0x1ca3 / reaper

An ADB-based botnet written in C.

0x1CA3

• 🔭 I mainly know/code/work with:
  • Python
  • C
  • C++
  • Vlang
  • Golang
  • PHP
• 💻 Languages that I don't code in very much:
  • SQL
  • Javascript
  • x86/x86_64 Assembly
• 📚 Currently Learning:
  • PE
  • Windows API
  • Reverse Engineering
  • x86/x86_64 Assembly
• 📱 Interests:
  • IoT
  • Programming
  • Webapp Hacking
  • Malware Analysis
  • Reverse Engineering
  • Exploit Development
  • Malware Development
• 📫 How to reach me: 835622562742272011 <- [Go on https://discord.id/ to get profile information]
• ⚡ Fun fact: You're probably here because I'm arguing with you.

Here are some projects to check out.

• Net - A light-weight, minimal botnet written in C
• loader - A loader for infecting devices
• syringe - A DLL & Code Injection C++ library for Windows
• parasite - An LD_PRELOAD based malware base written in C

~ 0x1CA3

reaper's Issues

Client.c issue

the client.c is work only for UNIX not for winodws.. please rewrite to be compiled and executed in windows ..

Also, i noticed another issue .. when you stop and close server and panel while client.c running then try back to run server then login to panel and check command bots.. it gives 0 bots .. while the client.c is running .. it should reconnect and regain the established connection back again why it returns bots count to zero .. which means if server is stop and then back to run server again the connection will be lost even if the client.c is running but nothing backconnect again to server..

Hey, i was also doing the same kind of project and i know how to make it skip adb devices that are offline

you have to put 2s timeout

:D

Good shit buddy, love you.

Buffer Overflow & Command Injection

There is a buffer overflow & command injection inside of the connect command reference

Here you initialise a buffer:

char *adb_connect_ip;
adb_connect_ip = (char *)malloc(32 * sizeof(char));

A few lines below this, you accept unsensitised user input to the buffer using scanf()
which can lead to a buffer overflow

scanf("%s", adb_connect_ip);

If you look down another few lines, after copying the user input to the buffer, you then proceed
to execute the users input using system() without validating it

system(adb_con_before);

I would recommend fixing this, whilst it not being a huge issue due to the fact this project
was clearly just something written for fun & not meant to be used in a real world scenario, it's still
a bad idea to leave vulnerable code inside of your C2

This is actually called

Azula c2 it's not just a IoT botnet it is a malware builder that Georgia Cri aka Apple J4ck created

curl/curl.h: No such file or directory

9 | #include <curl/curl.h>
  |          ^~~~~~~~~~~~~

compilation terminated.

yo this is interesting

im learning python im not fully into it yet plus anything i develop never had this error before but anyway heres your error
i did python3 loader.py droid.txt -pthread

File "/usr/lib64/python3.6/subprocess.py", line 1364, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'adb': 'adb'