Gcat – Python Backdoor Using Gmail For Command & Control


Gcat is a stealthy Python backdoor that uses Gmail as a command and control server. It’s fairly basic right now, but it’s an interesting proof of concept and if the community got behind it and contributed some new features it could be a pretty powerful piece of kit.

Gcat - Python Backdoor Using Gmail For Command & Control

Feature wise it doesn’t have that much, you can’t upload files yet, but you can execute shellcode, download files and capture screenshots.

But as a concept it’s great, e-mail traffic? How many organisations will block that, especially to Google servers. Way less conspicuous than the typical IRC traffic.

Setup

For this to work you need:

  • A Gmail account (Use a dedicated account! Do not use your personal one!)
  • Turn on “Allow less secure apps” under the security settings of the account

This repo contains two files:

  • gcat.py a script that’s used to enumerate and issue commands to available clients
  • implant.py the actual backdoor to deploy

In both files, edit the gmail_user and gmail_pwd variables with the username and password of the account you previously setup.

You’re probably going to want to compile implant.py into an executable using Pyinstaller.

Options


Using Gcat

Once you’ve deployed the backdoor on a couple of systems, you can check available clients using the list command:

The output is a UUID string that uniquely identifies the system and the OS the implant is running on

Let’s issue a command to an implant:

Here we are telling 90b2cd83-cb36-52de-84ee-99db6ff41a11 to execute ipconfig /all, the script then outputs the jobid that we can use to retrieve the output of that command

Lets get the results!

Upcoming Features

  • Multi-platform support
  • Command to upload files
  • Transport crypto & obfuscation

You can download Gcat here:

Gcat-master.zip

Or read more here.

Posted in: Hacking Tools, Secure Coding

, , , , ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


One Response to Gcat – Python Backdoor Using Gmail For Command & Control

  1. Jose Selvi September 19, 2015 at 3:36 pm #

    Similar idea than a tool that a released some time ago, called “FaceCat” (it uses FaceBook):

    https://github.com/PentesterES/FaceCat
    https://www.sans.org/reading-room/whitepapers/engineering/covert-channels-social-networks-33960

    Probably “FaceCat” isn’t working anymore. I haven’t update the HTML parsing for a long time, but it’s a good example that you can use covert channels in almost any application or service (Gmail, FaceBook, whatever).