+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Python (https://sinister.li/Forum-Python)
+--- Thread: Python Virus (/Thread-Python-Virus)
Pages:
1
2
RE: Python Virus - Deque - 01-09-2014
(01-09-2014, 11:30 AM)upsurt Wrote: I've been using py2exe, because I would love to compile my Python script to a real exe.
But first of all, you can use it only with Python 2.7. With Python 3 there are some issues.
But that's ok, I prefer anyway Python 2.7.
The bad thing is, you'll get a bunch of files. A real exe and additional stuff.
Sure, you can use it. It's working well. But you'll have many files and not only one standalone exe.
Correct me, if something changed or if you know it better.
I know C#/.Net quite well, but would never choose it for a virus.
As I said, I really don't know much about py2exe.
Edit: I found this, though: https://stackoverflow.com/questions/707242/create-a-standalone-windows-exe-which-does-not-require-pythonxx-dll
It seems a standalone is possible with the right options applied.
I wouldn't exclude .NET for all kind of viruses.
For PE viruses it isn't good, unless maybe you manage to create a CIL injection to the section that contains the CIL code (only works for .NET exe files as host).
You might also imagine a virus that infects .NET source files right before compilation.
In those cases you will have to write at least part of the virus' sources in a .NET supported language.
RE: Python Virus - upsurt - 01-09-2014
(01-09-2014, 11:40 AM)Deque Wrote: I wouldn't exclude .NET for all kind of viruses.
For PE viruses it isn't good, unless maybe you manage to create a CIL injection to the section that contains the CIL code (only works for .NET exe files as host).
You might also imagine a virus that infects .NET source files right before compilation.
In those cases you will have to write at least part of the virus' sources in a .NET supported language.
Sure, you're right. If you want a virus infecting .Net files, then it's fine.
I've even done this in the past.
But I would like to know more about infecting PE with ASM.
I know about Python virus infectiong other python files.
==> http://vxheavens.com/lib/vvx00.html
==> https://github.com/cranklin/Python-Virus
RE: Python Virus - Deque - 01-09-2014
(01-09-2014, 11:48 AM)upsurt Wrote: But I would like to know more about infecting PE with ASM.
Read that book: http://rogunix.com/docs/Malware/The%20Art%20of%20Computer%20Virus%20Research%20and%20Defense.pdf
You won't find any recipies there, but general concepts which I also used for the paper about infection strategies.
Some parts are pretty outdated, but there is a section about PE infection.
If you know how to program with ASM, it shouldn't be a problem to apply the knowledge.
RE: Python Virus - upsurt - 01-09-2014
(01-09-2014, 11:40 AM)Deque Wrote: As I said, I really don't know much about py2exe.
Edit: I found this, though: https://stackoverflow.com/questions/707242/create-a-standalone-windows-exe-which-does-not-require-pythonxx-dll
It seems a standalone is possible with the right options applied.
I've to try this out. Thank you!
But there is a comment:
Quote:The solution is working well but what about the inclusion of tkinter in the exe? The executable crashes if I move it out the dist directory but it works well inside dist where "tcl" dir is present.
So I'm not sure it is working...
RE: Python Virus - Deque - 01-09-2014
(01-09-2014, 11:48 AM)upsurt Wrote: I know about Python virus infectiong other python files.
==> http://vxheavens.com/lib/vvx00.html
==> https://github.com/cranklin/Python-Virus
I wrote one too: http://www.hackcommunity.com/Thread-Tutorial-Python-source-basic-virus-infection-and-polymorphism
It is good way to teach how viruses work in general.
The most tricky source infectors only infect right before compilation and clean the source files right after so that you don't see any tracks.
RE: Python Virus - upsurt - 01-09-2014
nice one! have you writen a virus in any other language?
RE: Python Virus - Deque - 01-09-2014
(01-09-2014, 02:21 PM)upsurt Wrote: nice one! have you writen a virus in any other language?
I have a concept code in Java that infects runnable jar files: http://www.hackcommunity.com/Thread-Java-jar-virus-example
But that's it.
RE: Python Virus - kenjoe41 - 01-24-2014
Wouldn't it be wiser to inject a dll.It is so easy in python.
RE: Python Virus - commander - 01-24-2014
but... will such a virus work on windows? I mean it have got python dependency. then what is the use with it.
RE: Python Virus - Pielco11 - 03-14-2014
Is possible to compile an .py file to an .exe file.. just try "pyinstaller".. it can compile also to all the type of platform (python is cross-platform) ... "pyinstaller --onefile virus.py"... finally you can try the "--noconsole" option, it'll not display the window's program..