Navigation



Gcat – Python Backdoor Using Gmail For Command & Control

Last updated: September 9, 2015 | 13,301 views

Gcat is a stealthy Python backdoor that uses Gmail as a command and control server. It’s fairly basic right now, but it’s an interesting proof of concept and if the community got behind it and contributed some new features it could be a pretty powerful piece of kit.

Gcat - Python Backdoor Using Gmail For Command & Control

Feature wise it doesn’t have that much, you can’t upload files yet, but you can execute shellcode, download files and capture screenshots.

But as a concept it’s great, e-mail traffic? How many organisations will block that, especially to Google servers. Way less conspicuous than the typical IRC traffic.

Setup

For this to work you need:

  • A Gmail account (Use a dedicated account! Do not use your personal one!)
  • Turn on “Allow less secure apps” under the security settings of the account

This repo contains two files:

  • gcat.py a script that’s used to enumerate and issue commands to available clients
  • implant.py the actual backdoor to deploy

In both files, edit the gmail_user and gmail_pwd variables with the username and password of the account you previously setup.

You’re probably going to want to compile implant.py into an executable using Pyinstaller.

Options


Using Gcat

Once you’ve deployed the backdoor on a couple of systems, you can check available clients using the list command:

The output is a UUID string that uniquely identifies the system and the OS the implant is running on

Let’s issue a command to an implant:

Here we are telling 90b2cd83-cb36-52de-84ee-99db6ff41a11 to execute ipconfig /all, the script then outputs the jobid that we can use to retrieve the output of that command

Lets get the results!

Upcoming Features

  • Multi-platform support
  • Command to upload files
  • Transport crypto & obfuscation

You can download Gcat here:

Gcat-master.zip

Or read more here.

Share264
Tweet338
Share85
Buffer
WhatsApp
Email
687 Shares
Posted in: Hacking Tools, Secure Coding

, , , , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
July 7, 2021 - 73 Shares
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
May 27, 2021 - 215 Shares
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
May 7, 2021 - 94 Shares
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 203 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 230 Shares
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
February 3, 2021 - 160 Shares


One Response to Gcat – Python Backdoor Using Gmail For Command & Control

  1. Jose Selvi September 19, 2015 at 3:36 pm #

    Similar idea than a tool that a released some time ago, called “FaceCat” (it uses FaceBook):

    https://github.com/PentesterES/FaceCat
    https://www.sans.org/reading-room/whitepapers/engineering/covert-channels-social-networks-33960

    Probably “FaceCat” isn’t working anymore. I haven’t update the HTML parsing for a long time, but it’s a good example that you can use covert channels in almost any application or service (Gmail, FaceBook, whatever).