ANTICHAT — форум по информационной безопасности, OSINT и технологиям

C:\masm32\get.exe netstat -a >> C:\log.log

.386
.model flat, stdcall
option casemap :none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\shell32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\shell32.lib

.data?
	argc	dd ?
	st_info	STARTUPINFO <>
        pr_info	PROCESS_INFORMATION <>
	
.code

start:
	invoke GetCommandLineW
	invoke CommandLineToArgvW, eax, addr argc
	mov esi, eax

mLoop:
	dec argc
	cmp argc, 0
	je mQuit
	add esi, 4
	
	invoke RtlZeroMemory, addr pr_info, sizeof pr_info
	invoke RtlZeroMemory, addr st_info, sizeof st_info
	mov st_info.cb, sizeof st_info
	mov edx, [esi]
	
	invoke CreateProcessW, 0, edx, NULL, NULL, FALSE, 0, NULL, NULL, addr st_info, addr pr_info
	invoke WaitForSingleObject, pr_info.hProcess, INFINITE
	invoke CloseHandle, pr_info.hProcess
	invoke CloseHandle, pr_info.hThread
	
	jmp mLoop
	
mQuit:
	invoke ExitProcess, 0
end start

startproc "netstat /a" >> log.txt

format PE GUI 4.0
include '%fasminc%/win32a.inc'
section '.code' code readable writeable executable

fmt     db "%s %ws",0
szfile  db "12345.bat",0
entry $
        ;получить и разделить аргументы
        invoke  GetCommandLineW
        push    eax
        invoke  CommandLineToArgvW, eax, esp

        lea     esi,[eax+4]
        pop     edi

        ;выделить строку под склеенные аргументы
        invoke  VirtualAlloc,0,1000h,MEM_COMMIT+MEM_RESERVE,PAGE_READWRITE
        mov     ebx,eax
        test    eax,eax
        jz      .exit

        ;склеить аргументы(кроме нулевого)
      @@:
        sub     edi,1
        jz      @f
        lodsd
        cinvoke _snprintf,ebx,1000h,fmt,ebx,eax
        jmp     @b
      @@:

        ;сздать батник
        add     ebx,1
        sub     esp,sizeof.OFSTRUCT
        invoke  OpenFile,szfile,esp,OF_CREATE
        mov     esi,eax
        add     esp,sizeof.OFSTRUCT

        ;записать туда строку
        invoke  lstrlen,ebx
        invoke  WriteFile,esi,ebx,eax,esp,0
        invoke  CloseHandle,esi

        ;запустить
        invoke  WinExec,szfile,SW_HIDE
        invoke  VirtualFree,ebx,0,MEM_RELEASE

        ;удалить
        invoke  DeleteFile,szfile
      .exit:
        invoke  ExitProcess,0


data import
library kernel32,'KERNEL32.DLL',\
          kernel32w,'KERNEL32.DLL',\
          user32,'USER32.DLL',\
          shell32,'shell32.dll',\
          ntdll,'ntdll.dll'

include '%fasminc%\apia\comdlg32.inc'
include '%fasminc%\apia\user32.inc'
include '%fasminc%\apia\kernel32.inc'
import shell32,\
        CommandLineToArgvW,'CommandLineToArgvW'
import kernel32w,\
        GetCommandLineW,'GetCommandLineW'
include '%fasminc%\ntdll.inc'
end data