Python based self-propagation [USB distribution]

[Pythogen]

Something I've been playing around with,

https://github.com/pythogen/Python/tree/master/Projects/pyCrawl

The crawl method searches the drive for file formats specified in the code in order to concatenate code or general data.

The driveScan method is designed to scan accessible drives A: to Z: for external device infection using the autorun exploit.

DriveScan loops until a new drive is found to be a accessible dir (when the device is inserted via usb) and copies itself as an exe (file execution directory / compiled with py2exe) to the located drive for infection. It also creates or overwrites autorun.ini for execution on vulnerable operating systems (Window XP and Vista) then finally hides both the newly copied executable and the ini file ending the infection process.

The process is continuous. The script's main priority is to scan for drives and distribute itself.

file extraction may be useful for injecting code into html files or rewriting python and ruby files.

Just something I wrote for fun and wanted to share. It's perhaps a foundation to some sort of malware due to the fact the only purpose is self-distribution..

[Pythogen]

Might look into this more laters and give my feedback, comments.

/Placeholder

Someone give us a TODO embeded in the forums, hehe. I am sure i am going to forget.

Cool! I've modified a few things. More comments included and a bit cleaner. Thanks for considering it! Silent USB distribution is/was always fascinating to me.

[NO_BOOT_DEVICE]

looks nice!
even though usb spreading doesn't work as well these days, it's still a good thing to learn about and still does work sometimes, so it is useful
you seem to know your stuff pretty well

a few thoughts i have:
on crawl(): you'd probably want to append to .py files before you get ahead of yourself and start porting to other languages
however, appending to py files doesn't work as well since it's just kinda self documenting code, which means it's easy for someone to look at and say "this looks fishy".
instead, here's an idea. check for the python lib files where all the default modules are stored, and hide yourself in one (os is a good one to choose) surrounded by a giant try except block so even if some code fails for some reason, the user doesn't see "valueerror in infectdrives()" and panic

Code: (python) [Select]

# Function used for hiding files (used in autorun.ini exploit)it's not an exploit, it's just a file that the os checks to see if the drive wants to run anything.
and i don't think you have to specify that it's used there, just do "# hides files"

Code: (python) [Select]

theDir = os.path.dirname(sys.executable) + "\\a.exe";
this was a little unwieldy, and depended on it being a.exe which probably would set off some alarm bells, so i looked around, and this should work
at top:

Code: (python) [Select]

from inspect import getsourcefile
from os.path import abspathreplacing that code:

Code: (python) [Select]

theDir=abspath(getsourcefile(lambda:0))

Code: (python) [Select]

if adriv == True:there are some scenarios where you absolutely need it to equal True and True only. this is not one, since all you want is a truthy value. "if adriv:" will work for checking if it's truthy, and "if not adriv:" will work for checking falsy.

also, on driveScan in general:
my opinion: driveScan should not contain your payload. it is called driveScan, it scans drives. that is it's goal.

driveScan should not at the least not include the drive infection function, instead it should only check os.path.isdir and then append the working ones to an array, that another function goes through. (infect(), maybe? ;P) the fact that it does contain drive infection makes changing the script to do what i'm about to say harder:

going through every drive on the system with a 1 second delay between drives and writing to them is, uh, bad. very bad. you want to wait a very long time (think in terms of instead of using a while loop you're using cronstyle scheduling) when you've scanned every drive. you also might want to look into this. it might be hard to do in python, but it'd make things a lot better. also, don't just write over and over again. try having ways to figure out if you have already touched it (if you want to think even sneakier, try doing that without using if file exists functions)

with those in mind, i have refined your drive scan function for you as a headstart:

Code: (python) [Select]

def drivescan():
  d = []
  for l in "ABCDEFGHIJKLMNOPQRSTUVWXYZ":
    d.append(os.path.isdir(l + ":\\"))
  return d

however, really, the most important thing is that you have fun. hacking should be fun, making scripts should be fun.
hope i helped!

[kenjoe41]

Code: (python) [Select]

def drivescan():
  d = []
  for l in "ABCDEFGHIJKLMNOPQRSTUVWXYZ":
    d.append(os.path.isdir(l + ":\\"))
  return d


You do realise this is gonna be a list of Trues and Falses, a generator expression or list comprehession method wouldn't have been too difficult to do:

Code: (python) [Select]

def drivescan():
  d = []
  d = [l for l in "ABCDEFGHIJKLMNOPQRSTUVWXYZ" if os.path.isdir(l + ":\\")]
  return d

And OP, i looked at the code and it lacks alot, i was in the impression it isn't done yet so continue working on it please. This is a good learning project.