注入shellcode

最新推荐文章于 2023-12-29 14:29:33 发布

原创最新推荐文章于 2023-12-29 14:29:33 发布 · 1.3k 阅读

2 ·

CC 4.0 BY-SA版权

PE结构专栏收录该内容

4 篇文章

订阅专栏

shellcode 是能够放在任何地方都能够执行的机器码

2.编写shellcode原则

一：不能有全局变量

二：不能调用系统函数

三：不能嵌套调用函数

3.编写shellcode实战

一：shellcode分为基本模块和功能模块，结构如下图：

FS:[0]是TEB

从FS:[0X30]对应peb,偏移找到当前线程的dll模块链表，找到模块基地址,

利用pe导出表知识，自己找导出表找到函数GetProcAddress 和LoadLibrary就可以找到任何函数了

未完待续...

PEB结构

0: kd> dt _PEB
nt_400000!_PEB
   +0x000 InheritedAddressSpace : UChar
   +0x001 ReadImageFileExecOptions : UChar
   +0x002 BeingDebugged    : UChar
   +0x003 SpareBool        : UChar
   +0x004 Mutant           : Ptr32 Void
   +0x008 ImageBaseAddress : Ptr32 Void
   +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
   +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
   +0x014 SubSystemData    : Ptr32 Void
   +0x018 ProcessHeap      : Ptr32 Void
   +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
   +0x020 FastPebLockRoutine : Ptr32 Void
   +0x024 FastPebUnlockRoutine : Ptr32 Void
   +0x028 EnvironmentUpdateCount : Uint4B
   +0x02c KernelCallbackTable : Ptr32 Void
   +0x030 SystemReserved   : [1] Uint4B
   +0x034 AtlThunkSListPtr32 : Uint4B
   +0x038 FreeList         : Ptr32 _PEB_FREE_BLOCK
   +0x03c TlsExpansionCounter : Uint4B
   +0x040 TlsBitmap        : Ptr32 Void
   +0x044 TlsBitmapBits    : [2] Uint4B
   +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
   +0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
   +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
   +0x058 AnsiCodePageData : Ptr32 Void
   +0x05c OemCodePageData  : Ptr32 Void
   +0x060 UnicodeCaseTableData : Ptr32 Void
   +0x064 NumberOfProcessors : Uint4B
   +0x068 NtGlobalFlag     : Uint4B
   +0x070 CriticalSectionTimeout : _LARGE_INTEGER
   +0x078 HeapSegmentReserve : Uint4B
   +0x07c HeapSegmentCommit : Uint4B
   +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
   +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
   +0x088 NumberOfHeaps    : Uint4B
   +0x08c MaximumNumberOfHeaps : Uint4B
   +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
   +0x094 GdiSharedHandleTable : Ptr32 Void
   +0x098 ProcessStarterHelper : Ptr32 Void
   +0x09c GdiDCAttributeList : Uint4B
   +0x0a0 LoaderLock       : Ptr32 Void
   +0x0a4 OSMajorVersion   : Uint4B
   +0x0a8 OSMinorVersion   : Uint4B
   +0x0ac OSBuildNumber    : Uint2B
   +0x0ae OSCSDVersion     : Uint2B
   +0x0b0 OSPlatformId     : Uint4B
   +0x0b4 ImageSubsystem   : Uint4B
   +0x0b8 ImageSubsystemMajorVersion : Uint4B
   +0x0bc ImageSubsystemMinorVersion : Uint4B
   +0x0c0 ImageProcessAffinityMask : Uint4B
   +0x0c4 GdiHandleBuffer  : [34] Uint4B
   +0x14c PostProcessInitRoutine : Ptr32     void 
   +0x150 TlsExpansionBitmap : Ptr32 Void
   +0x154 TlsExpansionBitmapBits : [32] Uint4B
   +0x1d4 SessionId        : Uint4B
   +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
   +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
   +0x1e8 pShimData        : Ptr32 Void
   +0x1ec AppCompatInfo    : Ptr32 Void
   +0x1f0 CSDVersion       : _UNICODE_STRING
   +0x1f8 ActivationContextData : Ptr32 Void
   +0x1fc ProcessAssemblyStorageMap : Ptr32 Void
   +0x200 SystemDefaultActivationContextData : Ptr32 Void
   +0x204 SystemAssemblyStorageMap : Ptr32 Void
   +0x208 MinimumStackCommit : Uint4B

peb的0xc位置找到_PEB_LDR_DATA

PEB_LDR_DATA结构

0: kd> dt _PEB_LDR_DATA
nt_400000!_PEB_LDR_DATA
   +0x000 Length           : Uint4B
   +0x004 Initialized      : UChar
   +0x008 SsHandle         : Ptr32 Void
   +0x00c InLoadOrderModuleList : _LIST_ENTRY
   +0x014 InMemoryOrderModuleList : _LIST_ENTRY
   +0x01c InInitializationOrderModuleList : _LIST_ENTRY
   +0x024 EntryInProgress  : Ptr32 Void
TA; // +0x24

这个结构体有三个链表

+0x00c InLoadOrderModuleList : _LIST_ENTRY
+0x014 InMemoryOrderModuleList : _LIST_ENTRY
+0x01c InInitializationOrderModuleList : _LIST_ENTRY

遍历链表即可找到dll

LDR_DATA_TABLE_ENTRY 结构

typedef struct _LDR_DATA_TABLE_ENTRY  
{  
    LIST_ENTRY InLoadOrderLinks;  
    LIST_ENTRY InMemoryOrderLinks;  
    LIST_ENTRY InInitializationOrderLinks;  
    PVOID DllBase;  
    PVOID EntryPoint;  
    DWORD SizeOfImage;  
    UNICODE_STRING FullDllName;  
    UNICODE_STRING BaseDllName;  
    DWORD Flags;  
    WORD LoadCount;  
    WORD TlsIndex;  
    LIST_ENTRY HashLinks;  
    PVOID SectionPointer;  
    DWORD CheckSum;  
    DWORD TimeDateStamp;  
    PVOID LoadedImports;  
    PVOID EntryPointActivationContext;  
    PVOID PatchInformation;  
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY;

通过此结构体可根据BaseDllName获得DllBase，

接下来用到pe知识，找到pe文件导出表，查导出表找到函数。

如 loadLibray getProcess 找到后可以任意运行函数。难点在于怎么找到导入表。

获取模块的基址代码

void _getModuleBaseAddr()
{
    void *PEB = NULL,
        *Ldr = NULL,
        *Flink = NULL,
        *p = NULL,
        *BaseAddress = NULL,
        *FullDllName = NULL;

    __asm
    {
        mov eax, fs:[0x30]
        mov PEB, eax
    }
    Ldr = (PVOID)*((PDWORD)((DWORD)PEB + 0x0c));
    Flink = (PVOID)*((PDWORD)((DWORD)Ldr + 0x14));
    p = Flink;
    do
    {
        BaseAddress = (PVOID)*((PDWORD)((DWORD)p + 0x10));
        FullDllName = (PVOID)*((PDWORD)((DWORD)p + 0x20));
        wprintf(L"FullDllName is %s\n", FullDllName);
        printf("BaseAddress is %x\n", BaseAddress);
        p = (PVOID)*((PDWORD)p);
    } while (Flink != p);
}

获取kener32.dll基址

DWORD kener32Base = 0;

	__asm
	{
		xor		ecx, ecx
		mov		ecx, dword ptr fs : [30h]
		mov		ecx, dword ptr[ecx + 0Ch]
		mov		esi, dword ptr[ecx + 1Ch]
		sc_goonKernel :
					  mov		eax, dword ptr[esi + 8]
					  mov		ebx, dword ptr[esi + 20h]
					  mov		esi, dword ptr[esi]
					  cmp		dword ptr[ebx + 0Ch], 00320033h; 判断名称中字符32的unicode
					  jnz		sc_goonKernel
					  mov		ebx, eax; 获取kernel32地址
					  mov		kener32Base, ebx

	}