Lets make Malware!

⚠️Responsible Usage Notice

This project is intended for educational and authorized security testing purposes only. Unauthorized use of this program against systems you do not own or have explicit permission to test is strictly prohibited and may be illegal. Always obtain proper authorization before running any form of penetration testing or exploitation activity. The creator assumes no liability for misuse or damage caused by improper or unlawful use of this software.

About

Boiler-plate C++ project for Windows Malware development, this repo hosts pre-prepared utility header-files students will use when following along the lesson and developing their own toy-malware sample.

The goal of this lesson is to demonstrate malware development using KSU's well-known and loved C++, learn how malware slips passed Defender, and how malware can persist on Windows machines.

This repo by default creates a .ps1 file containing the following:

Add-Type -AssemblyName System.Windows.Forms

[System.Windows.Forms.MessageBox]::Show(
    "We're hackers that keep it real!",
    "Love from HacKSU!",
    [System.Windows.Forms.MessageBoxButtons]::OK,
    [System.Windows.Forms.MessageBoxIcon]::Information
)

This payload is passed through XOR and converted into Hex, this hex-string is stored in evil.hpp in the defined variable REM.

This file can be found at:

$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\HACKSU\pwn.ps1

System Clean-up

This program does create a user-defined file and establishes persistence to that file.

Incase you are testing your code against your local-machine, open the terminal as the user who executed the program and move into their startup folder.

cd "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\HACKSU"

You should also check Windows Defender Exclusions as this program also creates an exclusion as well.

Windows Security > Virus & Threat protection settings > (Manage Settings) > Exclusions > (Add or remove exclusions)

Showcase Image