BusyBotNet is a Fork of Busybox with Security Tools

Busybox provides a lightweight version of common command line utilities normally found on “big” Linux into a single binary, in order to bring them to embedded systems with limited memory and storage. As more and more embedded systems are now connected to the Internet, or as they are called nowadays the Internet of Things nodes, adding security tools, such as cryptographic utilities, could prove useful for administrators of such system, and so BusyBotNet project wsa born out of a fork of Busybox.

Some of the tools implemented include:

fenc to encrypt stuff with salsa algo
tsh. needs work, backdoor shell aes enc
rathole backdoor shell, blowfish enc
ssyn2 ddos tool
sudp udp ddos tool
jshon sh wrapper for json
hydra
prism userspace icmp triggered reverse shell backdoor

You can access the source code and instructions on busyboxnet github repo.

I’ve quickly tried it in my AMD x86 computer running Ubuntu 14.04 using BusyBotNet default settings:

git clone https://github.com/isdrupter/busybotnet
cd busybotnet
make -j8

git clone https://github.com/isdrupter/busybotnet

cd busybotnet

make -j8

You could run make menuconfig to add or remove the tools as needed.

The resulting binary was 3.1MB large, and compiled with the defined functions:

./busybox
BusyBox v1.24.1 (2016-06-20 10:45:31 ICT) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
   or: busybox --list[-full]
   or: busybox --install [-s] [DIR]
   or: function [arguments]...

    BusyBox is a multi-call binary that combines many common Unix
    utilities into a single executable.  Most people will create a
    link to busybox for each function they wish to use and BusyBox
    will act like whatever it was invoked as.

Currently defined functions:
    [, [[, acpid, add-shell, addgroup, adduser, adjtimex, aescrypt, arp,
    arping, ash, awk, base64, basename, beep, beer, bindtty, blkid,
    blockdev, boink, bonk, bootchartd, brctl, bunzip2, bzcat, bzip2, cal,
    cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst, chroot,
    chrt, chvt, cksum, clear, cmp, coke, comm, conseal, conspy, cp, cpio,
    crond, crontab, crypthash, cryptpw, cttyhack, cut, date, dc, dcd3c, dd,
    deallocvt, delgroup, deluser, depmod, devmem, df, dhclient, dhcprelay,
    dhgenprime, diff, dirname, dmesg, dnsamp, dnsd, dnsdomainname,
    dos2unix, dpsc, dpss, du, dumpkmap, dumpleases, ecdsa, echo, ed, egrep,
    eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd,
    false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fenc,
    fgconsole, fgrep, find, findfs, flock, fold, free, freeramdisk, fsck,
    fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, genericsum,
    genkey, getopt, getty, gewse, gewse5, grep, groups, gunzip, gzip, halt,
    hd, hdparm, head, hexdump, hole, hostid, hostname, httpd, hush,
    hwclock, hydra, i2cdetect, i2cdump, i2cget, i2cset, id, ifconfig,
    ifdown, ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice,
    iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule,
    iptunnel, jolt, jshon, kbd_mode, kill, killall, killall5, kissofdeath,
    kkill, klogd, knbot, land, last, latierra, less, linux32, linux64,
    linuxrc, lizbot, lizserv, ln, loadfont, loadkmap, logger, login,
    logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof,
    lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man,
    md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs, mkfifo,
    mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp,
    modinfo, modprobe, more, mount, mountpoint, mpstat, mqsh, mqtte, mt,
    mv, nameif, nanddump, nandwrite, nbd-client, nc, nestea, netscan,
    netstat, newtear, nice, nmeter, nohup, nslookup, ntpd, ntpdos, od,
    openvt, orgasm, ottf, passwd, patator, patch, pgrep, pidof, ping,
    ping6, pipe_progress, pivot_root, pkdecrypt, pkencrypt, pkill, pksign,
    pmap, pong, popmaildir, poweroff, powertop, printenv, printf, prism,
    proxcat, ps, pscan, pstree, pubclient, pud, pwd, pwdx, raidautorun,
    raped, rdate, rdev, readahead, readlink, readprofile, realpath, reboot,
    reformime, remove-shell, renice, reset, resize, rev, rfkill, rm, rmdir,
    rmmod, route, rpm, rpm2cpio, rsadecrypt, rsaencrypt, rsagenkey,
    rsasign, rsaverify, rtcwake, run-parts, runlevel, runsv, runsvdir, rx,
    script, scriptreplay, sed, sendmail, seq, setarch, setconsole, setfont,
    setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum,
    sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap,
    snmpdos, sockstress, softlimit, sort, spiffit, sping, split, ssyn2,
    start-stop-daemon, stat, stream, strings, stty, su, subclient, sudp,
    sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, synk4,
    synscan, sysctl, syslogd, tac, tail, tar, tcpsvd, teardrop, tee,
    telnet, telnetd, test, tftp, tftpd, time, timeout, top, torloris,
    touch, tr, traceroute, traceroute6, true, truncate, tsh, tshd, tty,
    ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol,
    ubiupdatevol, udhcpc, udhcpd, udpdata, udpspoof, udpsvd, uevent,
    umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz,
    unzip, uptime, users, usleep, uudecode, uuencode, vconfig, vi, vlock,
    volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois,
    wingatecrash, xargs, xersex, xersextcp, xz, xzcat, yes, zcat, zcip

./busybox

BusyBox v1.24.1 (2016-06-20 10:45:31 ICT) multi-call binary.

BusyBox is copyrighted by many authors between 1998-2015.

Licensed under GPLv2. See source distribution for detailed

Usage: busybox [function [arguments]...]

or: busybox --list[-full]

or: busybox --install [-s] [DIR]

or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix

utilities into a single executable. Most people will create a

link to busybox for each function they wish to use and BusyBox

will act like whatever it was invoked as.

Currently defined functions:

[, [[, acpid, add-shell, addgroup, adduser, adjtimex, aescrypt, arp,

arping, ash, awk, base64, basename, beep, beer, bindtty, blkid,

blockdev, boink, bonk, bootchartd, brctl, bunzip2, bzcat, bzip2, cal,

cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst, chroot,

chrt, chvt, cksum, clear, cmp, coke, comm, conseal, conspy, cp, cpio,

crond, crontab, crypthash, cryptpw, cttyhack, cut, date, dc, dcd3c, dd,

deallocvt, delgroup, deluser, depmod, devmem, df, dhclient, dhcprelay,

dhgenprime, diff, dirname, dmesg, dnsamp, dnsd, dnsdomainname,

dos2unix, dpsc, dpss, du, dumpkmap, dumpleases, ecdsa, echo, ed, egrep,

eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd,

false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fenc,

fgconsole, fgrep, find, findfs, flock, fold, free, freeramdisk, fsck,

fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, genericsum,

genkey, getopt, getty, gewse, gewse5, grep, groups, gunzip, gzip, halt,

hd, hdparm, head, hexdump, hole, hostid, hostname, httpd, hush,

hwclock, hydra, i2cdetect, i2cdump, i2cget, i2cset, id, ifconfig,

ifdown, ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice,

iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule,

iptunnel, jolt, jshon, kbd_mode, kill, killall, killall5, kissofdeath,

kkill, klogd, knbot, land, last, latierra, less, linux32, linux64,

linuxrc, lizbot, lizserv, ln, loadfont, loadkmap, logger, login,

logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof,

lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man,

md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs, mkfifo,

mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp,

modinfo, modprobe, more, mount, mountpoint, mpstat, mqsh, mqtte, mt,

mv, nameif, nanddump, nandwrite, nbd-client, nc, nestea, netscan,

netstat, newtear, nice, nmeter, nohup, nslookup, ntpd, ntpdos, od,

openvt, orgasm, ottf, passwd, patator, patch, pgrep, pidof, ping,

ping6, pipe_progress, pivot_root, pkdecrypt, pkencrypt, pkill, pksign,

pmap, pong, popmaildir, poweroff, powertop, printenv, printf, prism,

proxcat, ps, pscan, pstree, pubclient, pud, pwd, pwdx, raidautorun,

raped, rdate, rdev, readahead, readlink, readprofile, realpath, reboot,

reformime, remove-shell, renice, reset, resize, rev, rfkill, rm, rmdir,

rmmod, route, rpm, rpm2cpio, rsadecrypt, rsaencrypt, rsagenkey,

rsasign, rsaverify, rtcwake, run-parts, runlevel, runsv, runsvdir, rx,

script, scriptreplay, sed, sendmail, seq, setarch, setconsole, setfont,

setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum,

sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap,

snmpdos, sockstress, softlimit, sort, spiffit, sping, split, ssyn2,

start-stop-daemon, stat, stream, strings, stty, su, subclient, sudp,

sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, synk4,

synscan, sysctl, syslogd, tac, tail, tar, tcpsvd, teardrop, tee,

telnet, telnetd, test, tftp, tftpd, time, timeout, top, torloris,

touch, tr, traceroute, traceroute6, true, truncate, tsh, tshd, tty,

ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol,

ubiupdatevol, udhcpc, udhcpd, udpdata, udpspoof, udpsvd, uevent,

umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz,

unzip, uptime, users, usleep, uudecode, uuencode, vconfig, vi, vlock,

volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois,

wingatecrash, xargs, xersex, xersextcp, xz, xzcat, yes, zcat, zcip

The promised tools are indeed installed:

./busybox hydra 
Hydra v8.2-dev (c) 2016 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

...

./busybox ssyn2 
Invalid parameters!
Spoofed SYN Flooder v1.6.1 FINAL by ohnoes1479
Usage: ssyn2 &lt;target IP/hostname&gt; &lt;port to be flooded&gt; &lt;number threads to use&gt; &lt;time (optional)&gt;

./busybox sudp
Invalid parameters!
Spoofed UDP Flooder v2.5.3 FINAL by ohnoes1479
Usage: sudp &lt;target IP/hostname&gt; &lt;port to be flooded&gt; &lt;throttle (lower is faster)&gt; &lt;number threads to use&gt; &lt;time (optional)&gt;

./busybox hydra

...

./busybox ssyn2

Invalid parameters!

Spoofed SYN Flooder v1.6.1 FINAL by ohnoes1479

Usage: ssyn2 <target IP/hostname> <port to be flooded> <number threads to use> <time (optional)>

./busybox sudp

Invalid parameters!

Spoofed UDP Flooder v2.5.3 FINAL by ohnoes1479

Usage: sudp <target IP/hostname> <port to be flooded> <throttle (lower is faster)> <number threads to use> <time (optional)>

Loading this version of busybox in shipping products could seriously backfire if your device is hacked, so I guess some of the tools would have to be disabled, or/and only be used for internal testing.

Via n0where

Jean-Luc Aufranc (CNXSoft)

Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.