个人的后门程序开发（第一部分）：文件操作和注册表管理

本来是想寒假时写的，结果一直懒得动手。


虽然手上有ghost源码，但是感觉功能不是我想要的，比如把精力费在学MFC写界面上不如改进下隐藏性。

基本的计划就是做一个后门程序，目的是用来进行权限维持的。目前来看是基于控制台的，而且要带有内核模块，应用层的主要问题就是没写过太大体量的程序导致搞起来很蛋疼，内核方面就是通用性坑爹，

蓝屏起来也要费时间。

第一部分就是封装的两个函数，文件操作和注册表管理。ghost是把这两个功能封装成两个类，我这里就直接用函数来实现了。

VS2015编译通过

//文件操作类函数
#include "windows.h"

//Mode操作模式
//0.新建文件 1.删除文件 2.写文件 3.读文件 4.移动文件 5.获取文件信息
#define CREATE_FILE 0
#define DELETE_FILE 1
#define WRITE_FILE  2
#define READ_FILE   3
#define MOVE_FILE   4
#define QUERY_FILE  5

#define FILE_SUCCESS 1
#define FILE_ERROR   0

//定义一个文件信息的结构，用于QUERY_FILE返回
typedef struct _FileInfo{
DWORD FileAttributes;
char *FileName;
char *TypeName;

} FILE_INFO,*PFILE_INFO;

DWORD FileControl(IN DWORD Mode,IN LPWSTR FilePath, IN OUT PVOID Buffer,IN __int64 FilePointer,IN OUT DWORD *Size)
{
HANDLE FileHandle = 0;
DWORD Return = 0;
SHFILEINFO MyFileInfo = { 0 };
PFILE_INFO FileInfo = 0;
__int64 TempPointer = FilePointer;
TempPointer = TempPointer & 0XFFFFFFFF;
__int64 *pTempPointer = &TempPointer;
switch (Mode)
{
case WRITE_FILE:
case READ_FILE:
case QUERY_FILE:
FileHandle=CreateFile(FilePath,
GENERIC_READ | GENERIC_WRITE | GENERIC_ALL,
FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (FileHandle== INVALID_HANDLE_VALUE)
{
Return = GetLastError();
return Return;
}
break;
case CREATE_FILE:
FileHandle = CreateFile(FilePath,
GENERIC_READ | GENERIC_WRITE | GENERIC_ALL,
FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
CREATE_NEW,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (FileHandle == INVALID_HANDLE_VALUE)
{
Return = GetLastError();
return Return;
}
break;
default:
break;
}
switch (Mode)
{
case CREATE_FILE:
CloseHandle(FileHandle);
break;
case DELETE_FILE:
if (!DeleteFile(FilePath))
{
Return = GetLastError();
return Return;
}
break;
case MOVE_FILE:
if (!MoveFile(FilePath,(LPCWSTR)Buffer))
{
return FILE_ERROR;
}
break;
case QUERY_FILE:
SHGetFileInfo(FilePath,
NULL,
&MyFileInfo,
sizeof(MyFileInfo),
SHGFI_TYPENAME | SHGFI_DISPLAYNAME | SHGFI_ATTRIBUTES);
///////////////////////////////////////////////////
/*
typedef struct _SHFILEINFO

{

HICON hIcon;//文件的图标句柄

int iIcon;//图标的系统索引号

DWORD dwAttributes;//文件的属性值

char szDisplayName[MAX_PATH];//文件的显示名

char szTypeName[80];//文件的类型名

} SHFILEINFO;
*/
/////////////////////////////////////////////
FileInfo=(PFILE_INFO)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
sizeof(FILE_INFO));
if (!FileInfo)
{
return FILE_ERROR;
}
memset(FileInfo, 0, sizeof(FILE_INFO));
FileInfo->FileAttributes = MyFileInfo.dwAttributes;
FileInfo->FileName = (char *)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
sizeof(MyFileInfo.szDisplayName));
memcpy(FileInfo->FileName,
MyFileInfo.szDisplayName,
sizeof(MyFileInfo.szDisplayName));
FileInfo->TypeName = (char *)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
sizeof(MyFileInfo.szTypeName));
memcpy(FileInfo->TypeName,
MyFileInfo.szTypeName,
sizeof(MyFileInfo.szTypeName));
((DWORD *)Buffer)[0] = (DWORD)FileInfo;
CloseHandle(FileHandle);
break;
case READ_FILE:
if ((!FilePointer)||(!Size))
{
return FILE_ERROR;
}
if (SetFilePointer(FileHandle,
(LONG)(FilePointer >> 32),
(LONG *)pTempPointer,
FILE_BEGIN
) == HFILE_ERROR)
{
return GetLastError();
}
memset(Buffer,
0,
*Size);
if (!ReadFile(FileHandle,
(LPVOID)Buffer,
*Size,
Size,
NULL))
{
return GetLastError();
}
CloseHandle(FileHandle);
break;
case WRITE_FILE:
if ((!FilePointer) || (!Size))
{
return FILE_ERROR;
}
if (SetFilePointer(FileHandle,
(LONG)(FilePointer >> 32),
(LONG *)pTempPointer,
FILE_BEGIN
) == HFILE_ERROR)
{
return GetLastError();
}
if (!WriteFile(FileHandle,
(LPCVOID)Buffer,
*Size,
Size,
NULL))
{
return GetLastError();
}
default:
return FILE_ERROR;
}
return FILE_SUCCESS;
}
DWORD IfFile(DWORD Return)
{
switch (Return)
{
case FILE_SUCCESS:
return 1;
case FILE_ERROR:
return 0;
default:
return -1;
}
}

//注册表操作的封装函数
#include "windows.h"

#define DUQV 0
#define MEIJVZIJIAN 1
#define MEIJVJIANXIANG 2
#define PANDUANCUNZAI 3
//读取注册表的指定键的数据(Mode:0-读键值数据 1-牧举子键 2-牧举指定键项 3-判断该键是否存在)
int ReadReg(HKEY MainKey, LPCTSTR SubKey, LPCTSTR Vname, DWORD Type, char *szData, LPBYTE szBytes, DWORD lbSize, int Mode)
{
HKEY hKey;
int  iResult = 0;
char KeyName[32], ValueSz[MAX_PATH], ValueTemp[MAX_PATH];
DWORD szSize, KnSize, dwIndex = 0;
memset(KeyName, 0, sizeof(KeyName));
memset(ValueSz, 0, sizeof(ValueSz));
memset(ValueTemp, 0, sizeof(ValueTemp));
if (RegOpenKeyEx(MainKey,SubKey,0,KEY_READ,&hKey)!=ERROR_SUCCESS)
{
return -1;
}
switch (Mode)
{
case DUQV:
switch (Type)
{
case REG_SZ:
case REG_EXPAND_SZ:
szSize = sizeof(ValueSz);
if (RegQueryValueEx(hKey,Vname,NULL,&Type,(LPBYTE)ValueSz,&szSize)==ERROR_SUCCESS)
{
return -1;
}
break;
case REG_MULTI_SZ:
szSize = sizeof(ValueSz);
if (RegQueryValueEx(hKey,Vname,NULL,&Type,(LPBYTE)ValueSz,&szSize)==ERROR_SUCCESS)
{
return -1;
}
break;
case REG_BINARY:
szSize = lbSize;
if (RegQueryValueEx(hKey,Vname,NULL,&Type,szBytes,&szSize)==ERROR_SUCCESS)
{
return -1;
}
break;
}
break;
case MEIJVZIJIAN:
while (1)
{
memset(ValueSz, 0, sizeof(ValueSz));
szSize = sizeof(ValueSz);
if (RegEnumKeyExA(hKey,dwIndex++,ValueSz,&szSize,NULL,NULL,NULL,NULL)!=ERROR_SUCCESS)
{
break;
}
wsprintf((LPWSTR)ValueTemp, L"[%s]\r\n", ValueSz);
strcat(szData, ValueTemp);
iResult = -1;
}
break;
case MEIJVJIANXIANG:
while (1)
{
memset(KeyName, 0, sizeof(KeyName));
memset(ValueSz, 0, sizeof(ValueSz));
memset(ValueTemp, 0, sizeof(ValueTemp));
KnSize = sizeof(KeyName);
szSize = sizeof(ValueSz);
if (RegEnumValue(hKey,dwIndex++,(LPWSTR)KeyName,&KnSize,NULL,&Type,(LPBYTE)ValueSz,&szSize)!=ERROR_SUCCESS)
{
break;
}
switch (Type)
{
case REG_SZ:
wsprintf((LPWSTR)ValueTemp, L"%-24s %-15s %s \r\n", KeyName, "REG_SZ", ValueSz);
break;
case REG_EXPAND_SZ:
wsprintf((LPWSTR)ValueTemp, L"%-24s %-15s %s \r\n", KeyName, "REG_EXPAND_SZ", ValueSz);
break;
case REG_DWORD:
wsprintf((LPWSTR)ValueTemp, L"%-24s %-15s 0x%x(%d) \r\n", KeyName, "REG_DWORD", ValueSz, int(ValueSz));
break;
case REG_MULTI_SZ:
wsprintf((LPWSTR)ValueTemp, L"%-24s %-15s \r\n", KeyName, "REG_MULTI_SZ");
break;
case REG_BINARY:
wsprintf((LPWSTR)ValueTemp, L"%-24s %-15s \r\n", KeyName, "REG_BINARY");
break;
default:
break;
}
lstrcat((LPWSTR)szData, (LPWSTR)ValueTemp);
iResult = 1;
}
break;
case PANDUANCUNZAI:
iResult = 1;
break;
default:
break;
}
RegCloseKey(MainKey);
RegCloseKey(hKey);
return iResult;
}