1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
| #include <windows.h>
#include <stdio.h>
typedef BOOL (WINAPI *Del)(LPCTSTR lpFileName);
typedef VOID (WINAPI *Term)(HANDLE hProcess,UINT uExitCode);
typedef HANDLE (WINAPI *GetC)(void);
struct DAT// структура поможет удалению.
{
Del DELETE_F;
Term EXIT_P;
GetC GET_P;
char buf [256];
};
static DWORD WINAPI Trfunc (LPVOID param)
{
DAT* data = (DAT*)param;
while(!data->DELETE_F(data->buf));
data->EXIT_P(data->GET_P(),0);//прибиение cmd
return 0;
}
int main()
{
//полезный код
for(int i =0;i<10;++i)
{
printf("useful\n");
Sleep(500);
}
//бодяга для удаления
DAT data;
GetModuleFileName(GetModuleHandle(0),data.buf,256);//имя самое
data.EXIT_P = (Term)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"TerminateProcess"); //сохраняем проц завершения процесса
data.DELETE_F = (Del) GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"DeleteFileA");// сохраняем проц удаления
data.GET_P = (GetC) GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"GetCurrentProcess");// сохраняем проц получения текущего процесса
PROCESS_INFORMATION pinf = {0};
STARTUPINFO sinf = {0};
sinf.cb = sizeof(STARTUPINFO);
CreateProcess("C:\\WINDOWS\\system32\\cmd.exe",0,0,0,FALSE,CREATE_NO_WINDOW,0,0,&sinf,&pinf);
char* ppp = (char*)VirtualAllocEx(pinf.hProcess,0,500,MEM_RESERVE|MEM_COMMIT,PAGE_EXECUTE_READWRITE);
char* p2p = ppp+sizeof(data);
DWORD dw;
WriteProcessMemory(pinf.hProcess,ppp,&data,sizeof(data),&dw);
WriteProcessMemory(pinf.hProcess,p2p,&Trfunc,500-sizeof(data),&dw);
HANDLE htr = CreateRemoteThread(pinf.hProcess,0,0,(LPTHREAD_START_ROUTINE)p2p,ppp,0,&dw);
CloseHandle(pinf.hProcess);
CloseHandle(htr);
return 0;
} |
