RAASnet es un proyecto escrito en Python que se creó para demostrar lo fácil que es desarrollar ransomware y estudiar o analizar su funcionamiento. El script se encuentra disponible para Microsoft Windows, GNU/Linux y MacOS. En Microsoft Windows se recomienda compilar payload.py en formato EXE para hacerlo más portátil.
Principales características
- Generar una carga útil de ransomware
- Con o sin carga útil GUI
- Funciona en Microsoft Windows, GNU/Linux y MacOS
- Encriptación súper rápida con PyCrypto
- Compilación a EXE, APP o ejecutable Unix/Linux
- Icono personalizado para su carga útil EXE
- Recibe las claves de las víctimas
- Desencriptar archivos
- Modo de demostración (la carga útil no encripta nada)
- Modo de pantalla completa (la advertencia ocupa toda la pantalla)
- Mensaje de advertencia personalizado para su víctima
- Imagen personalizada en su carga útil
- Modo fantasma (cambia el nombre añadiendo la extensión .DEMON en lugar de cifrar los archivos)
- Múltiples métodos de encriptación
- Seleccione las extensiones de los archivos a los que va dirigido
- Decida si el payload debe autodestruirse (sólo en modo consola)
- Decidir la unidad de destino para el cifrado (directorio de trabajo)
- Acceso al servidor verificado a través del reenvío de puertos VPN
- Codificar la carga útil como código Morse
Instalación
Primero, descargamos e instalamos la última versión de Python 3. Posteriormente, procedemos con la ejecución de los siguientes comandos:
git clone https://github.com/leonv024/RAASNet.git
pip3 install -r requirements.txt
python3 RAASNet.py
Cabe mencionar que, como anotación importante, en GNU/Linux podríamos necesitar instalar python3-tk, python3-pil, python3-pil.imagetk, libgeoip1, libgeoip-dev y geoip-bin.
Registro
El primer paso, evidentemente, es registrarnos en la plataforma de RaaS (Ransomware-As-A-Service), en este caso contra la URL https://zeznzo.nl/req.py en el cloud de Google, por lo cual es prudente utilizar información totalmente falsa ingresando datos que no se relacionen de ninguna manera con nuestra persona:
También podemos atacar directamente al servicio onion (TOR) del operador: https://hplqdv5fo3vw3fjyamyer7yuc7xtvtop2j3fipc7psf3pxvhoqjoqkid.onion
Si todo marcha bien, ingresaremos nuestras credenciales y nos encontraremos con el panel de control del afiliado:
Generando el payload
El siguiente paso es generar el payload que debe ser ejecutado en el equipo de la victíma. Si hacemos clic en el menú GENERATE PAYLOAD abriremos otro menú con algunas opciones interesantes:
Como, por ejemplo, entre otras opciones podemos cambiar el mensaje de extorsión o ransom:
O también el método de cifrado, que en la presente demostración mantendremos como PyCrypto. Si pulsamos el botón GENERATE la salida serán dos scripts en Python: el payload y el decryptor correspondiente.
Si echamos un vistazo al código comprobaremos qué fácil resulta el proceso de cifrado y descifrado seleccionados:
Cifrado con payload.py:
Descifrado con decryptor.py:
Como podemos observar, se trata de un cifrado en bloque (CBC) con AES. El mensaje debe tener un tamaño o longitud de 16 bits, por lo cual se rellena con ceros hasta completarlo. No obstante, además de la clave, AES también necesita un vector de inicialización (Initialization Vector). Este vector de inicialización se genera con cada cifrado, y su propósito es producir diferentes datos cifrados para que un atacante no pueda hacer un criptoanálisis para inferir la clave o los datos en claro de los mensajes.
Ahora que tenemos el payload y el decryptor, si nuestra víctima utiliza Microsoft Windows nos interesará compilar el script a EXE para hacerlo portable:
Sin embargo, debemos recordar que ambos payloads, el script en Python y el EXE, son detectados por Windows Defender:
De esta forma, si queremos que se ejecute en la máquina de la víctima tendremos que cambiar el encoder (por defecto morse) u ofuscarlo previamente mediante pyarmor u otra herramienta.
Tampoco olvidemos levantar el servidor que recibirá las claves en cuanto el ransomware la genere para cifrar los archivos:
Si todo sigue bien, el ransomware generará el típico mensaje de aviso/extorsión:
Todos los ficheros en la ruta especificada habrán sido cifrados y renombrados añadiendo la extensión .DEMON:
Por otra parte, como podremos apreciar, en el código del payload.py la clave se enviará al recolector de claves:
Y, del mismo modo, al servidor del operador del RaaS:
De esta manera, el susodicho podrá verlo sin problemas en el panel de control al momento de acceder a su cuenta:
Una vez que se negocie la extorsión correspondiente y la víctima obtenga la clave, podrá descifrar sus archivos fácilmente con el decryptor.
Lo primero que tendrá que hacer es seleccionar el tipo de cifrado oportuno:
Introducir la clave:
Y seleccionar la ruta donde los archivos fueron cifrados:
Algo importante que debemos tener en cuenta es que si se introduce una clave incorrecta los archivos a recuperar podrían corromperse y perderse:
Pero si todo marcha correctamente, la victima recuperará sus archivos:
Repositorio del proyecto en Github: RaasNet
you’ve got an awesome weblog here! would you prefer to make some invite posts on my blog?
I got what you intend, thankyou for putting up.Woh I am delighted to find this website through google. «Delay is preferable to error.» by Thomas Jefferson.
I got what you mean , thankyou for posting.Woh I am pleased to find this website through google.
Good day! Do you know if they make any plugins to protect against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
O GOLDCARD é um cartão virtual com acesso à conteúdos de tv, filmes e séries
Only wanna comment on few general things, The website design and style is perfect, the subject matter is very great. «In business school classrooms they construct wonderful models of a nonworld.» by Peter Drucker.
Tv Programını Da App Üzerinden Telefonunuzda Açabilir Maç İzleyebilirsiniz.
Asyabahis Sitesinde Kayıt Yaptırmak Ya Da Üye Olmak İçin Üye Ol Sekmesine Tıklayıp Sizden İstenilen Bilgileri Doldurmanız Gerekiyor.
Appreciate it for helping out, wonderful info. «The surest way to be deceived is to think oneself cleverer than the others.» by La Rochefoucauld.
Thanks for helping out, superb info. «If at first you don’t succeed, find out if the loser gets anything.» by Bill Lyon.
Thanks for ones marvelous posting! I really enjoyed reading it, you might be a great author.I will always bookmark your blog and definitely will come back at some point. I want to encourage continue your great work, have a nice evening!
Keep functioning ,great job!
There is noticeably a bundle to know about this. I assume you made certain nice points in features also.
Wow! This blog looks exactly like my old one! It’s on a completely different subject but it has pretty much the same page layout and design. Outstanding choice of colors!
This blog is definitely rather handy since I’m at the moment creating an internet floral website – although I am only starting out therefore it’s really fairly small, nothing like this site. Can link to a few of the posts here as they are quite. Thanks much. Zoey Olsen
Very efficiently written story. It will be valuable to anybody who utilizes it, as well as myself. Keep doing what you are doing – looking forward to more posts.
I really like your writing style, excellent information, thanks for posting : D.
whoah this blog is great i love studying your posts. Keep up the good work! You know, a lot of persons are hunting around for this information, you can help them greatly.
Hey! Do you know if they make any plugins to safeguard against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
Awsome blog! I am loving it!! Will come back again. I am taking your feeds also
Hi! Do you know if they make any plugins to safeguard against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
I like what you guys are up too. Such clever work and reporting! Keep up the excellent works guys I’ve incorporated you guys to my blogroll. I think it’ll improve the value of my web site :).
I’m still learning from you, but I’m making my way to the top as well. I absolutely liked reading everything that is written on your website.Keep the posts coming. I enjoyed it!
I love your blog.. very nice colors & theme. Did you create this website yourself? Plz reply back as I’m looking to create my own blog and would like to know wheere u got this from. thanks
O Cupom da Vez é um aplicativo inovador que permite aos usuários ganhar dinheiro extra ao avaliar produtos e cupons em categorias como vestuário, eletrônicos, itens domésticos e muito mais.
I went over this website and I believe you have a lot of wonderful information, saved to my bookmarks (:.
I am not real superb with English but I find this rattling easy to interpret.
Hey there, You have done a fantastic job. I’ll definitely digg it and personally recommend to my friends. I am confident they’ll be benefited from this website.
Hey! I just wanted to ask if you ever have any issues with hackers? My last blog (wordpress) was hacked and I ended up losing months of hard work due to no backup. Do you have any methods to protect against hackers?
Some really nice and useful information on this website , likewise I believe the design and style contains fantastic features.
Great beat ! I would like to apprentice whilst you amend your site, how could i subscribe for a blog website? The account helped me a applicable deal. I have been tiny bit familiar of this your broadcast provided vivid clear idea
Thank you for the auspicious writeup. It in reality used to be a leisure account it. Glance complex to more delivered agreeable from you! By the way, how could we be in contact?
Very interesting subject, thankyou for putting up. «I do not pretend to know where many ignorant men are sure-that is all that agnosticism means.» by Clarence Darrow.
Hiya, I’m really glad I’ve found this information. Nowadays bloggers publish only about gossips and net and this is actually annoying. A good blog with exciting content, this is what I need. Thank you for keeping this website, I’ll be visiting it. Do you do newsletters? Cant find it.
Some really prime posts on this site, saved to bookmarks.
Hello.This post was really interesting, particularly because I was investigating for thoughts on this topic last Monday.
Link alternatif duatoto resmi internasional.
DUATOTO – Situs Togel Pasaran Terlengkap Pasti Bayar
Heya! I just wanted to ask if you ever have any problems with hackers? My last blog (wordpress) was hacked and I ended up losing months of hard work due to no back up. Do you have any solutions to stop hackers?
DUATOTO – Link Bandar Togel Online Paling Terpercaya di Indonesia
This blog is definitely rather handy since I’m at the moment creating an internet floral website – although I am only starting out therefore it’s really fairly small, nothing like this site. Can link to a few of the posts here as they are quite. Thanks much. Zoey Olsen
I got what you mean ,saved to bookmarks, very nice web site.
The following time I learn a weblog, I hope that it doesnt disappoint me as much as this one. I mean, I do know it was my option to learn, however I really thought youd have one thing attention-grabbing to say. All I hear is a bunch of whining about one thing that you can repair in case you werent too busy on the lookout for attention.
Very interesting subject, thanks for posting. «He who seizes the right moment is the right man.» by Johann Wolfgang von Goethe.
Hey, you used to write fantastic, but the last few posts have been kinda boringK I miss your great writings. Past few posts are just a little bit out of track! come on!
Hiya, I am really glad I have found this information. Today bloggers publish only about gossips and web and this is really irritating. A good blog with interesting content, this is what I need. Thanks for keeping this site, I’ll be visiting it. Do you do newsletters? Can not find it.
Hello! Do you know if they make any plugins to help with SEO? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good gains. If you know of any please share. Kudos!
I envy your work, regards for all the informative content.
I would like to thnkx for the efforts you have put in writing this web site. I’m hoping the same high-grade web site post from you in the upcoming as well. In fact your creative writing abilities has inspired me to get my own website now. Actually the blogging is spreading its wings rapidly. Your write up is a good example of it.
You are my intake, I own few blogs and often run out from to post .
I truly appreciate this post. I’ve been looking all over for this! Thank goodness I found it on Bing. You’ve made my day! Thx again
This really answered my problem, thanks!
Hey There. I found your blog using msn. This is a very well written article. I will be sure to bookmark it and come back to read more of your useful information. Thanks for the post. I will certainly return.
Hi there just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Firefox. I’m not sure if this is a formatting issue or something to do with browser compatibility but I figured I’d post to let you know. The design and style look great though! Hope you get the issue fixed soon. Cheers
Some really prime articles on this internet site, saved to my bookmarks.
I’ll immediately grab your rss feed as I can’t to find your e-mail subscription link or newsletter service. Do you have any? Kindly let me know so that I may subscribe. Thanks.
I’d constantly want to be update on new articles on this site, saved to bookmarks! .
Simply wanna input on few general things, The website layout is perfect, the written content is very wonderful. «The reason there are two senators for each state is so that one can be the designated driver.» by Jay Leno.
Hello there, just became alert to your blog through Google, and found that it’s really informative. I am gonna watch out for brussels. I will appreciate if you continue this in future. A lot of people will be benefited from your writing. Cheers!
After study a few of the blog posts on your website now, and I truly like your way of blogging. I bookmarked it to my bookmark website list and will be checking back soon. Pls check out my web site as well and let me know what you think.
Yay google is my king helped me to find this great web site! .
Only wanna comment on few general things, The website style is perfect, the content material is very good. «By following the concept of ‘one country, two systems,’ you don’t swallow me up nor I you.» by Deng Xiaoping.
Absolutely pent articles, appreciate it for entropy. «Necessity is the mother of taking chances.» by Mark Twain.
I am often to blogging and i really appreciate your content. The article has really peaks my interest. I am going to bookmark your site and keep checking for new information.
Would love to incessantly get updated great website! .
I really like reading and I think this website got some truly utilitarian stuff on it! .
I will right away take hold of your rss feed as I can’t in finding your e-mail subscription hyperlink or newsletter service. Do you have any? Kindly let me recognise so that I may just subscribe. Thanks.
You are my inspiration , I have few blogs and rarely run out from to brand : (.
After all, what a great site and informative posts, I will upload inbound link – bookmark this web site? Regards, Reader.
I am glad to be one of the visitants on this great website (:, regards for putting up.
Very interesting info !Perfect just what I was looking for! «The medium is the message.» by Marshall McLuhan.
Of course, what a great site and educative posts, I definitely will bookmark your website.Have an awsome day!
great post.Never knew this, appreciate it for letting me know.
Hello. magnificent job. I did not expect this. This is a remarkable story. Thanks!
I couldn’t resist commenting
Thanks for this rattling post, I am glad I noticed this web site on yahoo.
Wohh precisely what I was looking for, thanks for posting.
You got a very great website, Gladiola I noticed it through yahoo.
Thank you for the sensible critique. Me and my neighbor were just preparing to do some research on this. We got a grab a book from our area library but I think I learned more from this post. I’m very glad to see such magnificent info being shared freely out there.
Appreciate it for this post, I am a big fan of this web site would like to go on updated.
I’ll immediately grab your rss feed as I can’t to find your e-mail subscription link or newsletter service. Do you have any? Kindly allow me recognise in order that I may subscribe. Thanks.
Hello would you mind sharing which blog platform you’re using? I’m going to start my own blog in the near future but I’m having a hard time deciding between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design seems different then most blogs and I’m looking for something completely unique. P.S My apologies for getting off-topic but I had to ask!
Respect to op, some excellent entropy.