How to Create a Self Replicating Worm
The worms and viruses are mostly coded in assembly language. This gives an advantage of smaller size and the speed optimizations and much more control of developer over the worm or virus. But we are going to discus the worm creation in c++ in this section. We’ll apply the concepts studied earlier in this section.
Before starting to code our first c++ worm, lets discus a little about worms structure. The worm has at least two different sections. One section takes care of its reproduction (also called cloning) and the other section triggers the reproduced copies. Extra care must be taken here that, the trigger section might not trigger too much clones, otherwise the system will get overloaded and will be suspected for infection.
There may be other sections like payload section, the encryption section, decrypting block and exploits section, etc, but in our first worm, we are going to code only the two sections, the clone section and the trigger section.
Every worm has a mission and after the completion of its mission finally the worm should terminate the host processes or remove the worm files from the hosting victims.
One more thing friends, the worm development also creates some problems for the developers, therefore, you might backup your important data before proceeding. Also, always document your worm in a file sidewise, this documentation will help you understand if anything went wrong.
You should add the automatic boot up triggers in the last phase of the worm development process, this will help you a lot, if anything goes wrong during development.
During development phase, you should create the worm termination scripts first and always observe the process lists and cpu and memory performances in task manager.
The one very effective worm termination script is
FOR /L %I IN (1, 1, 100) DO TASKKILL /F /IM “WORM_EXE_FILE” /T
The above script is quite effective if worm goes wild during development phase. But this will not stop the advanced worms, this can terminate only the worms with very weak mechanism. But once the worm employs the automatic boot up triggers, this script will give up then. Remember, this script also eats up the cpu and makes it usable 100%.
Let us start with a little program that once started will execute itself recursively and will never end. This technique is called recursive execution technique and the process launches a fresh executing clone process of itself before terminating itself. The following code is the simplest program employing the recursive execution technique:
The ShellExecute() function determines the file launcher depending upon the file type (the file extension). The process in this case will not have any window. Thus after double clicking the executable file the process will keep in executing recursively in the memory.
The newer process has a new process ID and all resource allotments are done exclusively for it again.
Next a worm should have a mission, the payload section is determined by the mission or motto of the worm. In this case the worm has been assigned the mission to flood the network segment with broadcast icmp packets.
The target IP address can easily be changed to any victim to launch a resource eating attack on the target network by changing the macro IPADDR from broadcast address to the host to network transformed ip address number. If you don’t know about it then, refer to the socket programming section.
The following three functions from the icmp.dll will accomplish this task, IcmpCreateFile, IcmpSendEcho & IcmpCloseHandle.
The worm also reproduces itself from one system to another and launches in another system, for this purpose, the worm creates a new thread, which checks for the USB removable drives, if found, then copies itself with the name defined in DISGUISE macro, in following code, we have named it “Hotel California.mp3.exe” and creates an autorun.inf file.
The autorun.inf automatically launches the worm file automatically.
The next step is to make the worm launch itself when the system boots up. For this the worm configures the settings of a service. We have chosen the Print Spooler service for this purpose. The worm changes the executable file path to a copy of itself in system32 directory.
The following code accomplishes all the things discussed above and compile it and execute the executable file to execute worm
The above coding is quite lively, but will hog the cpu and this can easily be noticed by the sysops. Actually, the system function every time initiates the cmd.exe and then execute the respective program, thus creating unnecessary two processes at least. The process generation is considered very heavy process and might be avoided as much as possible.