Practical Linux Malware Development

Set up your learning environment with a Linux-based OS, a code editor such as Visual Studio Code, and the Go compiler and Python interpreter to follow the course.

Set up a go project to develop a remote access trojan, creating a malware directory, plan, and main.go, and establish c2 communication with commands like cd and shell execution.

Connect to the C2 server and implement a loop using the buff io package to read commands line by line, trim spaces, and prepare to send results.

The lecture introduces a send_resp function that sends feedback from malware to the C2 server using a connection object, formatting the message with fmt and a string placeholder.

Learn to handle quit commands from a command and control server with an if-else on CMD, notify before closing connection, then close and break loop; next, cover the cd command.

Implement cd command handling with ifs for 'cd' and 'cd <target>', using the os package to get or change directories after splitting the command, and return results via the connection.

Read the file in binary, base64-encode it, and transmit a message with the filename and base64 data; on the receiver, split by colon, decode, and write the file.

Check the command for a colon, split it to get the file name and base64 payload, then decode and save the file with 0644 permissions.

Parse the download command and verify the first token is download. If the file exists, read it, encode to base64, and return filename:base64 to the server.

Fix mistakes by passing correct file name to get file function, use second value of temp variable, and return false from file exists function when error is not nil.

Take a screenshot of the target machine using a go library to capture desktop, encode the image as base64, and send it back to the server, then delete the file.

Explore linux persistence concepts, including system-wide vs user-level persistence, and implement a user-level approach by creating a persist file in /tmp and configuring crontab to run the executable.

Develop a go-based shell command executor with the exec package to run commands, capture output, handle errors, and remove temporary files after use, and test with netcat.

Test your malware using a netcat listener on port 1234, interact with the target to run shell commands, fetch base64-encoded screenshots and files, and plan a custom server.

Set up a server project by creating a server folder, opening it in Visual Studio Code, and drafting a plan to listen for connections and handle malware commands.

Create a python listener by building a tcp socket with afinet and sock stream, binding to 127.0.0.1:1234, and listening for incoming connections.

Accept incoming connections with the socket accept method, capturing the connection object and client address, then prepare to loop inputs to the malware and receive results.

Learn to implement an infinite loop that reads user commands via input, builds a command string with a trailing newline for use with malware server.

Learn to receive and save screenshots in a Linux malware development workflow by handling the screenshot command, decoding base64 streams, and writing the result to Screenshot.png using binary file operations.

Learn to implement a download command in a Linux malware framework by parsing input, handling base64 data, and writing decoded payloads to disk while preparing for the upload command.

Learn to perform file uploads in a linux malware development workflow by validating the file name, reading binary data, base64 encoding, and sending the payload to the malware.

Send shell commands to malware, including the persist command, store the output in a cmd variable, and print it.

Testing with our rat demonstrates linux malware operation, including server interaction, command execution (whoami, pwd, ifconfig), directory navigation, screenshot capture, file transfer, persistence, and termination.