, name)

with open(path, 'wb') as f:
f.write(data)

print("[+] Data was dumped {}".format(path))

def requests(self, data):
"""send data to the cnc client page

Arguments:
- data(str): Data to send to the CnC

Returns:
If failed None is return else is the decrypted response (type bytearray)
"""
enc_data = xor(data.encode("utf8"), self.key)
url = "{}?{}".format(self.panel,self.uhid.decode("utf8"))

# send request
r = requests.post(url, data=enc_data)

# status check
if r.status_code != 200:
print("[e] Problem during the request")
return None
else:
print("[i] Data [{}] was sent".format(data))

return xor(r.content, self.key)

def webinjects(self):
"""Retrieve webinject from the CnC"""

print("[i] Searching for webinjects ...")
cmd = CmdInjects()
res = self.requests(cmd.forge_data())

if res:
self.dump("injects.json", res)
if self.args.report:
self.report.webinjects(res)


def ping(self):
"""Retrieve webinject from the CnC"""
cmd = CmdPing()
print(cmd.forge_data())
self.requests(cmd.forge_data())

def binary(self):
"""Retrieve binaries from the CnC"""
print("[i] Searching for binaries ...")
# x86
cmd = CmdBinary(args=["int32"])
res = self.requests(cmd.forge_data())

if res:
self.dump("x86.bin", res)

if self.args.report:
self.report.binary(res, "x86")


# x64
cmd.args = ["int64"]
res = self.requests(cmd.forge_data())

if res:
self.dump("x64.bin", res)

if self.args.report:
self.report.binary(res, "x64")

class Report:

def __init__(self, directory):
self.report = []
self.path = os.path.join(directory, "report.txt")
self.header()

def header(self):
header = """|=-----------------------------------------------------------------------=|
|=-----------------------------------------------------------------------=|
|=-----------------------------------------------------------------------=|
|=------------------------=[ TinyNuke Report]=---------------------------=|
|=-----------------------------------------------------------------------=|
|=-----------------------------------------------------------------------=|
|=-----------------------------------------------------------------------=|
nnn"""
self.report.append(header)
def sep(self, string):
return "{:#^80}nn".format(string)

def webinjects(self, data):

self.report.append(self.sep("WebInjects"))
self.report.append(data.decode("utf8")+"nn")
self.report.append(self.sep("WebInjects Hosts"))

j = json.loads(data.decode("utf8"))
# hosts
for inject in j["injects"]:
try:
self.report.append(inject["host"] + "n")
except:
pass

self.report.append(self.sep("WebInjects Hijack"))
# hosts
for inject in j["injects"]:
try:
self.report.append(inject["hijack"] + "n")
except:
pass

def binary(self, data, type):
self.report.append(self.sep("Binary {} SHA256".format(type)))
m = hashlib.sha256()
m.update(data)
self.report.append("sha256: {}nn".format(m.hexdigest()))

def dump(self):
print("[i] Creating report ...")
with open(self.path, 'w') as f:
for line in self.report:
f.write(line)
print("[+] Report {}".format(self.path))



def usage():
"""Program Usage"""

parser = argparse.ArgumentParser(prog='tinynuke')
parser.add_argument('panel', help='TinyNuke client page (eg. http://127.0.0.1/tinynuke/client.php)')
parser.add_argument('dir', help='Dump directory (eg. /tmp/tiny/)')
parser.add_argument('-w', '--webinjects', action="store_true", help='Get TinyNuke WebInjects')
parser.add_argument('-p', '--ping', action="store_true", help='Request ping command')
parser.add_argument('-b', '--binary', action="store_true", help="retrieve 32/64 binaries from the CnC")
parser.add_argument('-r', '--report', action="store_true", help="Generate a report")
return parser.parse_args()

def main():
"""main"""
args = usage()

tiny = TinyNuke(args.panel, args)


if args.ping:
tiny.ping()

if args.binary:
tiny.binary()

if args.webinjects:
tiny.webinjects()

if args.report:
tiny.report.dump()

if __name__ == "__main__":
main()