Gcat – Python Backdoor Using Gmail For Command & Control

Outsmart Malicious Hackers


Gcat is a stealthy Python backdoor that uses Gmail as a command and control server. It’s fairly basic right now, but it’s an interesting proof of concept and if the community got behind it and contributed some new features it could be a pretty powerful piece of kit.

Gcat - Python Backdoor Using Gmail For Command & Control

Feature wise it doesn’t have that much, you can’t upload files yet, but you can execute shellcode, download files and capture screenshots.

But as a concept it’s great, e-mail traffic? How many organisations will block that, especially to Google servers. Way less conspicuous than the typical IRC traffic.

Setup

For this to work you need:

  • A Gmail account (Use a dedicated account! Do not use your personal one!)
  • Turn on “Allow less secure apps” under the security settings of the account

This repo contains two files:

  • gcat.py a script that’s used to enumerate and issue commands to available clients
  • implant.py the actual backdoor to deploy

In both files, edit the gmail_user and gmail_pwd variables with the username and password of the account you previously setup.

You’re probably going to want to compile implant.py into an executable using Pyinstaller.

Options


Using Gcat

Once you’ve deployed the backdoor on a couple of systems, you can check available clients using the list command:

The output is a UUID string that uniquely identifies the system and the OS the implant is running on

Let’s issue a command to an implant:

Here we are telling 90b2cd83-cb36-52de-84ee-99db6ff41a11 to execute ipconfig /all, the script then outputs the jobid that we can use to retrieve the output of that command

Lets get the results!

Upcoming Features

  • Multi-platform support
  • Command to upload files
  • Transport crypto & obfuscation

You can download Gcat here:

Gcat-master.zip

Or read more here.

Posted in: Hacking Tools, Secure Coding

, , , , ,


Latest Posts:


CloudFrunt - Identify Misconfigured CloudFront Domains CloudFrunt – Identify Misconfigured CloudFront Domains
CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions.
Airbash - Fully Automated WPA PSK Handshake Capture Script Airbash – Fully Automated WPA PSK Handshake Capture Script
Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.
XXEinjector - Automatic XXE Injection Tool For Exploitation XXEinjector – Automatic XXE Injection Tool For Exploitation
XXEinjector is an XXE Injection Tool that automates retrieving files using direct and out of band methods. Directory listing only works in Java applications.
Yahoo! Fined 35 Million USD For Late Disclosure Of Hack Yahoo! Fined 35 Million USD For Late Disclosure Of Hack
Ah Yahoo! in trouble again, this time the news is Yahoo! fined for 35 million USD by the SEC for the 2 year delayed disclosure of the massive hack, we actually reported on the incident in 2016 when it became public.
Drupwn - Drupal Enumeration Tool & Security Scanner Drupwn – Drupal Enumeration Tool & Security Scanner
Drupwn is a Python-based Drupal Enumeration Tool that also includes an exploit mode, which can check for and exploit relevant CVEs.
MyEtherWallet DNS Hack Causes 17 Million USD User Loss MyEtherWallet DNS Hack Causes 17 Million USD User Loss
Big news in the crypto scene this week was that the MyEtherWallet DNS Hack that occured managed to collect about $17 Million USD worth of Ethereum in just a few hours.


One Response to Gcat – Python Backdoor Using Gmail For Command & Control

  1. Jose Selvi September 19, 2015 at 3:36 pm #

    Similar idea than a tool that a released some time ago, called “FaceCat” (it uses FaceBook):

    https://github.com/PentesterES/FaceCat
    https://www.sans.org/reading-room/whitepapers/engineering/covert-channels-social-networks-33960

    Probably “FaceCat” isn’t working anymore. I haven’t update the HTML parsing for a long time, but it’s a good example that you can use covert channels in almost any application or service (Gmail, FaceBook, whatever).