Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

This repository offers a meticulous recreation of the notorious Stuxnet virus, crafted through extensive reverse engineering efforts carried out by cybersecurity professionals from around the world in 2010. It is strictly intended for academic study, malware analysis, and defensive research purposes, and should not be utilized for any malicious activities.

Stuxnet is recognized as the first cyber weapon engineered to inflict physical damage on industrial control systems (ICS). Its primary targets were Siemens Step 7 software and S7-300/400 Programmable Logic Controllers (PLCs), leading to the manipulation of frequency converter drives and subsequently damaging centrifuge rotors.

The reconstructed source code preserves the original logic and attack vectors while organizing the codebase for improved readability and analysis. The malware primarily targets Siemens SIMATIC WinCC, Step 7, and S7 PLCs, utilizing various propagation methods including USB drives (LNK exploits), network shares (Print Spooler), and peer-to-peer (P2P) networks.

The infection process begins with the Loader/Dropper (winsta.exe), which facilitates initial infection, privilege escalation, and deployment of other components. It then progresses to the Privilege Escalation stage (WTR4132.tmp), exploiting the Win32k.sys vulnerability to gain system-level privileges.

The malware then checks the environment to determine if its targets are present, such as Siemens software (WinCC, Step 7) and specific PLCs (S7-315, S7-417). It employs DLL injection techniques to intercept the s7blk_write function call and code injection to append malicious code to the OB1/OB35 blocks when a user downloads a project to the PLC.

Upon identifying the target, Stuxnet installs S7 Hooks (s7otbxdx.dll) to intercept communication between Step 7 and the PLC. If the target is not a Siemens device, the malware will self-destruct or enter an idle state. The Rootkit (File System) module (mrxcls.sys) is used to hide Stuxnet files, processes, and registry keys via SSDT hooking, while the Rootkit (Network) module (mrxnet.sys) filters file system requests to conceal malicious files and enables P2P propagation.

The payload (s7plcmain) is responsible for executing the Frequency Tampering attack that damages the centrifuges. The high-level execution flow of Stuxnet consists of nine stages, with the final stage installing a Rootkit (MRxCls) to hide files and registry entries, loading the Network module (MRxNet), and ultimately causing physical damage to the centrifuges by modifying the frequency output.

It is essential to note that this codebase is designed for static analysis and debugging in a controlled virtual environment, not for live deployment on critical infrastructure. The repository is licensed under the GNU General Public License v3.0, and the code is provided as-is without any warranty, and the authors are not responsible for any misuse or damage caused by this code.