浅析木马服务端的生成技术

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib
.data
szTitle db "Hello", 0
szText db "Hello, World", 0
.code
start:
invoke MessageBox, NULL, addr szText, addr szTitle, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, NULL
end start

BYTE bySrvData[] = {
    0x4d, 0x5a, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00,
    0x04, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00,
    0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    
// 由于篇幅略去以下所有数据-_-#...
};
BOOL CreateServer()
{
    HANDLE hFile;
    DWORD dwWritten;
    hFile = CreateFile( "C:\\MsgBox.exe", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL );
    
if
( hFile == NULL )
        
return
FALSE;
    WriteFile( hFile, (LPCVOID)bySrvData, 
sizeof
( bySrvData ), &dwWritten, NULL );
    CloseHandle( hFile );
    
return
TRUE;
}

BOOL CreateServer()
{
    HRSRC hResInfo;
    HGLOBAL hResData;
    DWORD dwSize, dwWritten;
    HANDLE hFile;
    
// 查找所需的资源
    hResInfo = FindResource( NULL, MAKEINTRESOURCE(IDR_SERVER), "Server" );
    
if
( hResInfo == NULL )
        
return
FALSE;
    
// 获得资源尺寸
    dwSize = SizeofResource( NULL, hResInfo );
    
// 装载资源
    hResData = LoadResource( NULL, hResInfo );
    
if
( hResData == NULL )
        
return
FALSE;
    
// 写文件
    hFile = CreateFile( "C:\\MsgBox.exe", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL );
    
if
( hFile == NULL )
        
return
FALSE;
    WriteFile( hFile, (LPCVOID)LockResource( hResData ), dwSize, &dwWritten, NULL );
    CloseHandle( hFile );
    
return
TRUE;
}

TCHAR strContext[] = "Hello, World!";
TCHAR strTitle[] = "Hello";
MessageBox( NULL, strContext, strTitle, MB_OK );
以上代码相对应的汇编代码为：
push 0 
; 最后一个参数MB_OK
lea eax,[ebp-18h]
push eax 
; 第3个参数strTitle
lea ecx,[ebp-10h]
push ecx ;
第2个参数strContext
push 0 
; 第1个参数NULL
call dword ptr [__imp__MessageBoxA@16 (0042a2ac)] 
; 函数调用

.data
szTitle db 100 dup('A')
szText db 100 dup('B')

HRSRC hResInfo;
HGLOBAL hResData;
DWORD dwSize, dwWritten;
LPBYTE p;
HANDLE hFile;
TCHAR szTitle[100], szText[100];
// 查找所需的资源
hResInfo = FindResource( NULL, MAKEINTRESOURCE( IDR_SERVER ), "Server" );
if
( hResInfo == NULL )
{
    MessageBox( hDlg, "查找资源失败！", "错误", MB_OK | MB_ICONINFORMATION );
    
break
;
}
// 获得资源尺寸
dwSize = SizeofResource( NULL, hResInfo );
// 装载资源
hResData = LoadResource( NULL, hResInfo );
if
( hResData == NULL )
{
    MessageBox( hDlg, "装载资源失败！", "错误", MB_OK | MB_ICONINFORMATION );
    
break
;
}
// 为数据分配空间
p = (LPBYTE)GlobalAlloc( GPTR, dwSize );
if
( p == NULL )
{
    MessageBox( hDlg, "分配内存失败！", "错误", MB_OK | MB_ICONINFORMATION );
    
break
;
}
// 复制资源数据
CopyMemory( (LPVOID)p, (LPCVOID)LockResource( hResData ), dwSize );
// 获取标题和文本，并复制数据
GetDlgItemText( hDlg, IDC_EDT_TITLE, szTitle, 100 );
GetDlgItemText(hDlg, IDC_EDT_TEXT, szText, 100);
CopyMemory( (LPVOID)( p + 0x800 ), (LPCVOID)szTitle, 100 );
CopyMemory( (LPVOID)( p + 0x864 ), (LPCVOID)szText, 100 );
// 创建文件，写数据
hFile = CreateFile( "C:\\MsgBox.exe", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL );
if
( hFile != NULL )
    WriteFile( hFile, (LPCVOID)p, dwSize, &dwWritten, NULL );
else
{
    MessageBox( hDlg, "创建文件失败！", "错误", MB_OK | MB_ICONINFORMATION );
    GlobalFree( (HGLOBAL)p );
    
break
;
}
// 收尾工作，释放资源
CloseHandle( hFile );
GlobalFree( (HGLOBAL)p );