BQuick
join:2003-11-05
Italy
| Text File virus possible to make?
From Neowin forum:
DISCLAIMER: I AM NOT RESPONSIBLE FOR ANYHTING YOU DO WITH THE INFORMATION IN THIS ARTICLE. YOU AGREE TO ABIDE BY THIS CONDITION BY READING THIS ARTICLE. IF YOU DONT AGREE WITH THIS DONT READ THIS ARTICLE.
Short Intro:
The idea that a user could not get malicious code run on your computer from a .jpg file became false recently. And now for the first time it could be possible to get infected with a text file if it has not allready happened before. (well close to it anyway.)
Recently a article was published on astalavista by Geoff Vass from Australia about how cmd.exe can launch files with a .txt extrension as executables.
In the article it basically said that if you rename a .exe file to .txt and open cmd.exe and run it from cmd.exe it will run as a executable. It went on to say that he emailed microsoft about it and coincidentally shortly after microsoft released a warning about it. To qoute the article directly it said.
Quote:
"So I had an email conversation with the fellas at secure@microsoft.com and they felt it was not a problem and would not be changing the behaviour.
Coincidentally, shortly after MS issued KB811528 which says that CMD.EXE
looks at the header of the file and because it is an executable, executes it
and that you should only run code from trusted sources (blah blah blah)."
Unquote:
Note:
If you want to read the full article by Geoff Vass first it is included with this article in the folder called "Article By Geoff Vass" and the file name of "txtrant.txt".
He went on to say that you could hide malicious code in .txt extensions and virus scanners might not scan it and hackers can use it to hide malicious code. He also said that for a .txt virus to actually execute the user will need to open up the command prompt and execute it.
So I thought about it for a while and realized you could just send a virus as a .zip attachment and inside the zip file would be 2 Files. The first file would be a virus but with the actual extension renamed to .txt and perhaps hidden(seeing that the default setting is not to show hidden files). For the purpose of clarity lets just say this file is called "virus.txt"(of course a virus writer could name it whatever they wanted [duh]). The second file would be a shortcut with the following command.
"cmd.exe /c virus.txt"
In case you dont know what that command does it would execute "virus.txt" as an executable and close after the virus has finished installing.
You could also use a command like the following that would erase something of your choice and you would not need two files in the .zip attachment.
"cmd.exe /c del /q c:\windows\*.*"
Also the shortcut file icon is replaced with a text icon.(There is a text icon included with this article). So now the shortcut looks like a text file. It could be named readme.txt and of courseyou cant see the .lnk extension on shortcuts so it would look like a normal text file even if file extensions are shown.
You can change the icon of the shortcut if you go into the properties of the shortcut and click shortcut and click change icon and use the icon included with this article. You could also go to layout(in the properties section still) and have the windows size reduced so that the height is 1 and the width is 1 to make the command prompt windows smaller. Plus you could change the Window position to 999 on both width and height so the user can't even see it.
You can also rename the .txt extension on the actual virus to anything you want such as .jpg and i think anything else too.(I dont think it will execute if the file has no extension though). But give it a try.
The only bad part about it is that the shortcut will have a little arrow in its corner but its more tempting to click that than a .exe file.
Hopefully this will give Microsoft more reason to change cmd.exe so that it does not launch all file types as executable.
Files Included with this Article:
Files included with this article are a text icon in the icon folder, the Article by Geoff Vass from which i thought of this simple idea.(Thanks Geoff). And in the virus folder are a sample virus but the program that the shortcut launches is not a virus. It is just a program to test your cpuspeed.(If you wanted a real virus there you can make your own and use this technique to launch it).
Author: A+
Email: ProgramOS32@softhome.net
»www.neowin.net/forum/index.php?s···c=224440
What do you think of it? |
|
Vamp
5c077
Premium
join:2003-01-28
MD | I think ... stupid microsoft. |
|
BQuick
join:2003-11-05
Italy | reply to BQuick
Well,that was the final blow for me.After the jpeg exploit i was thinking of it,now i decided to put back Abtrusion Protector,although i wanted to keep my system lighter...Duh |
|
Anon users
@sympatico.ca | Seems like real-time scan on all files is a must now... |
|
Rdax
Premium
join:2001-05-18
El Dorado, AR | reply to BQuick
Yes it can and a properly configured AV can stop it. See this link:
»Question about Avast! Home |
|
Tuulilapsi
Kenosis
join:2002-07-29
Finland
1 edit | reply to BQuick
I don't see any problem, that's what I think.
... An executable file obviously doesn't magically morph into a text file simply because you name it "This is a text file.txt". Sure, the extension is .txt, because you made it so, but the file is still an executable, and not a valid text file. So there's really no "text file virus" issue there, it's just about a regular executable posing (badly) as a text file, when it really isn't.
Now, the JPEG problem is different, it's a real flaw in the MS libraries that process JPEG files that can be exploited even remotely, and the JPEG exploit is a valid concern, unlike this. |
|
bcool
Premium
join:2000-08-25
The Ozarks | I wonder how difficult it would be for MS to mod Windows' cmd.exe so that it would not run an executable that's masquerading as a text file?  |
|
Epyon9283
Premium
join:2001-12-26
Dayton, NJ
| reply to BQuick
tom@raptor ~ $ vi hellovirus.c++
tom@raptor ~ $ g++ -Wno-deprecated hellovirus.c++ -o hellovirus.txt
tom@raptor ~ $ ls -l hellovirus.txt
-rwxr-xr-x 1 tom users 8715 Oct 4 12:08 hellovirus.txt
tom@raptor ~ $ ./hellovirus.txt
Hello Virus!
tom@raptor ~ $
maybe I'm just used to not determining if something is an executable by the file name extension...
Anyway I'd be suspicious if I got a zip file or something with a text file and a shortcut. |
|
hpguru
Curb Your Dogma
Premium
join:2002-04-12
| reply to BQuick
I swear these vulnerability warnings are beginning to sound a lot like Ashcroft's terror rumor-mill.
Damn it! Where's my duct tape!?
--
OSAMA BIN LADEN WANTS YOU - to vote for George Bush. |
|
