X86,X64Shellcode框架

最新推荐文章于 2024-05-21 10:01:30 发布

Core Objects

最新推荐文章于 2024-05-21 10:01:30 发布

阅读量317

点赞数

分类专栏： windows 文章标签： windows c++ c语言系统安全

本文链接：https://blog.csdn.net/qq_40363731/article/details/129797569

版权

windows 专栏收录该内容

10 篇文章 0 订阅

订阅专栏

#include<windows.h>

#pragma code_seg("shell")
#pragma comment(linker,"/entry:shellcode")
//#pragma comment (linker,"/merge:.data=shell")
//#pragma comment (linker,"/merge:.rdata=shell")
#pragma comment(linker,"/SECTION:shell,RWE")
DWORD WINAPI GetHash(const char* szBuffer);
FARPROC WINAPI GetProcAddr(LONG_PTR hModule, DWORD dhash);
using PFUNGetProcAddress = FARPROC(WINAPI*)(HMODULE, LPCSTR);
using PFUNLoadLibraryA = HMODULE(WINAPI*)(LPCSTR);
using PFUNMessageBoxA = int(WINAPI*)(_In_opt_ HWND hWnd, _In_opt_ LPCSTR lpText, _In_opt_ LPCSTR lpCaption, _In_ UINT uType);
void shellcode() {
#ifndef _WIN64
	DWORD Kernel32Base;
	__asm {
		mov  eax, fs: [0x30]		//TEB->PEB
		mov  eax, [eax + 0x0c]		//PEB->LDR
		mov  eax, [eax + 0xc]		//LDR->.exe
		mov eax, [eax]				//exe->ntdll.dll
		mov eax, [eax]				//ntdll.dll->kernel32.dll
		mov eax, [eax + 0x18]		//kernel32->kernel32.dll.moudlehandle
		mov Kernel32Base, eax
	}
#else
	LONG_PTR Kernel32Base;
/*	_TEB* pTeb = NtCurrentTeb();*/
	PULONGLONG pPeb = (PULONGLONG)__readgsqword(0x60);
	PULONGLONG pLdr = (PULONGLONG) * (PULONGLONG)((ULONGLONG)pPeb + 0x18);
	PULONGLONG InLoadOrderModuleList = (PULONGLONG)((ULONGLONG)pLdr + 0x10);
	PULONGLONG pModuleExe = (PULONGLONG)*InLoadOrderModuleList;
	PULONGLONG pModuleNtdll = (PULONGLONG)*pModuleExe;
	PULONGLONG pModuleKernel32 = (PULONGLONG)*pModuleNtdll;
	Kernel32Base = pModuleKernel32[6];
#endif
	//	PFUNGetProcAddress pfunGetProcAddr = (PFUNGetProcAddress)GetProcAddr(asmKernel32Moudle,0xb775fbf);
	char szUser32dll[] = { 'u','s','e','r','3','2','.','d','l','l',0 };
	PFUNLoadLibraryA pfunLoadLibraryA = (PFUNLoadLibraryA)GetProcAddr(Kernel32Base, 0x641922E8);
	HMODULE hUser32 = pfunLoadLibraryA(szUser32dll);
	PFUNMessageBoxA pfunMessageBoxA = (PFUNMessageBoxA)GetProcAddr((LONG_PTR)hUser32, 0xd43c7014);
	pfunMessageBoxA(NULL, NULL, NULL, MB_OK);
	return;
}
FARPROC WINAPI GetProcAddr(LONG_PTR hModule, DWORD dhash) {
	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
	PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)(hModule + pDosHeader->e_lfanew);
	PIMAGE_EXPORT_DIRECTORY pExportDir = (PIMAGE_EXPORT_DIRECTORY)(hModule + pNtHeader->OptionalHeader.DataDirectory->VirtualAddress);
	DWORD* pFunName = (DWORD*)(hModule + pExportDir->AddressOfNames);
	DWORD* pFun = (DWORD*)(hModule + pExportDir->AddressOfFunctions);
	WORD* pOder = (WORD*)(hModule + pExportDir->AddressOfNameOrdinals);
	while (GetHash((const char*)hModule + *pFunName) != dhash) {
		pFunName++;
		pOder++;
	}
	return (FARPROC)(pFun[*pOder] + hModule);
}
inline DWORD WINAPI GetHash(const char* szBuffer) {
	DWORD dHash = *szBuffer;
	while (*szBuffer++) {
		dHash = ((dHash << 25) | dHash >> 7);
		dHash += *szBuffer;
	}
	return dHash;
}
#pragma code_seg()