$ show malwaredllc/byob
BYOB (Build Your Own Botnet) is an open-source post-exploitation framework that provides a command-and-control (C2) server, a custom payload generator, and a suite of post-exploitation modules. It is designed for security researchers and developers to simulate botnet operations for educational purposes. The system consists of a console-based C2 server (Python) and a Flask-based web GUI for managing sessions, payloads, and exfiltrated data. The architecture follows a classic botnet pattern: clients (reverse TCP shells) connect to the C2 server, authenticate via Diffie-Hellman key exchange with AES-256-CBC encryption, and receive tasks (modules) that are remotely loaded and executed. Modules include keylogging, screenshot capture, privilege escalation, packet sniffing, port scanning, persistence mechanisms, and interaction with iCloud/Outlook. The web GUI offers a dashboard, payload generator, terminal interface, and file management. The codebase shows signs of significant duplication (identical modules exist in both the core and web-gui directories) and relies on heavily outdated third-party frontend libraries (CKEditor 2013, FullCalendar 2014, CodeMirror addons). The project appears to be in a stale maintenance state with known incomplete features (e.g., unencrypted remote imports, limited transport types). While the core concepts (remote module loading, encrypted C2, cross-compilation) are technically interesting, the implementation quality is uneven, with Python 2/3 compatibility hacks, security-sensitive patterns (exec usage, SimpleHTTPServer without auth), and a large volume of unused/purely vendored assets inflating the repository. It is best treated as a reference architecture for botnet design rather than production-ready software.
The LLM identified 3 files worth highlighting for reuse:
Implements a custom Python import hook (sys.meta_path) that fetches modules from a remote HTTP server. Supports packages, compiled .pyc files, and GitHub repository imports. The pattern follows PEP 302 with find_module/load_module methods and is self-contained, requiring only urllib/requests. Demonstrates a non-obvious technique for dynamic remote code execution without writing to disk, which could be extracted for educational or research purposes in scenarios requiring remote plugin loading.
Provides a complete implementation of Diffie-Hellman key exchange and AES-256-CBC encryption with HMAC integrity. Includes functions for generating prime numbers, performing modular exponentiation, and encrypting/decrypting data with padding. The module is self-contained with no internal dependencies (only uses hashlib, os, struct, and random). Can be extracted as a standalone secure communication utility for any Python application needing IKE and symmetric encryption.
A shell script that sets up a Docker-based cross-compilation environment for building Python executables targeting multiple CPU architectures (arm32v7, arm64v8, i386, amd64). Automates QEMU registration, pulls appropriate Docker images, creates architecture-specific build scripts, and applies PyInstaller to freeze a Python client. Demonstrates a reusable pattern for multi-arch binary generation that could be adapted for any Python project needing platform-specific executables without maintaining native build machines.