Original subtitles

hey hackers blue Cosmo here today I'm

going to show you guys how Trojan

viruses actually work how to build one

and actually all that really cool stuff

it's going to be pretty low level

hopefully you guys have some sort of

experience to it but I'll try to make it

as beginner friendly as I can uh today

I'm going to show you guys how Trojan

viruses work right the Trojan virus um

obviously if you guys aren't familiar

with Trojan viruses it's basically a uh

piece of malware embedded within another

normal file right we have like this

normal exe that we made a last episode

in the previous video actually we um did

a whole Deep dive on portable

executables how they work so you guys

you can understand how exe Pals work as

well as uh dll files work as well so I

definitely suggest you check that video

out if you're new yeah so a trojan virus

is just a piece of malware embedded

within another another normal executable

so if we were to execute this and then

it were to also execute some malicious

code in the background so it didn't look

like

um it was malware it looked like it was

a part of the normal executable it's

attached to which is a pretty cool

concept it's named after the uh the

Trojan Horse obviously and the method

that I'll show you guys in this video is

a pretty cool and somewhat kind of

unique method

um so I'll go ahead and open up the text

editor and I'll just drop the exe that

we made in the last video now in the

last video I kind of talked about code

caves and if you don't know what a code

cave is I'll just scroll all the way

down to the bottom of the pile and boom

there is this Cave of no bites these

just zeros just go straight down like if

you scroll up for a little bit they go

up for quite a bit right uh you can see

I can highlight this down right and

there are quite a lot of zeros here

um so what we can do is we can actually

load malicious bytes into this code cave

right you guys can see there are plenty

of normal bites here that are part of

the normal program but who was to say

that we can't put our own malicious

stuff in here and the great thing about

this too is that it doesn't make the

file any bigger or smaller because we're

just replacing bytes that already exist

with malicious code right so it's gonna

be great it's gonna be awesome

um one thing we have to note though is

we can't just directly you know change

these bytes in here and expect it to

work because that's not how it works in

fact let me show you how it does work

right

so I'm going to go ahead and make a

little diagram just going to help out

with understanding uh the structure

we'll make this white we'll get a little

little blind going here there you go

nice

nice cool so this is what um our PE file

structure looks like p e file right

um in your PE file we have the code and

then we have the code cave right I'll

just put cave down here because it's a

good uh understanding and what this code

cave is going to do is nothing actually

what this P file does is just go

straight down

the file just like that so it runs it

executes pretty much top to bond they're

going to be jumps that go up and down

and all this other stuff but for the

most part it's reading the instructions

each line and just going down the file

until the file is finished with its

execution right you kind of think about

it like that

um I'll go ahead and copy this and make

a another version right here and this is

going to be our Trojan so I'll go ahead

and call this the Trojan so with the

Trojan virus right we don't go top to

bottom right uh in fact this cave is

actually going to be our shell coat and

the shell code is the malicious code

that we're going to put in that code kit

right so we'll call it shell code that

is the malicious code that we put in the

code cave it's like our payload right

I'll show you guys how to make some

shortly

um but just to kind of help you guys

understand right uh when the file chose

a virus executes it's going to start

from the top right but instead of going

down the code it's actually going to

skip out and go straight to our Shell

Code right so this our Shell Code gets

executed before the actual code of the

program so from there we can go

and Lead ourselves back up to the

beginning of the file right and then

lastly have our code execute as normal

to the bottom

and that is how the Trojan Works

compared to the B file right it's the

same bio we're just manipulating right

the code is still there this code right

here and this code right here are the

same code right this is the same file

but we're going to manipulate the empty

space within this file put malware in it

that we call Shell Code and skip to the

top of the file and execute it so that's

how our chosen is going to work now

Trojans are very vast form of malware

right this is how the one I'm showing

you is going to work but obviously it's

going to work different for different

files different methods different

attacks procedures whatever

we'll go into uh my Linux terminal you

guys should probably have like a Kali

Linux system or like uh I don't know

paired OS that's what I'm using paired

OS I'm going to go ahead and write msf

console msf console is the Metasploit

framework console

um it is an amazing exploitation tool

created by rapid7

um so you guys can totally take their

stuff and play around with it let's go

ahead and create our shelter so we're

going to do is use uh payload

Windows exec and this is going to allow

us to create our Shell Code for the

Windows operating system now

um this is going to create a 32-bit

shell count and we're going to be

working with 32-bit in this video

however if you guys want to create

64-bit Shell Code you can just do x64 in

front of that exec and boom you have 64.

uh bit shell kill right we're going to

be using 32-bit up stuff for this entire

video because 32 bits just a little bit

more popular and a little bit more

easier to work with but again you guys

can totally use 64-bit stuff but because

uh quick winning because we are using

32-bit stuff all of our other work that

we're going to have to do is 32-bit the

executable we manipulate the executable

we compile whatever has to be 32-bit as

well with our 32-bit shock cool so keep

that in mind as we kind of go forward

right we can show what options we have

and you can see there's two options uh

command and an exit function the command

is whatever malware we want to execute

onto the system right so we'll set the

command

to calc dot exe right and count.exe is

just a system calculator right if I open

up a Powershell and I type in calc.exe

you'll see the calculator pop up right

so this is a good way to let us know

that our code is working because if we

can execute count.exe then we can

execute whatever we want right so that's

a good kind of proof of concept to help

us out I kind of neglected to say this

in the beginning of the video but uh you

know don't do this unethically right do

this in your own lab do this in a cool

way to kind of learn how uh malware

works and how to build your own stuff

anyway uh the exit function is just

basically how the exit technique of the

shell code is going to work through

right we're just going to use thread

because it's easy to work with

especially within our shotgun nice so

thread awesome

um that should be it uh you can go ahead

and generate

um the raw formats we'll do raw and

we'll call this uh calc.binary uh

content bin cool so you you can go into

list to see your calc dot binge file

right there and we can exit

so if we do xxd on our calc.bin you can

kind of see a good overview of what the

actual Shell Code looks like you can see

the offsets going down the left column

the hexadecimal code in the middle

column and the ASCII representation of

the far right column you can also see

calc.exe right here right and this is

basically saying hey all these bytes are

going to prepare

um our system to execute calc.exe so

yeah that's basically um the structure

of our Shell Code and right these are

the bytes these bytes are what we have

to load into the system so go ahead and

load your shell code into your system I

already have mine uh waiting for me

right here uh basic choice right count

up in right there cool actually let's go

ahead and load count.bin into here

because we're actually going to need it

um in our hex editor something super

super important that a lot of people

forget with shell code or when building

or working with shortcut it's this no

bite right here this no bite the zero

zero indicates the end of our Shell Code

and if we forget this our Shell Code

will not work so make sure that we do

not forget that no bite right there

that's more of a reminder to myself than

to you guys

so we actually don't really have a

executable we can work with so let's go

ahead and make one

um I'm going to use x86 the native tools

command prompt this command prompt comes

pre-installed with the visual studio so

if you guys get Visual Studio you guys

will get this x86 near the command

prompt this is the 32-bit version which

is why I'm using it right

um so if we go ahead onto our file

explorer I'll go ahead and just copy

that route and CD and paste into that

directory

um we can go ahead and open up this

directory in Visual Studio code all

right so go ahead and Echo nothing into

a main.c program and this is what we're

going to go ahead and get started with

working on in this video so our

executable that we're going to create

today is going to be a very simple

message box I think message boxes are

just easy for beginners to understand

easy to work with easy for proof of

Concepts and all that so to make our

message box all we have to do is include

it went into the

windows.h header file we can do a pragma

for uh the user32 uh dll all right so

let's go ahead and make our main

function we'll do it main void in here

and then we will uh go ahead and have

our opening acrylic braces then we'll

just create our message box right here

and our message box uh first parameter

is no

um our second parameter is the message

so I'll just do a subscribe with the

smiley face and then uh we'll go ahead

and do cosmodium CS as the title and

then we'll go ahead and do a uh MB icon

this time we'll do exclamation I think

last video we did a icon air uh MB okay

and then have the button be the OK

button uh real quick

um if you guys haven't seen the previous

video I really really really suggest you

do especially if you guys are beginners

in that video we talked about portable

executables right so exes dlls and give

you guys a really good understanding of

how this stuff works so if you guys are

new to this stuff I really really

suggest you guys check out that video

I'll link it in the cards and whatever

but um this should be it this is a very

basic uh C program and it's just going

to create our message box so I'll go

ahead and execute this compile it and we

should see

there you go cosmodium CS subscribe the

exclamation icon and the OK button

let's go ahead and make a Trojan out of

this very basic main.exe right so if we

open it up in our hex editor and scroll

all the way down you guys can see the

code cave that is in this file now that

we have a file we can work with that has

um an empty cocave we can actually go

ahead and start working with this file

now again we can't just drop our Shell

Code into there we need to make sure we

have to work with it properly therefore

we are going to be working with

everybody's favorite assembly cool so I

can actually close this on they wouldn't

need a lot of this stuff anymore

um yeah so let's go ahead and get

started and I'm going to open up x32dbg

um this is what what stop stop I have

the executable on my system X32 there

you go um X32 dbg is just a very basic

uh debugger it's an amazing debugger I

definitely suggest you guys try it out

go ahead hit that file button and attach

our main.exe into this program right

here we can kind of see the CPU right of

the actual XP executable that got loaded

right if we go ahead and run it you guys

can see it hits the entry point now this

is important right because the entry

point is the uh kind of the beginning of

where the executable actually starts

running right if I kind of uh run

through this right it hits that

subscribe right we can hit okay and then

the program closes right the program

exits because the program finished it's

execution so we can go ahead and hit

restart go to the entry point right and

what we're going to want to do is we're

going to kind of start taking notes um I

will use uh Visual Studio code for this

actually I think I kind of like the way

uh Visual Studio code looks uh when we

kind of work with these files the first

thing we're going to have to do is save

the entry point address of our code so

if we go back to our debugger

um I'll go ahead and copy like through

these lines you don't have to copy this

many just copy a few and and save them

into your little lockout just keep note

of everything The Next Step we're going

to get is the code kit right so we need

to get the address of the code cave and

um It's associated okay so what we can

do is scroll down

and again you guys can see all these

note bytes at the end of the file it's

just like looking at it in the hex

editor uh but instead it's in a had a

different format with actual addresses

and some other information right but you

guys can see right here is kind of where

the code cave starts we have all these

zeros here so we'll just kind of just

rely on this area right here so I'll get

Ctrl C copy that address and then we'll

save it to the code K right so now that

we have the actual

um entry point information right here

and the code cave information right here

we can go ahead and do the first part of

the code right so I'll go ahead and

restart and run so we're at the entry

point of the cut right so this is the

first thing that executes right so

instead of having this do whatever the

heck it's doing we want to change this

to have it jump to our Shell Code or to

our code right so we'll hit the space

that should allow you to edit that line

so we'll do JMP for jump space and then

you want to get the address of our

cocave so we'll go ahead and copy this

address right here and whoops paste it

in right there make sure you select

those no Ops and Z parse uh that will

just make sure everything works okay and

then hit okay

so we can close this now close

and you'll see now the entry point

instead of doing what it used to do is

jump into our hex address right here

right and if we double click on that

jump it takes you straight down to the

code cave right so now we're actually at

the cocave where we can work with right

so now we're gonna have to start pushing

some of these registers and I know you

guys are pretty new to some of this

stuff right so we're going to have to do

a push ad and a push FD now I know you

guys are new so I'll kind of help you

guys understand what we're looking at

right so the push ad

um assembly code pushes all the general

registers onto the set right so things

like eax ECX edx ebx all that other

stuff

um that right here

um this stuff is what it's going to be

pushing on to the stack this way we can

actually save the registers at that

current time so that way we can pull

them back down later and have the code

execute as it's supposed to right so

that's what our push ad is going to do

it's going to get all the general

registers and if we get our push FD or

push FD this is going to do the same

thing but it's just going to do the

e-flex right again I'll leave uh these

links in the description for you guys

but ultimately just do research if you

guys hear me talking about stuff right

just build up your skill set your

knowledge right because I can't teach

everything all in one video

um but yeah so what we want to do is do

that push a d and push FD right so we'll

go ahead and space push a d and then

push FD and that should be it right so

we can close up for now and now you can

see we're pushing 80 and pushing FD and

pushing those registers and flags onto

the stack so we can pull them down later

and have our code continue as normal

with all the appropriate registers and

flags right

so now that we've saved the register

save the flags we can actually start to

execute our show code as anticipated

right so you can go in your hex editor

go on your calc.bin and then we can go

ahead and highlight our Shell Code right

here so I'll go ahead hit Ctrl c a bunch

of times or you can just hit copy like

that right

um go back to the debugger and then

select the line right under push FD and

then just shift down and I'm just going

to go down just for a little bit I'm

just going to kind of estimate your

guesstimate obviously you wouldn't want

to calculate this realistically speaking

but I'm sure you guys are pretty new and

don't want to throw stuff into a

calculator right

um so in order to open this just hit

Ctrl e and we can add edit the

hexadecimal code and then you can just

Ctrl V into the hex section right here

and it will actually add the Shell Code

from your

calculator.binary into the actual main

executable that we're working with right

so I'll go ahead okay and if we scroll

up you in the sea right after a push ad

and push FD is our actual hex code right

you can see the uh shell code being

executed right after our push FD here

and it is just being executed throughout

the rest of the program and eventually

we hit this null byte now leave this

null bite here remember how this null

byte is indicating the end of this

executable leave that no bite there

leave that there so that way the program

knows when the end of the Shell Code

actually exists so we're going to leave

this line blank keep it all zeros and

start working back on this line so in

order to do this we'll do a pop

FD and then pop 80 right because we want

to do it first of all in the reverse

order and again pop if you guys don't

know uh what pop is

um I'll go ahead and open it pop FD pop

ad right the pop FD is going to restore

those flags and then the pop 80 is going

to restore those General registers

remember the EDI ESI EB all these other

registers

um we're just restoring them back and

then the pop FD is doing the same so

that way

um our program can actually continue to

execute with its original registers and

its original Flags right because

basically we can just put those onto the

stack let the stack hold on to them do

whatever what the we need to do

with our Shell Code and then pull those

back down so now that we've pulled them

back down right we need to actually

execute the original program otherwise

this wouldn't be a Trojan right this

would just be

um shitty malware right so we want to

actually execute the original program so

we can go back this line right here is

the line replace we replaced this line

at the entry point with the jump to the

cocave right this line used to jump to

our cocave but it no longer is the

original code it used to be so what we

can do is just highlight the original uh

code that the entry point was supposed

to execute and have it execute after our

Shell Code has been run so we can hit

space and then uh paste that line into

there obviously it won't work so you'll

have to delete those carrots and then

delete that uh main dot stuff in front

of it just so that way it's exactly the

same of how it used to be so we can hit

OK and then now it will reformat itself

back to the main dot underscore main

cert startup uh Command right cool so

now that that's done we have one more

job we need to do right so basically

what we've done so far is um we've

replaced our entry point to jump to our

cocave and then our cocave is now

executing shell count now that that we

finished executing your shell code and

we ran the original command that the

instrument was supposed to execute we

can have our code cave jump back to the

second address and then it can just

continue execution as normal going down

the rest of the program so all we need

to do is just jump back to this address

right here so that way the program can

continue to execute as normal right so

we'll go ahead and hit space jump spit

and paste in the address right here hit

OK and that should be it right so that's

part one right because we're not done

yet because this

um some there's a bug that we have here

that I will disclose in a little bit

if we go ahead and look at this jump

right here this last jump if I double

click on it it will take us right under

the entry point if I scroll up you'll

see we are right under the entry point

which is perfect right so what's going

to happen with the code is that it's

going to execute hit our entry point of

the program if we double click it's

going to jump down it's going to do our

push ID push FD execute our Shell Code

and then it's going to have the null

byte to indicate that the end of the

um shell codes has executed then we're

going to restore

um those flags and registers execute the

original code of the entry point and

then we're going to jump back up as if

it never happened to the rest of the

execution of the program right it's

going to go here and it's going to go

here and it's going to continue

executing down

there's a little Band-Aid icon right

here we can click on that and then this

is going to allow us to patch our file

right so we can go ahead and hit patch

file

and then we'll call this uh main Tech

patched.exe right same

cool so this file will not work right if

we if we run it it might open up the

calculator

um but it won't actually execute

um the program right you see it opens a

calculator which is good but it didn't

execute the original code right and

that's because somewhere in this code

our shell code is exiting right so it's

exiting the program right and I'll kind

of show you guys this right so if we

open up our patched executable let's go

ahead and run it and we hit the entry

point and then we'll hit the entry point

run it again

and you see how it just exits right you

see how it just exits the code because

it just hit termination what's happening

is our shell code is exiting the program

before the normal code can continue so

what we need to do is go to our entry

point

um and I guess step into that

instruction right so when you step into

it

um we'll hit our push ad and push FD

um and what we're going to do is we can

flag uh a lot of or break add Brain

Points to a lot of these calls right

just hit F2 on these calls and it'll

allow you to break point them if you

need to

um I already know the call that's going

to stop its execution is likely this

last call uh right here so I'll go ahead

hit this call and this call right here

but again if you guys want to you guys

can breakpoint all of these uh calls to

see if it's being executed properly or

not right the breakpoints are basically

going to break the execution of the code

for a little bit halted stuff where you

can inspect what's going on

um but yeah let's go ahead and restart

the program

right if I run it we'll hit the entry

point I hit run again and we hit into

the uh first break point right you can

see the code is still executing so

there's nothing to worry about uh that

we can hit the run again and you can see

it executed the calculator so this call

right here up until this point it

executes our shelter but as soon as I

hit run again it'll hit this call and I

hit run one more time and it exits the

program right it didn't it was never

able to continue and jump back up and

all the other stuff because the code

exited all right so now we're at the

point where we kind of have an

understanding of what's going on but now

we're doing all these pushes and stuff

with Registries that we don't want to

happen because this is the last call

that is made and this executes the

shotgun we know it executes at this

point so we don't have to worry about

the rest of the execution here from this

point on right so we're going to go to

this push zero and we're going to

replace this by zero with a jump to the

uh pop FD address right so I'll go ahead

and copy this pop FD address and I'll

paste it right here just so we can

quickly access it right I'll copy this

pop FD address and if we go on to this

post zero hit space and then JMP into

that address okay and close so what's

going to happen here is that it's going

to prevent that push from happening and

messing up with any of the actual exit

calls of the Shell Code because at this

call right here our Shell Code executes

right so now we just needed to do

restore those flags and registers and

call it the deck in fact if we double

click on this jump you'll see it takes

us to the pop FD just the pop ad it runs

the original entry point code and jumps

back up as if nothing ever happened and

continuous execution which is great so

let's go ahead and Patch this and then

patch file and then we'll call this Main

and then we'll call this trojan.exe

cool so now if we go to our file

explorer and we run our main.exe you'll

know this is just the normal subscribe

but if we run this thing and run the uh

Main trojan.exe

you'll know this it not only runs the

message box but it now also runs that

calculator

I'll go ahead and close this and let's

go ahead and try it again but we'll do

it on a different executable right so

let's go ahead if I go into a toolbox

tools this is internal Suite if you guys

don't have the uh system tunnel Suite uh

you guys can just go ahead so Central

Suite is an amazing Suite by the way I

just say download it has a lot of Cool

Tools helpful for malware analysis and

stuff I'll probably leave this in the

description stuff but the assistant

Channel Suite just has a bunch of random

uh executables that we can play with and

if I scroll all the way to the bottom

you'll see a zoomit.exe you can double

click it and it'll open up this little

thing that just helps you zoom in on

stuff it's a very basic uh program but

it's an actual executable and I want to

see if we can you know make this

executable a Trojan uh virus so what

I'll go ahead and do is copy this one

the reason I'm choosing zoom in.exe and

not zoom it64.exe is because this one is

32-bit right so if I go ahead and open

up my Studio or something we can drag

and drop our zuma.exe into PE studio and

we can see that it says right here is

32-bit so I'm going to go ahead and copy

this executable and I'll go into

development our basic Trojan and paste

the zuma.exe in here just so we can have

it in this directory so we can work with

it all right so let's take our zoom

in.exe and start working with this one

right so I will go ahead that file icon

double click on zoom in.exe and if we

scroll all the way down to the bottom

again we can see a giant code here at

the bottom of the file go ahead and

restart the file jump to the entry point

so let's go ahead and save that

information right so I'll go ahead and

copy the next few lines just so in case

if anything gets overwritten or anything

we can account for it right I'll just

use the same uh the same file here we'll

call this uh Zoom it.exe so we'll go

ahead and get our entry point

and paste in

um our entry point into there right

um now let's go ahead and get the code

Cave of the actual file cool so we found

the cocave address we'll go into copy

this and paste it right there now that

we have that information let's go ahead

and copy the code cave address because

this is what we want to jump to right so

let's go let's just restart hit run we

hit the entry point and then we can hit

space do that jump and enter

um the address to which we want to jump

to I'll hit okay right close this so now

our entry point right now if I double

click it jumps to our code address right

so now we can push our registers push

our flags and now we can start executing

um our Shell Code so what we want to

want to do is hold down shift hit that

down arrow and we're just going to

highlight

um a fair amount of this obviously you

would want to calculate the kill cave

and make sure that there's enough

allocation in there but honestly I kind

of just like to try and see if it works

or not hit Ctrl e so we can edit this

right and uh we'll go ahead onto our hex

editor go ahead and Ctrl a copy all this

code and paste it into here right so hit

okay and now you guys will see that we

have our Shell Code in here awesome so

we

have our Shell Code again you guys need

to have that no byte right after it so

make sure you guys have that no bite

right after and now we can go ahead and

pop FD pop ad so at this point right

here right we want to execute the

original entry point because we replace

the entry point with uh with our jump so

we want to do whatever it was trying to

do so whatever this was what I was

trying to do it was trying to do a call

to this address so let's go ahead and

copy and paste that call obviously it

won't work so you have to get rid of the

zoom it dot to make sure that it

executes the call to that address and

when you add it it will automatically

format that zoom in there for you all we

have now is the jump back to the rest of

the normal execution of the code so

we'll go ahead and copy this address

right here and we'll just do a JMP to

that address right there and hit okay uh

this jump again will take you right

under the entry point and this jump

right here will take you to the push ad

push FD of the coated that we're working

with so let's go ahead and make this

patch we'll call this Zoom it

patched.exe

okay and then we'll go ahead and open up

our uh Zoom it patch.exe and we're going

to run it double click on this code

right here right we can see a lot of the

different calls those codes making we

already know it's the push zero right

here go ahead and copy our pop FD

address so

copy and then we want to go ahead and

have our push zero hit that space and we

want to jump to that pop FD and hit okay

and that's it there you go so we can go

ahead and close this off uh patch the

file and we'll call this Zoom it

trojin.exe

okay so that's it so we can actually go

to our

um file explorer right here right I'll

kind of go ahead and minimize a lot of

these uh programs I'll actually look

I'll just go ahead and load the original

Zoom it onto the desktop and then the

zoom at Trojan onto the desktop as well

so we can kind of see their execution

so if we run the normal Zoom it

it opens up the zoom it executable from

the sys internal Suite to some random

zooming in random program right we can

close it and then if we run the zoom at

Trojan it will run our Zoom it but it'll

also run our calculator right because we

are having this is a trojan virus where

we execute

um the calc.exe as a part of this

program right

um yeah that's it that's that's how the

Trojan works and of course you can

replace this cow.exe with a Shell Code

of different executables or shell codes

of different uh command line arguments

or whatever you want really uh I'll

probably make some more videos about

Shell Code assembly debuggers if this

video was too advanced free let me know

and I can probably make some more

beginner friendly

um videos towards kind of getting into

this level of development hopefully

something new and interesting from my

perspective

um I've been trying to produce more of

my my hour projects on YouTube I know

YouTube isn't too fond of malware so I'm

kind of testing the one items with these

videos but hopefully this was something

you guys enjoyed please kind of support

me give me a little like and comment and

leave a little subscribe with this kind

of content interests you guys but uh

yeah thank you so much and uh Happy

hacking