th3r4ven / bifrost

Bifrost C2. Open-source post-exploitation using Discord API

What's up?!. I'm TH3R4VEN 🦅

Software Engineer and CyberSecurity Professional

Hi, My name is Matheus, I'm a Software Engineer on SEC4YOU with focus on backend development and cybersecurity professional, trying to mix best of 2 worlds to provide and create malicious and secure softwares.

• 🔭 I’m currently working on a private project for DezOrganizada Furiosa.
• 🌱 I’m currently learning Go and Python as always and trying to decide witch front-end framework to study!
• ⚡ Fun fact I'm a Drummer!! 🥁

📫 How to reach me

   

Tecnologies

Github Stats

bifrost's Issues

Suggest to loosen the dependency on discord.py

Dear developers,

Your project Bifrost requires "discord.py==1.7.1" in its dependency. After analyzing the source code, we found that the following versions of discord.py can also be suitable without affecting your project, i.e., discord.py 1.7.0, 1.7.2, 1.7.3. Therefore, we suggest to loosen the dependency on discord.py from "discord.py==1.7.1" to "discord.py>=1.7.0,<=1.7.3" to avoid any possible conflict for importing more packages or for downstream projects that may use ddos_script.

May I pull a request to further loosen the dependency on discord.py?

By the way, could you please tell us whether such dependency analysis may be potentially helpful for maintaining dependencies easier during your development?

---

Details:

Your project (commit id: b5ae2fc) directly uses 2 APIs from package discord.py.

discord.file.File.__init__, discord.client.Client.__init__

Beginning fromwhich, 15 functions are then indirectly called, including -2 discord.py's internal APIs and 17 outsider APIs as follows:

[/th3r4ven/Bifrost]
+--discord.file.File.__init__
|      +--os.path.split
+--discord.client.Client.__init__
|      +--asyncio.get_event_loop
|      +--discord.http.HTTPClient.__init__
|      |      +--asyncio.get_event_loop
|      |      +--weakref.WeakValueDictionary
|      |      +--asyncio.Event
|      +--discord.client.Client._get_state
|      |      +--discord.state.ConnectionState.__init__
|      |      |      +--discord.flags.Intents.default
|      |      |      +--warnings.warn
|      |      |      +--discord.flags.MemberCacheFlags.from_intents
|      |      |      +--inspect.getmembers
|      |      |      +--discord.state.ConnectionState.clear
|      |      |      |      +--weakref.WeakValueDictionary
|      |      |      |      +--collections.OrderedDict
|      |      |      |      +--collections.deque
|      |      |      |      +--gc.collect
|      +--asyncio.Event

Since all these functions have not been changed between any version for package "discord.py" from [1.7.0, 1.7.2, 1.7.3] and 1.7.1. Therefore, we believe it is safe to loosen the corresponding dependency.

Change function/method names to look more "Nordic"

Bind Shell Payload

Create a stealth dynamic shell payload to deploy on victim.

• hide common strings to bypass AV.
• Create new command to this feature (%rsp).