SubGlitch1 / OSRipper

AV evading OSX Backdoor and Crypter Framework
https://subglitch1.github.io/OSRipper/
MIT License
274 stars 46 forks source link

Unable to run on windows | unable to create a successful session #10

Closed venkata16sidhartha closed 2 years ago

venkata16sidhartha commented 2 years ago

I have ran the program in kali 2022.1, with all packages full updated. It generated exe, but when i run it in windows i get "This app cant run on your PC. To find a full version for your PC...." popup. Additionally, if i create exe by myself, by modifying the ip from 0.0.0.0 to my kali ip in ocr file(obfuscate it and create exe using same command), it runs but shell dosent popup, the obfuscated py file is dropping shell, but exe isnt either running or not dropping shell.

For shell that is being created im getting: Meterpreter session <> is not valid will be closed.(This is for the exe i create, m creating exe from obfuscated py code in windows, hence its atleast running, idk why its not creating session.)

Ive tried this on option 1. further more, initial meu is giving 3 options in one kali pc, and another is giving 5 options. could you help on that as well.

SubGlitch1 commented 2 years ago

you cannot compile a .exe on linux just like you cannot compile a Unix executable on windows. You have to compile on the same OS type that you want it to run on.

SubGlitch1 commented 2 years ago

also before trying again please clone again as there are some major updates

venkata16sidhartha commented 2 years ago

Still the name with new update: I ran the main.py in kali, then ran pyinstaller, same command that is there in main.py in windows on the ocr_or.py file, then i ran created windows, but this is the issue. Capture

venkata16sidhartha commented 2 years ago

And the same if i compile and do everything in windows: image this is for option 1.

SubGlitch1 commented 2 years ago

that is interesting. Can you try with option 2 while i take a look at this and let me know how your results are there

venkata16sidhartha commented 2 years ago

While you take a look, please try from 2 different systems, ie, exe should run in 1 system, and msf in another, if i run py file in same system as that of msf, im getting a stable shell, the same py file if i run in another system ,different ip same subnet, im getting the above images.

venkata16sidhartha commented 2 years ago

For option 2, im getting this error, when i compile in windows, and run the exe image

SubGlitch1 commented 2 years ago

allright thank you for alerting me on this. I develop on OSX as this tool is majorly focused on OSX so i dont notice when after some commits it stops working on windows. I will get on my windows PC and fix this.

venkata16sidhartha commented 2 years ago

For option 2: image so in this image, ignore the already in use thing, the first shell created is on sme system, where i ran the obfuscated python code, and hence shell is created on same system, 2nd one is where i ran the same obfuscated code on my windows system shell is created (for python script), and shell is dropped(for exe)

SubGlitch1 commented 2 years ago

does running the unobfuscated script on windows work?

venkata16sidhartha commented 2 years ago

obfuscated script(python file) runs and creates a stable shell, but exe compiled with pyinstaller does not.

SubGlitch1 commented 2 years ago

it must be because pyinstaller is not importing the required libaries for the frozen python interpreter which is used in the .exe

venkata16sidhartha commented 2 years ago

could you help me how to do it, as now, i have a fully FUD py script, which is really awesome

SubGlitch1 commented 2 years ago

thank you and also i will help you brother dont worry.

first of all can you compile the script with this command: pyinstaller -F --hidden-import imp --hidden-import socket --hidden-import urllib3 ocr_or.py

venkata16sidhartha commented 2 years ago

im adding a -w as well in the above command

SubGlitch1 commented 2 years ago

can you try this pyinstaller -F --hidden-import zlib --hidden-import socket --hidden-import ssl --hidden-import base64 ocr_or.py

venkata16sidhartha commented 2 years ago

image

SubGlitch1 commented 2 years ago

Allright give me 30 minutes or so

venkata16sidhartha commented 2 years ago

Please take your time, no hurry.

venkata16sidhartha commented 2 years ago

Additionally, please look into the obfuscation, virustotal is picking this up.

SubGlitch1 commented 2 years ago

yeah if u look at the wiki u can see that this is only FUD for macOS

SubGlitch1 commented 2 years ago

i think i will discontinue windows support for now until this issue is fixed

venkata16sidhartha commented 2 years ago

ok, looking forward for it, but i suggest to look into this, as windows is a wider target area compared to mac.

SubGlitch1 commented 2 years ago

i will thank you for bringing this issue to my attention