;*******************************************************
;ml /c /coff /Fo selfkill-Rnt.obj selfkill-Rnt.asm
;Link /subsystem:windows /SECTION:.text,WRE selfkill-Rnt.obj
;*******************************************************
.386
.model flat, stdcall
option casemap :none
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
;*******************************************************
.code
;删除自身的远程线程代码
KREMOTE_CODE_START equ this byte
call @F
@@:
pop ebx
sub ebx,offset @B ;重定位
push 500
call [ebx+_lpselfkillSleep]
lea eax,[ebx+offset _selfkillselfname]
push eax
call [ebx+_lpselfkillDeleteFile]
ret
_lpselfkillSleep dd ?
_lpselfkillDeleteFile dd ?
_selfkillselfname:
KREMOTE_CODE_END equ this byte
KREMOTE_CODE_LENGTH equ offset KREMOTE_CODE_END - offset KREMOTE_CODE_START
;*******************************************************
.data?
REMOTE_CODE db KREMOTE_CODE_LENGTH dup (?)
szSelfName db MAX_PATH dup (?)
.code
;*******************************************************
;用于在explorer.exe进程中插入远程线程
szDesktopClass db 'Progman',0
szDesktopWindow db 'Program Manager',0
_RemoteCode2KXP proc @_RmCodeStart,@_RmCodeLen
local @hRmCodeMemory
local @hselfkillProcessID
local @hselfkillProcess
;查找文件管理器窗口并获取进程ID，然后打开进程
invoke FindWindow,addr szDesktopClass,addr szDesktopWindow
lea ecx,@hselfkillProcessID
invoke GetWindowThreadProcessId,eax,ecx
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_OPERATION or \
PROCESS_VM_WRITE,FALSE,@hselfkillProcessID
mov @hselfkillProcess,eax
;在进程中分配空间并将写入远程代码，建立远程线程
invoke VirtualAllocEx,@hselfkillProcess,NULL,@_RmCodeLen,MEM_COMMIT,PAGE_EXECUTE_READWRITE
.if eax
mov @hRmCodeMemory,eax
invoke WriteProcessMemory,@hselfkillProcess,eax,@_RmCodeStart,@_RmCodeLen,NULL
xor eax,eax
invoke CreateRemoteThread,@hselfkillProcess,eax,eax,@hRmCodeMemory,eax,eax,eax
invoke CloseHandle,eax
.endif
invoke CloseHandle,@hselfkillProcess
ret
_RemoteCode2KXP endp
;*******************************************************
szselfkillDllKernel db 'Kernel32.dll',0
szselfkillSleep db "Sleep",0
szselfkillDeleteFile db "DeleteFileA",0
start:
;取得API地址(硬编码地址)
invoke GetModuleHandle,addr szselfkillDllKernel
mov esi,eax
invoke GetProcAddress,esi,offset szselfkillSleep
mov _lpselfkillSleep,eax
invoke GetProcAddress,esi,offset szselfkillDeleteFile
mov _lpselfkillDeleteFile,eax
;把远程代码和自身地址合并
cld
mov ecx,KREMOTE_CODE_LENGTH
mov esi,offset KREMOTE_CODE_START
mov edi,offset REMOTE_CODE
rep movsb
invoke GetModuleFileName,NULL,offset szSelfName,MAX_PATH
push KREMOTE_CODE_LENGTH+MAX_PATH
push offset REMOTE_CODE
call _RemoteCode2KXP
ret
end start
|
本类阅读TOP10