Self-Executing HTML roy g biv / 29A About the author: Former DOS/Win16 virus writer, author of several virus families, including Ginger (see Coderz #1 zine for terrible buggy example, contact me for better sources ;), and Virus Bulletin 9/95 for a description of what they called Rainbow. Co-author of world's first virus using circular partition trick (Orsam, coded with Prototype in 1993). Designer of world's first XMS swapping virus (John Galt, coded by RT Fishel in 1995, only 30 bytes stub, the rest is swapped out). Author of world's first virus using Thread Local Storage for replication (Shrug, see Virus Bulletin 6/02 for a description, but they call it Chiton), world's first virus using Visual Basic 5/6 language extensions for replication (OU812), world's first Native executable virus (Chthon), world's first virus using process co-operation to prevent termination (Gemini, see Virus Bulletin 9/02 for a description), world's first virus using polymorphic SMTP headers (Junkmail, see Virus Bulletin 11/02 for a description), world's first viruses that can convert any data files to infectable objects (Pretext), and world's first 32/64-bit parasitic EPO .NET virus (Croissant). Author of various retrovirus articles (eg see Vlad #7 for the strings that make your code invisible to TBScan). Went to sleep for a number of years. This is my seventh virus for Win32. It is the world's first virus using self-executing HTML. MHTML - Microsoft Helps To Make expLoits ;) JunkHTMaiL brings to you another new technique for e-mail speading. If you read RFC 2557, you will see a description about MIME HTML (MHTML). Using MHTML allows us to send MIME files that we can execute! How? The first part is to specify the name and location of the file to create. MHTML allows us to do that using the "Content-Location:" token. Using the "file://" URI, we can specify the path and filename, for example like this: Content-Location://file:///.exe Only the directory and suffix is needed. No need for any filename at all. This is the same as for OLE2 files. So now we have our file, how to run it? Internet Exploiter Internet Explorer will search a large amount of files for HTML code, so all we need to do is append some script and use a codebase that references our file. We can do it this way:

CLSID can be any hex string. Only the first 8 bytes are checked, so no need for the other parts. The problem is the variable part (the document.URL). We need to know this before we can instantiate the object. What's the solution? DHTML - Devious HTML :) Dynamic HTML allows us to alter pages on-the-fly, which will the be executed automatically. We can do this with the document.write() method, like this: So now we can resolve our variable URL and create a page with the proper value which will be executed. The codebase refers to our file, and Internet Explorer will automatically decode and execute for us. JunkHTMaiL uses the JunkMail polymorphic SMTP engine, so the text will be highly variable. Here is an example JunkHTMaiL e-mail before obfuscation: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=WIFVHABY --WIFVHABY Just click the attachment If the attachment is blocked by Outlook 2002 then see http://support.microsoft.com/support/kb/articles/q290/4/97.asp --WIFVHABY Content-Type: text/plain; name=email.htm Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment MIME-Version: 1.0 Content-Location:file:///.exe Content-Transfer-Encoding: base64 [base64 encoded file] --WIFVHABY -- Here is an example JunkHTMaiL e-mail after obfuscation: MIMe-vERSioN: 1(*T).0 COntEnT-TyPe: ("=29<=2FS=43=52=49=50=54=3E --WIFVHABY OIALNKVLKBDYHURLTQQGRACSXCSGLWKJVSDROSQBJOXYMYAFRFQJGKA VBJLPEZQDTRVIXV AHAVZF ABCAYMKUVCZERXGK MCKSRAHQVCJVFYZJGTRUHRJQXPNUWJRRJCRTGCOFCRWNRNKYGAXT NEWUHSRTHFEIWGHMMELC PQJQLUYEBRTOPMMUEIZYEXAITLRBJOTVLMFZIZTUTSVILGZQQSKODLBCIKW VADMWVJEXMGWEPAJIVBEXBQQESSCWMQVSUZXVOMLGATIUKIJCCZRZZQSF FPGMSXAG -- Wow! :) Yes, even the base64 encoded part is encoded further using octets. JunkHTMaiL uses the JunkMail text compression to hide the e-mail texts. The compressor is also included so you can change the texts if you want to. That's all for this time. Some cynics might say it is too late for you to ever make it to the top. They are right. That top is ours. ;) roy g biv greets: RT Fishel JunkMail rocks! VirusBuster I hope it's not too late... Prototype see you in the next life The Gingerbread Man ...actus rium non facit nici. mens ria sit rgb/29A may 2003 iam_rgb@hotmail.com