Navigation



Gcat – Python Backdoor Using Gmail For Command & Control

Last updated: September 9, 2015 | 12,515 views

Gcat is a stealthy Python backdoor that uses Gmail as a command and control server. It’s fairly basic right now, but it’s an interesting proof of concept and if the community got behind it and contributed some new features it could be a pretty powerful piece of kit.

Gcat - Python Backdoor Using Gmail For Command & Control

Feature wise it doesn’t have that much, you can’t upload files yet, but you can execute shellcode, download files and capture screenshots.

But as a concept it’s great, e-mail traffic? How many organisations will block that, especially to Google servers. Way less conspicuous than the typical IRC traffic.

Setup

For this to work you need:

  • A Gmail account (Use a dedicated account! Do not use your personal one!)
  • Turn on “Allow less secure apps” under the security settings of the account

This repo contains two files:

  • gcat.py a script that’s used to enumerate and issue commands to available clients
  • implant.py the actual backdoor to deploy

In both files, edit the gmail_user and gmail_pwd variables with the username and password of the account you previously setup.

You’re probably going to want to compile implant.py into an executable using Pyinstaller.

Options


Using Gcat

Once you’ve deployed the backdoor on a couple of systems, you can check available clients using the list command:

The output is a UUID string that uniquely identifies the system and the OS the implant is running on

Let’s issue a command to an implant:

Here we are telling 90b2cd83-cb36-52de-84ee-99db6ff41a11 to execute ipconfig /all, the script then outputs the jobid that we can use to retrieve the output of that command

Lets get the results!

Upcoming Features

  • Multi-platform support
  • Command to upload files
  • Transport crypto & obfuscation

You can download Gcat here:

Gcat-master.zip

Or read more here.

Share264
Tweet338
Share85
Buffer
WhatsApp
Email
687 Shares
Posted in: Hacking Tools, Secure Coding

, , , , ,


Latest Posts:


zBang - Privileged Account Threat Detection Tool zBang – Privileged Account Threat Detection Tool
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations & red teams can use it to identify attack vectors
March 31, 2020 - 110 Shares
Memhunter - Automated Memory Resident Malware Detection Memhunter – Automated Memory Resident Malware Detection
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving threat hunter analysis process.
March 29, 2020 - 206 Shares
Sandcastle - AWS S3 Bucket Enumeration Tool Sandcastle – AWS S3 Bucket Enumeration Tool
Sandcastle is an Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target's name as the stem argument (e.g. shopify).
March 24, 2020 - 114 Shares
Astra - API Automated Security Testing For REST Astra – API Automated Security Testing For REST
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs.
February 27, 2020 - 572 Shares
Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
February 19, 2020 - 258 Shares
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network
February 14, 2020 - 307 Shares


One Response to Gcat – Python Backdoor Using Gmail For Command & Control

  1. Jose Selvi September 19, 2015 at 3:36 pm #

    Similar idea than a tool that a released some time ago, called “FaceCat” (it uses FaceBook):

    https://github.com/PentesterES/FaceCat
    https://www.sans.org/reading-room/whitepapers/engineering/covert-channels-social-networks-33960

    Probably “FaceCat” isn’t working anymore. I haven’t update the HTML parsing for a long time, but it’s a good example that you can use covert channels in almost any application or service (Gmail, FaceBook, whatever).