how does one make a worm to send packets to execute bytes on a
computer without the legitimate user downloading the Stuxnet?
It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were basically unknown vulnerabilities to Microsoft and the general community until Stuxnet was discovered and analysed.
Here's the 0day vulnerabilities attributed to Stuxnet:
allows local users or remote attackers to execute arbitrary code via a
crafted (1) .LNK or (2) .PIF shortcut file, which is not properly
handled during icon display in Windows Explorer
when printer sharing is enabled, does not properly validate spooler
access permissions, which allows remote attackers to create files in a
system directory, and consequently execute arbitrary code
do not properly manage a window class, which allows local users to
gain privileges by creating a window, then using (1) the
SetWindowLongPtr function to modify the popup menu structure, or (2)
the SwitchWndProc function with a switch window information pointer
does not properly determine the security context of scheduled tasks,
which allows local users to gain privileges via a crafted application
Using these vulnerabilities Stuxnet could execute code on a remote machine, elevate its privileges, then repeat the cycle over and over. This is the basically how any worm operates.
In addition Stuxnet utilised two stolen certificates to sign drivers that Windows would trust, enabling it to gain access into the Kernel.
How is this even achieved.
You couldn't use the same vulnerabilities to build a worm like Stuxnet today, you'd have to find new vulnerabilities. As you can imagine these kinds of vulnerabilities are extremely rare and valuable to an attacker.
Trojan Horse virus needs to be downloaded, but this worm does not?
It comes down to economics, if every malware creator had access to these kinds of vulnerabilities then I'm sure they would build worms instead of Trojans. On the other hand a Trojan might be cheaper and just as effective depending on the scenario.
If you're just trying to spread adware then it'd be a waste to use such a valuable vulnerability when you can get a significant number of people to willingly install your malware just by showing them a banner ad saying "Double your RAM today!".
However, if your goal is to infiltrate the nuclear facilities of a foreign country then popup ads won't cut it.