PWN2FILE

A Linux based tool that disguises your payload as 40+ file formats to silently execute on a Linux system.

---

DESCRIPTION

PWN2FILE is an advanced Linux-based red team tool that generates malicious desktop launchers disguised as legitimate files. The tool supports 40+ different file formats across multiple categories including documents, media files, archives, and text files.

Inspired by APT41's proven social engineering and initial access tradecraft — specifically their use of spear-phishing campaigns and convincing file lures to deliver first-stage payloads — PWN2FILE demonstrates how sophisticated threat actors leverage user trust and desktop environments to gain initial footholds. APT41 has consistently used file-based lures in their operations, often delivering malicious documents or disguised executables to bypass security awareness training and endpoint protections.

When an unsuspecting victim double-clicks the file, their system interprets it as a .desktop application rather than the genuine file it appears to be. The launcher performs two simultaneous actions:

1. Decoy Execution: Downloads and opens a legitimate file (PDF, image, video, audio, archive, or text) to maintain normal behavior
2. Payload Delivery: Silently fetches and executes an attacker-supplied payload in the background

This sophisticated approach allows the payload to run completely undetected while the decoy file captures the victim's attention. The tool is intended for use only in controlled environments with explicit written permission.

---

APT41 Parallels

APT41 Technique	PWN2FILE Implementation
Spear-phishing lures	Uses realistic file icons and metadata to impersonate legitimate documents
Living off the land	Leverages Linux's native .desktop file specification — no custom binaries required
Initial access focus	Prioritizes gaining the first foothold through user interaction
Evasion of security tools	Bypasses traditional file-type analysis and email gateway scanning
Global targeting	Generic file format support makes the tool applicable to any target environment

---

Detection Opportunities for SOC Analysts

While PWN2FILE creates convincing lures, defenders can hunt for these indicators:

Indicator	What to Look For
.desktop file analysis	Monitor for newly created .desktop files with Exec= lines containing suspicious commands (e.g., curl, wget, bash -c, python -c)
File type mismatch	Cross-reference reported file extension (e.g., .pdf) with actual MIME type using file command
Icon anomalies	Look for .desktop files using high-resolution icons inconsistent with standard desktop themes
Process execution	Monitor for unusual execution chains originating from desktop environment components (gio-launch-desktop, xdg-open)
Email gateway	Scan for inbound .desktop files via email (often blocked or quarantined by enterprise gateways)
User awareness	Train employees to recognize when a file opens a terminal or prompts for credentials unexpectedly

---

Key Features

Multi-Format Disguise

• 40+ supported file formats across 6 categories
• Authentic file icons
• System default application integration

Multiple Payload Options

• Reverse Shells: 10 different variants (Bash, Python, Zsh, Awk, Telnet, Sqlite3, Socat, Ruby, PHP, Netcat)
• Metasploit: linux/x64/meterpreter/reverse_tcp & linux/x64/meterpreter_reverse_https
• Custom Scripts: Python, Bash, and Binary (ELF) payloads
• Customizable: Bring your own payload files

Cloud Infrastructure

• Supabase Integration: Reliable file hosting with CDN delivery
• Database Tracking: Automatic logging of all uploaded files
• Direct URLs: Instant payload access without authentication
• Scalable: Free tier supports multiple concurrent operations

Evasion Techniques

• Temporary Files: Automatic cleanup after execution
• Hidden Execution: No terminal windows or error messages

Zero-Dependency

• Uses only standard libraries
• No compilation or external tools required
• Cross-desktop environment support (GNOME, KDE, XFCE, etc.)

---

Supported File Types

Category	File Extensions	# of Formats
Documents	.pdf, .doc, .docx, .xls, .xlsx, .ppt, .pptx	7
Images	.png, .jpg, .jpeg, .gif, .bmp, .webp, .tiff, .svg, .ico	9
Videos	.mp4, .avi, .mkv, .webm, .mov, .wmv, .flv, .mpeg, .3gp, .m4v	10
Audio	.mp3, .wav, .ogg, .flac, .aac, .m4a, .opus, .wma, .aiff, .amr	10
Archives	.zip, .rar, .7z, .tar, .gz, .tgz, .bz2, .tbz2, .xz, .txz, .zst	11
Text	.txt, .log, .conf, .cfg, .ini, .properties, .env, .md, .rst, .json, .csv, .xml, .yaml, .yml	14
TOTAL		61+ formats

---

SETUP SUPABASE

• Go to: https://supabase.com/dashboard/new

• Create organization (org, personal)

• enable (Enable Data API) and (Automatically expose new tables)

• Copy Product URL and Publishable Key

• Go to Project Settings

• select API Keys

• Copy Service role secret

• Go to Storage

• click New bucket

• Put "data" as the bucket name, enable public bucket, and click Create.

and update your config.json file with your Project URL, Publishable key, service role secret

Example:

{
    "SUPABASE_URL": "https://gqbdetbewhevkksclbfu.supabase.co",
    "SUPABASE_KEY": "sb_publishable_TvQ2jFqzrPfsKC-krVrwqA_g_xjy9GM",
    "SUPABASE_SERVICE_KEY": "eyJHbgcrOeJIUsI2NiIsInR3cCI6IkpXcCJ9.eyJpc311OilzeXBhymFrZSIsInJlZiI6ImdxYmR5dGJld2hpdmtrZWNsYmd14iwicm9sZSI6InNlcnZpY2Vfcm9sZSIs3mlhdCI2MTc3NzkyMDk4OCwiZXhwIjoyMDkzNDk2OTg4fQ.L4wdbD3QgDv2NHlP6ZU53wpI2jlLZ0TQXfq6vy7VB_A"
}

INSTALLATION

git clone https://github.com/0xbitx/DEDSEC_PWN2FILE.git
cd DEDSEC_PWN2FILE
chmod +x dedsec-pwn2file
./dedsec-pwn2file

TESTED ON FOLLOWING

• Kali Linux
• Parrot OS

Legal Disclaimer

This tool is intended for educational and security research purposes only. Unauthorized usage may be illegal in your jurisdiction. The author is not responsible for any misuse of this tool.