not-sekiun / pyiris

PyIris is a modular remote access trojan toolkit written in python targeting Windows and Linux systems.

The project is currently undergoing a major rewrite for version 3, the current version, version 2 will be made obsolete

The PyIris Project (Updates coming soon refer to ROADMAP.md)

The PyIris project is a modular remote access trojan toolkit written completely in python. It allows users to dynamically build, generate and encode/encrypt remote access trojan payloads for remote control of other compromised hosts.

Demo of PyIris in action on multiple operating systems (Windows and Linux)

Dynamically generating a payload in Windows

Remotely controlling a Windows system through a scout in Ubuntu (screenshot of victims machine is of the ubuntu attacker machine since I'm running the ubuntu machine in a VM)

Creating listeners that will receive connections from the scouts in Kali Linux

Features (Both Windows and Linux)

• Tab completion for most commands
• Dynamically generate scouts
• Robust error handling to allow scouts to recover from sudden disconnects
• Upload and download files from and to the target machine
• Sleep, kill and disconnect scouts
• Download files from external urls (web dowloads)
• Keylogging in memory
• Displaying system information
• Taking screenshots without writing to disk
• See all currently open visible and non visible windows on the target
• Check to see if scout is running with admin/root privileges
• Inject keystrokes
• Compile payloads into Windows EXEs or Linux ELFs
• Clear, set or dump clipboard data
• Setting audio
• Take pictures from webcam without writing to disk
• Stackable encryption of scout payload source code, in a theoretically infinite stack in infinite variations
• execute arbitrary python code and read the results even if the python interpreter is not installed on the target machine from compiled scouts
• request for admin/root
• sleep for an arbitrary length of time before running (To bypass AV dynamic program analysis)
• self delete (only works for scripts)
• Stream webcam over TCP sockets (pretty laggy will work on a UDP version)

Features (Windows)

• Acheive persistence through the windows registry (HKEY_CURRENT_USER)
• Acheive persistence through the windows startup folder
• Remote Command Execution through cmd.exe or powershell.exe (provided it is not blocked)
• Open URLs from native browser (internet explorer ewww)
• Shutdown, restart, lock, logoff user gracefully without connection hanging from scout payload
• Execute or open files remotely
• Check the user idle time
• Dump saved chrome passwords (wont work with the latest chrome browsers since they changed encryption methods and Im kinda lazy to update this lol)
• Disbale/ Enable the targets keyboard/mouse
• Bypass UAC through sdclt.exe (Has already been patched in recent windows updates)

Features (Linux)

• Achieve persistence through cron jobs (crontab)
• Remote Command Execution through the bash shell

Getting Started

Prerequisites

• Python 3.x, (I use python 3.7.x)
• Git

Setting up PyIris (Windows)

First, clone this repository (make sure you have git installed), CD into the root folder.

git clone https://github.com/angus-y/PyIris-backdoor

cd PyIris-backdoor

Next install the rest of the required modules with pip3. Only install modules from the setup/windows/requirements.txt file as this section is for running the Windows edition of PyIris.

pip3 install -r setup/windows/requirements.txt

Upon running PyIris.py in the root folder for the first time you should be greeted with the option to generate a key, this indicates everything has been installed correctly.

Setting up PyIris (Linux)

First, clone this repository (make sure you have git installed), CD into the root folder.

git clone https://github.com/angus-y/PyIris-backdoor

cd PyIris-backdoor

Next install an external dependency, xlib, required by pyperclip through apt-get.

sudo apt-get install xclip

Then install pyalsaaudio through apt-get, if you're installing on ubuntu please read the below note

sudo apt-get install python3-alsaaudio

After that install canberra-gtk-module for cv2 to use to display webcam live streams

sudo apt-get install libcanberra-gtk-module

Pyautogui refuses to be imported in linux if tkinter is not installed so we must install it. However, we are not actually using tkinter for any of the scouts

sudo apt-get install python3-tk python3-dev

Finally, install the rest of the required modules with pip3. Only install modules from the setup/linux/requirements.txt file as this section is for running the Linux edition of PyIris.

pip3 install -r setup/linux/requirements.txt

Upon running it the first time you should be greeted with the option to generate a key, this indicates everything has been installed correctly.

Updating PyIris

Change into the PyIris-backdoor folder first, then run

git pull

On windows to install any newly added third party modules or update then run

cd setup/windows

pip3 install -r requirements.txt

On linux to install any newly added third party modules or update then run

cd setup/linux

pip3 install -r requirements.txt

Supported OS

PyIris was successfully installed on the following operating systems

• Windows 10
• Kali Linux Rolling releases
• Ubuntu
• Debian

Basic Usage

Windows

py -3 PyIris.py

If prompted to generate a key, either press enter or enter a key that you want to use.

Linux

python3 PyIris.py

If prompted to generate a key, either press enter or enter a key that you want to use.

Starting out

The help command is your friend! Simply run help to get a list of all commands you can use on a specific interface. For more detail about a specific command, run help <name of command> to get more in depth help about it. Alternatively you can use the ? command which is an alias for the help command. I am planning to write a wiki soon detailing all the commands and information you need to use PyIris

FAQ

Why cant the compiled scout I generated in my Linux OS run on a Windows target machine? (Or vice versa)

PyIris utilizes Pyinstaller to compile its payloads. It is therefore not possible to cross-compile binaries. That means if you generate and compile a scout in Linux the binary only runs in Linux, it works the same for Windows. If you want to cross-compile Windows scouts for Linux I suggest you use wine and run PyIris from there otherwise your options are very limited.

Why am I getting an attribute error "enum has no module 'IntFlag' during compilation of scouts?

This is most probably due to a redundant library you have installed called enum34 which has already been deprecated. Uninstall the library with the command

pip uninstall -y enum34

If you get this error while compiling with pyinstalled the compiled executable will not run. See here for more information

PyHook isn't installing on my Windows OS!

I have already included a PyHook wheel file in the setup/windows folder however that wheel works only for 64 bit versions of Windows. You may have to manually install PyHook yourself. Go to this site and search for the PyHook wheel file that works for your Windows version and download it. Next, pip install using the name of that wheel file.

pip3 install <name of pyhook wheel file>

If you downloaded the correct pyhook wheel file it should install succesfully.

I correctly created my listeners and scouts why are the scouts not connecting to my listeners?

Since the listeners actually open ports on your machine you may have to allow the python 3 interpreter (python.exe) through your firewall so that it can actually receive connections. Another reason the scouts are not connecting is that your key could have changed the pre generated key prompted during a new PyIris install and run is used to authenticate and connect to the listeners. The scout could have been generated with a different key than the one that the listener is expecting, the regen command at the main home interface would have changed the key, alternatively you may have directly edited the resources/PyIris.cred file that contains the key

Why are there more linux components (backdoor functions) than windows components...

Well this is due to several reasons. First, is the problem of open source code and mulitple distros. Linux has many distrubutions each linux distro may be different or have a different system structure than each other linux system. Creating components to cover all of them is incredibly difficult. Secondly, is support, simply put some linux systems just dont support some functions out of the box for python. Lastly is the fact that the terminal in linux is much more powerful than cmd in windows, therefore a lot more things can be accomplished from the terminal than from cmd so there is no need to add extra components, your trusty linux/execute_command_bash will do the job for you. For example rather than adding a linux/browser component you can use the xdg-open command to open URLs its supported out of the box

Why are you using a raw text protocol isn't something like HTTP less suspicious to network analyst

Yes it is I should probably be using HTTP buuuuut I am just lazy. Perhaps in a future update but that requires rewriting a lot of the listener-scout protocol which could take some time.

Hey I am a 1337 H4X0R and need to DDOS NSA and The Pentagon can you add a 1337 DDOS component

No lol

Built with

• PyCharm IDE
• My brain

Want to report a bug?

Create an issue, but before that please read the "ISSUE_TEMPLATE.md" file first

Credits

• Inspired by Powershell Empire and Brain Damage
• Thanks to EV-EV for helping me in the earliest stages of the project and in helping me to create PyIris from its infancy
• Thanks to Dharshan2004 for helping build a part of the in-memory webcam module and testing PyIris on Debian
• Thanks to Ani152 for being my (legally) unwilling test subject in testing the PyIris framework
• Thanks to my brain for formulating this whole project

License

Licensed under Mozilla Public License Version 2.0 - See the "LICENSE.md" file for more details

Disclaimer!

I write stuff like this for fun and mainly to become a better at python. The purpose of this project is to challenge myself to solve problems in creative ways, teach myself to be better at coding and have some fun creating something cool in the process. I DO NOT CONDONE the usage of this project in any unethical or unlawful manner. Do not use this without the full consent of the subject. Besides this framework isnt even that good anyways.

pyiris's Issues

Not as issue: An Idea

I saw your issue with windows defender, try xor encryption and layer it with base 64 - this is by no means a great encryption but it doesn't create massive large files. A problem with this type of approach however, is that you cant compile your code directly into an exe using the encoded data. Your going to have to A) import all of your necessary modules before creating a variable to hold your encoded data B) include the decryption method within the file which makes anyone reverse engineering it be able to quickly read your code C) for some reason Avast and AVG detect payloads I've made with this style of encryption - but most other AV's don't. For reference material: here. The method I use isn't great but you can improve on it a lot.

[!]Unexpected error when bootstrapping : 'DISPLAY'

Pictures

no module named cv2

How and when to create an issue

Step 1 : Environment information where PyIris was run

• Exact OS Version
• PyIris Version
• Python Version

Step 2 : What was done before the error

• What commands were ran before the error
• What was the state of the framework before the error (eg. How many listeners active, how many scouts connected, etc.)
• Programs running while PyIris was running
• What was modified in the framework files (If any were modified)

Step 3 : Evidence and description

• Description of the error
• Screenshot of the error
• Raw text of the error
• Videos or gifs

Step 4 : Miscellaneous information

• Any miscellaneous information you would like to provide, the more data provided the better

Note : Do not create an issue if you cannot reproduce the bug, I need to be able to reproduce the bug in order to fix it

──(kali㉿kali)-[~/PyIris-backdoor]
└─$ python3 PyIris.py
[*]Starting...
[+]Using Python Version 3 - OK
[+]All local files imported - OK
[+]OS Linux - OK
[-]Could not import : No module named 'cv2' - Error, missing packages or packages not installed from setup folder

requirements.txt for windows has been deleted?

How and when to create an issue

Step 1 : Environment information where PyIris was run

• Exact OS Version
• PyIris Version
• Python Version

Step 2 : What was done before the error

• What commands were ran before the error
• What was the state of the framework before the error (eg. How many listeners active, how many scouts connected, etc.)
• Programs running while PyIris was running
• What was modified in the framework files (If any were modified)

Step 3 : Evidence and description

• Description of the error
• Screenshot of the error
• Raw text of the error
• Videos or gifs

Step 4 : Miscellaneous information

• Any miscellaneous information you would like to provide, the more data provided the better

Note : Do not create an issue if you cannot reproduce the bug, I need to be able to reproduce the bug in order to fix it

Generator Switch

I'm on linux and i get always the generator for linux not windows

HTTP scout

Hey I really like your project. I started playing around with developing my own backdoor but my python kung foo is not there yet. I have a idea to contribute though. You can add an option to create a HTTP scout using covertutils. I have tested it and it works pretty well, both on Windows and Linux. I dont know how easy/hard would be to "merge" PyIris handler code with covertutil handler but can be a good start.

How to Port forward?

Sorry for asking, But how to port forward the host and the listener

I tried the method of metasploit but it's not working also I used portmap to try it.

I think I will try ngrok or any port forwarding tool

Thank you for reading :)

AttributeError: module 'collections' has no attribute 'Callable' when running python PyIris.py for the first time

Step 1 : Environment information where PyIris was run

• Exact OS Version: Windows 11 (10.0.22000 Build 22000)
• PyIris Version: Latest
• Python Version: 3.10.6

Step 2 : What was done before the error

• What commands were ran before the error: Initial run of python PyIris.py
• What was the state of the framework before the error (eg. How many listeners active, how many scouts connected, etc.): None
• Programs running while PyIris was running: Command Prompt (where it was running), Edge, File Explorer
• What was modified in the framework files (If any were modified): Nothing

Step 3 : Evidence and description

• Description of the error: Ran python PyIris.py for the first time and got the error: AttributeError: module 'collections' has no attribute 'Callable'
• Raw text of the error:

[+]Using Python Version 3 - OK
[+]All local files imported - OK
[+]OS Windows - OK
[+]Successfully imported : pyperclip - OK
[+]Successfully imported : win32crypt - OK
[+]Successfully imported : cv2 - OK
[+]Successfully imported : pythoncom - OK
[+]Successfully imported : mss - OK
[+]Successfully imported : PIL - OK
[+]Successfully imported : pyautogui - OK
[+]Successfully imported : colorama - OK
[+]Successfully imported : cryptography - OK
[+]Successfully imported : pyWinhook - OK
[+]Successfully imported : pycaw - OK
CRITICAL:root:Unexpected error when bootstrapping, dumping stack trace and exiting...
Traceback (most recent call last):
  File "C:\Users\danie\Documents\Python\PyIris\library\modules\bootstrap.py", line 33, in main
    exec ('import ' + i)
  File "<string>", line 1, in <module>
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\readline.py", line 34, in <module>
    rl = Readline()
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\pyreadline\rlmain.py", line 422, in __init__
    BaseReadline.__init__(self)
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\pyreadline\rlmain.py", line 62, in __init__
    mode.init_editing_mode(None)
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\pyreadline\modes\emacs.py", line 633, in init_editing_mode
    self._bind_key('space',       self.self_insert)
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\pyreadline\modes\basemode.py", line 162, in _bind_key
    if not callable(func):
  File "C:\Users\danie\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\pyreadline\py3k_compat.py", line 8, in callable
    return isinstance(x, collections.Callable)
AttributeError: module 'collections' has no attribute 'Callable'

Step 4 : Miscellaneous information

• Any miscellaneous information you would like to provide, the more data provided the better: Removed package versions from requirements.txt because the specified versions couldn't be found.

where do i find the executable name

How and when to create an issue

Step 1 : Environment information where PyIris was run

• Exact OS Version
• PyIris Version
• Python Version

Step 2 : What was done before the error

• What commands were ran before the error
• What was the state of the framework before the error (eg. How many listeners active, how many scouts connected, etc.)
• Programs running while PyIris was running
• What was modified in the framework files (If any were modified)

Step 3 : Evidence and description

• Description of the error
• Screenshot of the error
• Raw text of the error
• Videos or gifs

Step 4 : Miscellaneous information

• Any miscellaneous information you would like to provide, the more data provided the better

Note : Do not create an issue if you cannot reproduce the bug, I need to be able to reproduce the bug in order to fix it

Asymmetric Public Private Key Encryption for commands

Hey @angus-y, I am thinking of adding an asymmetric encryption on the commands between the client and scout what do you think about it?