So I wrote a little remote control client/server based app to turn off my roomates torrent client at night (to avoid having to go into his room). I could have done this with remote software such as teamviewer or VNC but I don't need all the functionality that they provide plus I figuired it was a good learning exercise. It's not a trojan per se, since he knows it is running so don't flame me! haha.
It works great on windows XP and vista but doesn't work at all on Windows 7 for some reason. It works like this:
-the server is always listening for incoming TCP connections
-if you click a 'heartbeat' button on the server it sends out a UDP broadcast to the LAN
-if the trojan is running on a computer in the lan and receives the right UDP broadcast data it will try to connect to the originating IP of that broadcast via TCP
-Once this connection is established serialized classes can be sent back and forth, giving me the ability to do things such as shutdown his computer, reboot it, get a list of running procs, kill a proc, or run a proc.
On windows 7 it doesn't seem like it is getting the UDP broadcast at all, as there is no attempt to connect via tcp after the heartbeat is sent out. I am hesitant to post the code for it since I know script kiddies from around the world will probably abuse it far beyond its original intent, so I will post only where I think the problem is occuring (if you want the whole source and have a good reputation on here feel free to ask):
Server code:
//Broadcast the heartbeat pulse
private void btnPulse_Click(object sender, EventArgs e)
{
IPEndPoint groupEP = new IPEndPoint(IPAddress.Broadcast, 8002);
UdpClient uClient = new UdpClient();
uClient.EnableBroadcast = true;
uClient.Send(Encoding.ASCII.GetBytes("KyleTrojStart"), Encoding.ASCII.GetBytes("KyleTrojStart").Length, groupEP);
Log("Broadcasting heartbeat to LAN");
}
//Listen for TCP connections
private void StartNetwork()
{
sListen = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
try
{
sListen.Bind(new IPEndPoint(IPAddress.Any, 8003));
sListen.Listen(5);
sListen.BeginAccept(cbAccept, sListen);
}
catch (SocketException sE)
{
Log("Socket exception: " + sE.Message);
}
}
//Callback for accepting connections - this code is never reached
private void cbAccept(IAsyncResult aR)
{
Socket lSock = (Socket)(aR.AsyncState);
try
{
Socket conSock = lSock.EndAccept(aR);
Invoke(new delVoidSocket(cbHandleAccept), conSock);
sListen.BeginAccept(cbAccept, sListen);
}
catch (SocketException sE)
{
Invoke(new delVoidString(cbHandleError), sE.Message);
}
}
//Callback for handling accepted connections - this code is never reached
private void cbHandleAccept(Socket sok)
{
mCon = new CustomConnectionClass(sok, DATA_BUFF_SIZE);
Log("New connection established.");
foreach (Control c in this.Controls)
c.Enabled = true;
mCon.Sock.BeginReceive(mCon.DataBuffer, 0, (int)DATA_BUFF_SIZE, SocketFlags.None, cbReceive, mCon.Sock);
}This is on the client (the actual trojan)
volatile bool bKillThread = false;
//Wait for the server on a seperate thread
private void WaitForServer(object _Callback)
{
delVoidIP cbFunc = (delVoidIP)_Callback;
UdpClient listener = new UdpClient(8002);
IPEndPoint groupEP = new IPEndPoint(IPAddress.Any, 8002);
byte[] bData;
do
{
//probably doesn't run past here, but I could be wrong
bData = listener.Receive(ref groupEP);
if (Encoding.ASCII.GetString(bData, 0, bData.Length) == "KyleTrojStart")
Invoke(cbFunc, groupEP.Address);
System.Threading.Thread.Sleep(1000);
} while (bKillThread == false);
}I haven't had the chance to debug the client in a windows 7 environment (as I don't have visual studio installed on a windows 7 machine). I am hoping it is a simple security issue which I can just disable on his computer. His firewall is disabled and in the advanced config I allowed UDP and TCP ports 8002,8003 incoming and outgoing. ANY help would be appreciated!