使用WMI和Remoting的完美组合来实现在远程计算机上创建进程及与之通讯

使用WMI和Remoting的完美组合来实现在远程计算机上创建进程及与之通讯

其实这两种技术都可以非常方便的实现在远程机器上创建进程这个目标。我这里之所以要结合使用，主要是为了方便远程进程之间的通讯。这里先介绍下Remoting的简单对象访问协议（soap）的通讯的信道的注册程序, 我把他命名为RemoteServer.exe, 它应在远程计算机（以下简称远程计算机为服务器）上配置在特定的目录下，一旦它被启动，那么这台远程计算机就将为我们提供soap 通道服务：ChannelServices，当然这个通道的端口，和服务器的名称，我们可以放到一个XML配置文件中。好了废话不多说了，还是让我做些实际的事情吧，那就看看这个程序的代码吧！

using System; using System.Collections; using System.Text.RegularExpressions; using System.Runtime.Remoting; using System.Runtime.Remoting.Channels; using System.Runtime.Remoting.Channels.Http; using System.Security.Permissions; using System.Xml; using SimpleRemotingAsm; namespace RemoteServer { /// <summary> /// This Program enables communication between Server and client. /// </summary> class Server { #region The entry point Main function /// <summary> /// The entry point Main function of the console program. /// </summary> static void Main(string[] args) { Console.WriteLine("*****RemoteServer started!*****"); Console.WriteLine("Hit enter to end"); try { string url = GetProperty("RemoteObjectUri"); int portNum = GetPortNum(url); HttpServerChannel c = new HttpServerChannel(portNum); ChannelServices.RegisterChannel(c, false); RemotingConfiguration.RegisterWellKnownServiceType(typeof(SimpleRemotingAsm.RemoteObject), "RemoteObject.soap", WellKnownObjectMode.Singleton); Console.WriteLine("The port number is {0}", portNum); } catch (Exception e) { Console.WriteLine(e.Message); } Console.ReadLine(); } #endregion #region The GetPortNum method /// <summary> /// Get the Port number from a URL string. If there's not a pot number in URL, /// use port 22222 by default. /// </summary> /// <param name="url">URL string</param> /// <returns>port number</returns> static int GetPortNum(string url) { int portNum = 22222; string pattern = @"(?<=:)(/d+)(?=/)"; Regex reg = new Regex(pattern); Match m = reg.Match(url); portNum = Int32.Parse(m.Value); return portNum; } #endregion #region The GetProperty method /// <summary> /// Read configure information from config.xml file. /// </summary> /// <param name="name">property option</param> /// <returns>property value</returns> static string GetProperty(string name) { XmlDocument xmlDoc = new XmlDocument(); xmlDoc.Load("config.xml"); XmlNodeList xe = xmlDoc.GetElementsByTagName("Property"); int i = 0; while (xe[i] != null) { if (xe[i].Attributes[0].InnerText == name) { string s = xe[i].Attributes[1].InnerText; if (s.Contains("[ServerName]")) { return s.Replace("[ServerName]", GetProperty("ServerName")); } return s; } i++; } Console.WriteLine("Value not found!"); return null; } #endregion } }

很简单吧？接着我要给出config.xml的内容：

<?xml version="1.0" encoding="utf-8" ?> <Config> <Properties> <Property name="ServerName" value="SUT02" /> <Property name="RemoteServer" value="RemoteServer.exe" /> <Property name="RemoteObjectUri" value="http://[ServerName]:22222/RemoteObject.soap" /> <Property name="UpLoadPath" value="C:/upload/" /> <Property name="UpLoaderName" value="UpLoader.exe" /> </Properties> </Config>

可以看出config.xml亦很简单，RemoteObjectUri的值就是我们利用.NET Remoting访问远程对象时将要用到的一个URL，请务必小心配置，里面的[ServerName]在程序中会被动态替换为SUT02，注意这就是ServerName的值，该值务必设为远程计算机的名称或IP地址。冒号后面的22222就是你想使用的信道的端口号，最好设大点，以免已经被其他程序占用了。当然也不是越大越好，端口空间是1-65535。RemoteServer就是我们上面给出的程序可执行文件名称了，该可执行文件应该已经存放在Server的C:/upload/下面了，即UpLoadPath下面，后面还有一个配置，等下会提到，是用来试验我们刚刚使用.NET Remoting创建的信道来创建远程进程的一个程序可执行文件名称，该可执行文件应该已经存放在Server的C:/upload/下面了，即UpLoadPath下面。

到此为止，不知你有没有什么疑问，如果你没有疑问，那只能证明你比我还粗心，在列出RemoteServer代码的时候，我没有说明有关RemoteObject的东东。回顾上面的代码，你将发现：
...... using SimpleRemotingAsm; ...... RemotingConfiguration.RegisterWellKnownServiceType(typeof(SimpleRemotingAsm.RemoteObject),"RemoteObject.soap", WellKnownObjectMode.Singleton);

其实也不难，SimpleRemotingAsm就是一个C# class Libruary程序，他里面只有一个Class：RemoteObject，这个类的实例将在服务器上产生，但是，实例的访问却是在我们的client上进行的，当然啦，要不怎么叫soap，要不怎么叫Remoting呢？呵呵。RegisterWellKnownServiceType调用后，服务端就一Singleton模式实例化了一个RemoteObject对象，“RemoteObject.soap”就是该对象的uri名称，注意这里是短格式的uri。好了，让我带领你看看SimpleRemotingAsm的程序代码吧：

using System; using System.Diagnostics; namespace SimpleRemotingAsm { /// <summary> /// Defined a remote object ,which is constructed on SUT, and is called by client. /// </summary> public class RemoteObject : MarshalByRefObject { #region The public constructor /// <summary> /// Construction method, shows a message on SUT after it is constructed. /// </summary> public RemoteObject() { Console.WriteLine("Constructing RemoteObject!"); } #endregion #region The public RunCommand function /// <summary> /// Call a program to run on SUT. /// </summary> /// <param name="cmd">The program to run</param> /// <returns>A string contains the output after the program ran</returns> public string RunCommand(string cmd) { Process p = new Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardInput = true; p.StartInfo.RedirectStandardOutput = true; p.StartInfo.RedirectStandardError = true; p.StartInfo.CreateNoWindow = true; p.Start(); p.StandardInput.WriteLine(cmd); p.StandardInput.WriteLine("exit"); string message = p.StandardOutput.ReadToEnd(); p.Close(); return message; } #endregion } }

很简单的吧，这个库只有一个类RemoteObject，该类只有一个方法RunCommand，方法只有一个参数，即要执行的命令字符串。

这个方法中有这么几行代码：

            Process p = new Process();
            p.StartInfo.FileName = "cmd.exe";

            ... ...

            p.StartInfo.CreateNoWindow = true;

 

这是说我们首先将创建一个控制台程序，并且该控制台是隐藏窗口运行的。

 

接下来看看，如何在客户端使用WMI远程创建RemoteServer进程，之后再利用RemoteServer进程注册的信道，进行Remoting通讯。

什么都没有代码更具说服力，那我就列出Client的代码吧：

using Microsoft.Win32; using System; using System.Collections.Generic; using System.Management; using System.Text; using System.Threading; using System.Runtime.InteropServices; using System.Runtime.Remoting; using System.Runtime.Remoting.Channels; using System.Runtime.Remoting.Channels.Http; using System.Xml; using SimpleRemotingAsm; namespace Client { class Program { #region Private member variables /// <summary> /// The computer name of the server. /// </summary> private static string remoteServerHostName; /// <summary> /// The domain of the remote server user. /// </summary> private static string remoteServerDomain; /// <summary> /// The user name of the remote server user. /// </summary> private static string remoteServerUserName; /// <summary> /// The password of the remote server user. /// </summary> private static string remoteServerUserPassword; /// <summary> /// The position of UpLoader.exe on SUT. /// </summary> private static string upLoadPath; /// <summary> /// The name of the executable file used to upload virus file. /// </summary> private static string upLoaderName; #endregion static void Main(string[] args) { remoteServerHostName = GetProperty("ServerName"); remoteServerDomain = GetProperty("Domain"); remoteServerUserName = GetProperty("UserName"); remoteServerUserPassword = GetProperty("Password"); upLoadPath = GetProperty("upLoadPath"); upLoaderName = GetProperty("upLoaderName"); Execute(); Upload(); Terminate(); } #region Execute method /// <summary> /// The method is used to start up the sut controled application on the server. /// </summary> /// <returns>If the operation is successful, returns true, otherwise returns false.</returns> public static bool Execute() { if (RunRemoteCommand(GetProperty("RemoteServer"), upLoadPath)) { Thread.Sleep(1000 * Int32.Parse(GetProperty("DelaySeconds"))); return true; } return false; } #endregion #region Terminate method /// <summary> /// The method is used to terminate the process of the sut controled application on the server. /// </summary> /// <returns>If the operation is successful, returns true, otherwise returns false.</returns> public static bool Terminate() { if (RunRemoteCommand(GetProperty("TerminatorBatName"), upLoadPath)) { Thread.Sleep(1000 * Int32.Parse(GetProperty("DelaySeconds"))); return true; } return false; } #endregion #region Upload method /// <summary> /// upload an virus infected file to a IIS server. /// </summary> /// <returns>Return ture if running success, false otherwise</returns> public static bool Upload() { HttpChannel channel = new HttpChannel(); ChannelServices.RegisterChannel(channel, false); //Get a RemoteObject's reference from the server, the Uri of this object is specified in config.xml //This RemoteObject is defined in SimpleRemotingAsm namespace, so does its own operations. object remoteObj = Activator.GetObject(typeof(SimpleRemotingAsm.RemoteObject), GetProperty("RemoteObjectUri")); if (remoteObj == null) { // Assert the connect operation is success. Console.WriteLine("Could not locate server!"); return false; } RemoteObject simple = (RemoteObject)remoteObj; // Initialize the variables. string virusInfectedFile = GetProperty("VirusInfectedFile"); string virusInfectedFileDestinationUrl = GetProperty("VirusInfectedFileDestinationUrl"); string commandLine = string.Format("{0}{1} /"upload/" /"{2}/" /"{3}/"", upLoadPath, upLoaderName, upLoadPath + virusInfectedFile, virusInfectedFileDestinationUrl); //Run the operation of the RemoteObject in server, and get the returned value. string result = simple.RunCommand(commandLine); ChannelServices.UnregisterChannel(channel); if (result.IndexOf("successfully") != -1) { return true; } else { return false; } } #endregion #region GetProperty method /// <summary> /// Read configure information from config.xml file. /// </summary> /// <param name="name">property option</param> /// <returns>property value</returns> static string GetProperty(string name) { XmlDocument xmlDoc = new XmlDocument(); xmlDoc.Load("ClientConfig.xml"); XmlNodeList xe = xmlDoc.GetElementsByTagName("Property"); int i = 0; while (xe[i] != null) { if (xe[i].Attributes[0].InnerText == name) { string s = xe[i].Attributes[1].InnerText; if (s.Contains("[ServerName]")) { return s.Replace("[ServerName]", GetProperty("ServerName")); } return s; } i++; } Console.WriteLine("Value not found!"); return null; } #endregion #region RunRemoteCommand method /// <summary> /// Run a command on remote server /// </summary> /// <param name="strCommand">The command line to run</param> /// <param name="path">The command's current working directory</param> /// <returns>Return ture if running success, false otherwise</returns> private static bool RunRemoteCommand(string strCommand, string path) { try { ConnectionOptions connOption = new ConnectionOptions(); connOption.Username = remoteServerDomain + @"/" + remoteServerUserName; connOption.Password = remoteServerUserPassword; ManagementPath mngPath = new ManagementPath(@"//" + remoteServerHostName + @"/root/cimv2:Win32_Process"); ManagementScope scope = new ManagementScope(mngPath, connOption); scope.Connect(); ObjectGetOptions objOption = new ObjectGetOptions(); ManagementClass classInstance = new ManagementClass(scope, mngPath, objOption); ManagementBaseObject inParams = classInstance.GetMethodParameters("Create"); int ProcessId = 0; //inParams.SetPropertyValue("CommandLine", strCommand); object[] cmdline = { "cmd /c " + strCommand, path, null, ProcessId }; classInstance.InvokeMethod("Create", cmdline); return true; } catch (Exception) { return false; } } #endregion } }

这只是一个简单的在客户端使服务器上传一个病毒文件的应用，思路比较简单，首先利用WMI使远程服务器执行一个名字为RemoteServer.exe的隐藏控制台程序，以建立soap通道，进行后续的.NET Remoting调用，及Upload调用。最后Terminate使用一个在服务器端配好的一个bat脚本来关闭RemoteServer.exe隐藏控制台程序。

bat脚本的内容如下：

taskkill /f /im RemoteServer.exe

 

另外客户端程序需要注意添加WMI的引用：System.Management;

和Remoting的相关引用：

using System.Runtime.InteropServices;
using System.Runtime.Remoting;
using System.Runtime.Remoting.Channels;
using System.Runtime.Remoting.Channels.Http;

读取配置文件时用到了XmlDocument，所以需要引用：using System.Xml;

还有就是我们的RemoteObject对象库的引用：using SimpleRemotingAsm;这在Upload方法中会用到。

 

最后，ClientConfig.xml的内容如下：

<?xml version="1.0" encoding="utf-8" ?> <Config> <Properties> <Property name="ServerName" value="SUT02" /> <Property name="Domain" value="CONTOSO" /> <Property name="UserName" value="administrator" /> <Property name="Password" value="Password02!" /> <Property name="RemoteServer" value="RemoteServer.exe" /> <Property name="RemoteObjectUri" value="http://[ServerName]:22222/RemoteObject.soap" /> <Property name="UpLoadPath" value="C:/upload/" /> <Property name="UpLoaderName" value="UpLoader.exe" /> <Property name="VirusInfectedFile" value="VirusInfectedFile.txt" /> <Property name="VirusInfectedFileDestinationUrl" value="http://[ServerName]/subwebpath/VirusInfectedFile.txt" /> <Property name="TerminatorBatName" value="terminator.bat" /> <Property name="DelaySeconds" value="3" /> </Properties> </Config>

呵呵，很简单吧：）打字打得很累的，所以谢绝转载，谢谢合作！