diff --git a/ddom.py b/ddom.py new file mode 100644 index 0000000..e8ecfb9 --- /dev/null +++ b/ddom.py @@ -0,0 +1,331 @@ +# росия🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢🤢 +import sys +import re +import urllib.request +import urllib.error +import urllib.parse +import random +import hashlib +import requests +import os +import argparse +import pyvirtualdisplay +from selenium import webdriver +import datetime + + +timestamp_now = datetime.datetime.now().strftime('%Y-%m-%d') + +print("""\n +# Daily Dose of Malware (DDoM) +# +# Original author: https://github.com/notnop +# Rewritten by Enderman and Matt in Python 3! +# +# %%%%&&&&..............%%%/ Malware is art! +# %%%%&&&&.........&&&..%%%%% Don't let it become a filthy criminal's tool! +# %%%%&&&&.........&&&..%%%%%%% +# %%%%&&&&.........&&&..%%%%%%% +# %%%%&&&&.........,,,..%%%%%%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%%% _________________ .%%%% +# %%%% _________________ .%%%% +# %%%% _________________ .%%%% +# %%%% _________________ .%%%% +# %%%% _________________ .%%%% +# %%%% _________________ .%%%% +# %&&% ,%&&% +# %&&%%%%%%%%%%%%%%%%%%%%%%%&&% +# %&&%%%%%%%%%%%%%%%%%%%%%%%&&%\n""") +# Flags +parser = argparse.ArgumentParser(description='DDoM v2.0') +parser.add_argument("-c", "--count", nargs=1, type=int, help="Defines the number of malware samples you want, up to 5000. If the argument is omitted, sets to 100 by default.", + required=False, default=argparse.SUPPRESS, metavar="SAMPLES") +parser.add_argument("-r", "--rename", help="[Not recommended] Makes the samples executable. Don't use this unless you're confident you won't execute them on your host.", + required=False, action="store_const", const=True) +parser.add_argument("-y", "--yes-to-all", help="Skips the confirmation prompt.", + required=False, action="store_const", const=True) + +def confirmation(question, default="no"): + valid = {"yes": True, "y": True, "ye": True, + "no": False, "n": False} + if default is None: + prompt = " [y/n] " + elif default == "yes": + prompt = " [Y/n] " + elif default == "no": + prompt = " [y/N] " + validInputEntered = False + while not validInputEntered: + data = input("{}{}".format(question, prompt)).lower() + if data in valid: + validInputEntered = True + return valid[data] + if data == "": + validInputEntered = True + return default + + + +args = parser.parse_args() +print(args) +if not "count" in args: + print("[*] Argument was omitted - going with 100 samples by default") + scount = 100 +else: + scount = args.count[0] + +# Global variables + +final_list = [] # Malware address collector +headers = { + 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.3' +} + +print("""\nYou'll get latest {} samples from: +\t# http://malc0de.com +\t# http://vxvault.net +\t# http://tracker.h3x.eu +""".format(scount)) + +confirmed = confirmation("Confirm and start downloading {} samples?".format(scount), "no") +if not confirmed: + sys.exit(0) + +print("\nSearching...") + +# Malc0de +def malc0de(samples): + global final_list + + url_list = [] + + if samples <= 50: + pages = 1 + else: + pages = (samples // 50) + 1 + + # Browsing pages + for i in range(0, pages): + address = "https://malc0de.com/database/?&page=" + str(i) + + try: + #req = requests.get(address, headers=headers) + #con = urllib.request.urlopen(req, timeout=60).read() + req = requests.get(address, headers=headers) + con = req.content.decode("utf-8") + b = re.findall("[\d]{4}-[\d]{2}-[\d]{2}<\/td>\n.+\n", con) + if b: + for i in b: + date = re.search("([\d]{4}-[\d]{2}-[\d]{2})<\/td>", i) + malware = re.search("\t(.+)<\/td>", i) + if date and malware: + malware = re.sub("", "", malware.group(1)) + url_list.append(malware) + except Exception as e: + print("Malc0de: " + str(e)) + + final_list += url_list + + print("[*] Malc0de - Done ", len(url_list)) + +# VXVault +def vxvault(nr_samples): + global final_list + + url_list = [] + address = "http://vxvault.net/ViriList.php?s=0&m=" + str(nr_samples) + + try: + #req = urllib.request.Request(address, None, headers) + #con_page = urllib.request.urlopen(req).read() + req = requests.get(address, headers=headers) + con_page = req.content.decode("utf-8") + # Find all malware addresses + page = con_page.split("\r") + for i in page: + match = re.search( + "href='ViriFiche\.php\?ID=[\d]+'>(.+)", i) + if match: + temp_mal_address = match.group(1) + if not re.search("[\d]{1,2}-[\d]{1,2}", temp_mal_address): + + # Add malware addresses + url_list.append(temp_mal_address) + + final_list += url_list + + except Exception as e: + #print("vxvault: " + str(e)) + raise e + + print("[*] VXVault - Done ", len(url_list)) + +def h3x_get(nr_samples): + lst = [] + + address = "http://tracker.h3x.eu/" + req = urllib.request.Request(address, None, headers) + con_page = urllib.request.urlopen(req).readlines() + + # Print con_page + + for linie in con_page: + address = re.findall("href='/site/([A-Za-z0-9%\._-]+)", linie.decode("utf-8")) + lst += address + if len(lst) >= nr_samples: + return lst + return lst + + +def h3x_clean(x=1000): + global final_list + list = h3x_get(x) + new_list = [] + + # Cleaning + for i in list: + i = re.sub("%3A", ":", i) + i = re.sub("%2F", "/", i) + new_list.append(i) + + final_list += new_list + + print("[*] tracker.h3x - Done ", len(new_list)) + + +def google(export_bool=False, output_bool=False): + + dorks = {"Pony": ["intitle:Authorization inurl:panel*/admin.php intext:Authorization. Sign in.", + "intitle:Authorization inurl:panel*/*admin.php", + "intitle:Authorization inurl:*admin.php Authorization. User Password Save password. Login. TF."], + "WannaCry": "intitle:\"index of\" \"@Please_Read_Me@.txt", + "Stealer": "intitle:\"(c) Bilal Ghouri\"", + "LokiBot": "inurl:PvqDq929BSx_A_D_M1n_a.php intitle:Auth", + "1ms0rry": "intitle:1ms0rry MINERPANEL", + "SpyEye": "intitle:FRMCP intext:Please, enter password"} + + + + info = {} + links_list = [] + + directory = "google" + timestamp_now + # now Firefox will run in a virtual display. + # you will not see the browser. + print("[*] Google - Starting Firefox...") + print("[*] Google - NOTE: Do not control Firefox while it is running!") + browser = webdriver.Firefox() + for i in dorks.keys(): # for every dork in dictionary + if i == "Pony": # for Pony is more than one dork + for j in dorks[i]: + browser.get('http://www.google.com/search?q=' + j + "&t=h_&ia=web") + links = browser.find_elements_by_xpath("//h3//a[@href]") + for elem in links: + link = elem.get_attribute("href") + links_list.append(link) + info.update({i: links_list}) + links_list = [] + + else: + browser.get('http://www.google.com/search?q=' + dorks[i] + "&t=h_&ia=web") + links = browser.find_elements_by_xpath("//h3//a[@href]") + for elem in links: + link = elem.get_attribute("href") + links_list.append(link) + + info.update({i: links_list}) + links_list = [] + + for i in info: + print("-----------------------------") + print(i) + for j in info[i]: + print(j) + print("-----------------------------") + + browser.quit() + +# Collect samples address: +malc0de(scount) +vxvault(scount) +h3x_clean(scount) +try: + google() +except Exception as e: + print(str(e)) + + +final_list = list(set(final_list)) +print("\nUnique addresses: ", len(final_list)) + +print("\nDownloading...") + + +# Generate random string +charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" + + +def get_random_word(a): + word = '' + for i in range(a): + word += random.choice(charset) + return word + + +# MD5 file +def md5Checksum(filePath): + fh = open(filePath, 'rb') + m = hashlib.md5() + while True: + data = fh.read(8192) + if not data: + break + m.update(data) + return m.hexdigest() + + +def download_file(address, dldagent={'User-Agent': "Chromium"}, + destination_folder=os.getcwd() + "\\Samples\\", + logs="error.log"): + + if not os.path.exists(destination_folder): + os.makedirs(destination_folder) + + # Filename + filename = destination_folder + str(get_random_word(8)) + '.exe' + + # Try to download sample + try: + + # Check if URL start with "http:// + if address[:7] != "http://": + address = "http://" + address + + # Construct URL and set timeout + req = urllib.request.Request(address, None, dldagent) + u = urllib.request.urlopen(req, timeout=4).read() # timeout 5 seconds + + # Write to file + f = open(filename, 'wb') + f.write(u) + f.close() + + # Write information to the log file + with open(destination_folder + logs, "a") as handle: + md5hash = md5Checksum(filename) + handle.write(md5hash + "\t" + filename + "\t" + address + "\n") + handle.close + + print("[*] Downloaded: " + filename) + + except Exception as e: + with open(destination_folder + logs, "a") as handle: + handle.write("Error: " + address + "\t" + str(e) + "\n") + handle.close() + pass + + +for mal in final_list: + download_file(mal) \ No newline at end of file