mauri870 / ransomware

A POC Windows crypto-ransomware (Academic). Now Ransom:Win32/MauriCrypt.MK!MTB
857 stars 413 forks source link

Error 422 #14

Closed wirehack7 closed 7 years ago

wirehack7 commented 7 years ago

I compiled it like described:

mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/ransomware
mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/server
mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/unlocker
openssl genrsa -out /root/gocode/src/github.com/mauri870/ransomware/build/server/private.pem 4096
Generating RSA private key, 4096 bit long modulus
..................................................................................................++
.....................................................++
e is 65537 (0x010001)
openssl rsa -in /root/gocode/src/github.com/mauri870/ransomware/build/server/private.pem -outform PEM -pubout -out /root/gocode/src/github.com/mauri870/ransomware/client/public.pem
writing RSA key
rsrc -manifest ransomware.manifest -ico icon.ico -o /root/gocode/src/github.com/mauri870/ransomware/build/ransomware/ransomware.syso
Manifest ID:  1
Icon  icon.ico  ID:  20
cp /root/gocode/src/github.com/mauri870/ransomware/build/ransomware/ransomware.syso /root/gocode/src/github.com/mauri870/ransomware/build/unlocker/unlocker.syso
cp -r cmd/ransomware /root/gocode/src/github.com/mauri870/ransomware/build
cp -r server /root/gocode/src/github.com/mauri870/ransomware/build
cp -r cmd/unlocker /root/gocode/src/github.com/mauri870/ransomware/build
cd  /root/gocode/src/github.com/mauri870/ransomware/client && perl -pi.bak -e 's/INJECT_PUB_KEY_HERE/`echo -n "\n"; cat public.pem`/e' main.go
cd /root/gocode/src/github.com/mauri870/ransomware/build/server && perl -pi -e 's/INJECT_PRIV_KEY_HERE/`echo -n "\n"; cat private.pem`/e' main.go
cd /root/gocode/src/github.com/mauri870/ransomware/build/server && env GOOS=linux go run $GOROOT/src/crypto/tls/generate_cert.go --host localhost
2017/02/03 14:15:16 written cert.pem
2017/02/03 14:15:16 written key.pem
mkdir -p /root/gocode/src/github.com/mauri870/ransomware/bin
mkdir -p /root/gocode/src/github.com/mauri870/ransomware/bin/server
cd /root/gocode/src/github.com/mauri870/ransomware/build/ransomware && GOOS=windows GOARCH=386 go build --ldflags "-s -w" -o /root/gocode/src/github.com/mauri870/ransomware/bin/ransomware.exe
# cd /root/gocode/src/github.com/mauri870/ransomware/build/ransomware && GOOS=windows GOARCH=386 go build --ldflags "-s -w -H windowsgui" -o /root/gocode/src/github.com/mauri870/ransomware/bin/ransomware.exe
cd /root/gocode/src/github.com/mauri870/ransomware/build/unlocker && GOOS=windows GOARCH=386 go build --ldflags "-s -w" -o /root/gocode/src/github.com/mauri870/ransomware/bin/unlocker.exe
cd /root/gocode/src/github.com/mauri870/ransomware/build/server && go build && mv `ls|grep 'server\|key.pem\|cert.pem'` /root/gocode/src/github.com/mauri870/ransomware/bin/server
cd client && rm public.pem && mv main.go.bak main.go
rm -r build

When running ransomware.exe in a Windows 7 VM it results in error: 422 - Error validating payload, bad public key

And log from server shows also 422 response code. Is the ransomware not trusting self signed certs?

mauri870 commented 7 years ago

Hi Markus, sorry for the delay. It'supposed to work with self signed certs, but I think the problem is with the private and public keys. Please try to clear the certs and rebuild it again from scratch, maybe make are cashing some thinks

Em 3 de fev de 2017 5:25 PM, "Markus R." notifications@github.com escreveu:

I compiled it like described:

mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/ransomware mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/server mkdir -p /root/gocode/src/github.com/mauri870/ransomware/build/unlocker openssl genrsa -out /root/gocode/src/github.com/mauri870/ransomware/build/server/private.pem 4096 Generating RSA private key, 4096 bit long modulus ..................................................................................................++ .....................................................++ e is 65537 (0x010001) openssl rsa -in /root/gocode/src/github.com/mauri870/ransomware/build/server/private.pem -outform PEM -pubout -out /root/gocode/src/github.com/mauri870/ransomware/client/public.pem writing RSA key rsrc -manifest ransomware.manifest -ico icon.ico -o /root/gocode/src/github.com/mauri870/ransomware/build/ransomware/ransomware.syso Manifest ID: 1 Icon icon.ico ID: 20 cp /root/gocode/src/github.com/mauri870/ransomware/build/ransomware/ransomware.syso /root/gocode/src/github.com/mauri870/ransomware/build/unlocker/unlocker.syso cp -r cmd/ransomware /root/gocode/src/github.com/mauri870/ransomware/build cp -r server /root/gocode/src/github.com/mauri870/ransomware/build cp -r cmd/unlocker /root/gocode/src/github.com/mauri870/ransomware/build cd /root/gocode/src/github.com/mauri870/ransomware/client && perl -pi.bak -e 's/INJECT_PUB_KEY_HERE/echo -n "\n"; cat public.pem/e' main.go cd /root/gocode/src/github.com/mauri870/ransomware/build/server && perl -pi -e 's/INJECT_PRIV_KEY_HERE/echo -n "\n"; cat private.pem/e' main.go cd /root/gocode/src/github.com/mauri870/ransomware/build/server && env GOOS=linux go run $GOROOT/src/crypto/tls/generate_cert.go --host localhost 2017/02/03 14:15:16 written cert.pem 2017/02/03 14:15:16 written key.pem mkdir -p /root/gocode/src/github.com/mauri870/ransomware/bin mkdir -p /root/gocode/src/github.com/mauri870/ransomware/bin/server cd /root/gocode/src/github.com/mauri870/ransomware/build/ransomware && GOOS=windows GOARCH=386 go build --ldflags "-s -w" -o /root/gocode/src/github.com/mauri870/ransomware/bin/ransomware.exe

cd /root/gocode/src/github.com/mauri870/ransomware/build/ransomware && GOOS=windows GOARCH=386 go build --ldflags "-s -w -H windowsgui" -o /root/gocode/src/github.com/mauri870/ransomware/bin/ransomware.exe

cd /root/gocode/src/github.com/mauri870/ransomware/build/unlocker && GOOS=windows GOARCH=386 go build --ldflags "-s -w" -o /root/gocode/src/github.com/mauri870/ransomware/bin/unlocker.exe cd /root/gocode/src/github.com/mauri870/ransomware/build/server && go build && mv ls|grep 'server\|key.pem\|cert.pem' /root/gocode/src/github.com/mauri870/ransomware/bin/server cd client && rm public.pem && mv main.go.bak main.go rm -r build

When running ransomware.exe in a Windows 7 VM it results in error: 422 - Error validating payload, bad public key

And log from server shows also 422 response code. Is the ransomware not trusting self signed certs?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/mauri870/ransomware/issues/14, or mute the thread https://github.com/notifications/unsubscribe-auth/AJspPeBFG9z9piwBVewNR4qmraUamGutks5rY38qgaJpZM4L2ta8 .

wirehack7 commented 7 years ago

Okay found the error. Build crashed before, so the inserted key keeps in it (and not beeing deleted and overwriten by main.bak). Maybe changing main.go to main.go.code and then put it as main.go would be better. So it can be more easier restored. Had to delete the project and redownload it.

Thanks!

merahawan commented 7 years ago

@wirehack7 same error cannot solve, re downloaded the project didn't fix, how to clear the certs ? can you let me know step by step? appreciate your suggestions

karikalansaitechnology commented 7 years ago

can't load package: package github.com/mauri870/ransomware: no buildable Go source files in /root/Projects/Proj1/src/github.com/mauri870/ransomware

karikalansaitechnology commented 7 years ago

how to fix above problem

wirehack7 commented 7 years ago

Read all the comments: https://github.com/mauri870/ransomware/issues/14#issuecomment-277556066