首页 > 系统相关 >Wx64ST:一款轻松可修改的C语言Shellcode模板

Wx64ST:一款轻松可修改的C语言Shellcode模板

时间:2024-09-04 13:55:38浏览次数:8  
标签:48 rdi mov C语言 Wx64ST 0x48 Shellcode ptr rax

关于windows_x64_shellcode_template

windows_x64_shellcode_template简称为Wx64ST,它是一款功能强大的Shellcode模板,该模板基于C语言编写,其简单、可扩展和易于修改等特性可以帮助广大安全研究人员轻松开发适用于Windows x64的Shellcode。

值得一提的是,该模板代码可以加载LoadLibraryA和GetProcAddress,并以C语言方式暴露HMODULE给kernel32.dll。

除此之外,模板提供的函数中包含了很多注释内容,以供广大研究人员参考。

工具要求

VS 2015 / VS 2017

工具安装

广大研究人员可以直接使用下列命令将该项目源码克隆至本地:

git clone https://github.com/rainerzufalldererste/windows_x64_shellcode_template.git

cd windows_x64_shellcode_template

git submodule update --init --recursive

create_project.bat

该shellcode_template项目包括开始开发自定义Shellcode的所有内容。

如何检索 Shellcode

有很多方法可以检索生成的 shellcode。最简单的方法可能是直接进入Visual Studio调试器并切换到void shellcode_template(),然后打开反汇编视图 (Ctrl+Alt+D)。请确保打开显示代码字节并关闭显示源代码和地址以简化输出:

48 89 5C 24 08       mov         qword ptr [rsp+8],rbx  

57                   push        rdi  

48 83 EC 30          sub         rsp,30h  

65 48 8B 04 25 60 00 00 00 mov         rax,qword ptr gs:[0000000000000060h]  

33 D2                xor         edx,edx  

49 B8 47 65 74 50 72 6F 63 41 mov         r8,41636F7250746547h  

48 8B 48 18          mov         rcx,qword ptr [rax+18h]  

48 8B 41 20          mov         rax,qword ptr [rcx+20h]  

48 8B 08             mov         rcx,qword ptr [rax]  

48 8B 01             mov         rax,qword ptr [rcx]  

48 8B 78 20          mov         rdi,qword ptr [rax+20h]  

48 63 47 3C          movsxd      rax,dword ptr [rdi+3Ch]  

44 8B 8C 38 88 00 00 00 mov         r9d,dword ptr [rax+rdi+0000000000000088h]  

41 8B 44 39 20       mov         eax,dword ptr [r9+rdi+20h]  

48 03 C7             add         rax,rdi  

48 63 08             movsxd      rcx,dword ptr [rax]  

4C 39 04 39          cmp         qword ptr [rcx+rdi],r8  

 ...

现在您只需移除标签和反汇编代码即可,剩下的就是Shellcode:

48 89 5C 24 08       mov         qword ptr [rsp+8],rbx  

57                   push        rdi  

48 83 EC 30          sub         rsp,30h  

65 48 8B 04 25 60 00 00 00 mov         rax,qword ptr gs:[0000000000000060h]  

33 D2                xor         edx,edx  

49 B8 47 65 74 50 72 6F 63 41 mov         r8,41636F7250746547h  

48 8B 48 18          mov         rcx,qword ptr [rax+18h]  

48 8B 41 20          mov         rax,qword ptr [rcx+20h]  

48 8B 08             mov         rcx,qword ptr [rax]  

48 8B 01             mov         rax,qword ptr [rcx]  

48 8B 78 20          mov         rdi,qword ptr [rax+20h]  

48 63 47 3C          movsxd      rax,dword ptr [rdi+3Ch]  

44 8B 8C 38 88 00 00 00 mov         r9d,dword ptr [rax+rdi+0000000000000088h]  

41 8B 44 39 20       mov         eax,dword ptr [r9+rdi+20h]  

48 03 C7             add         rax,rdi  

48 63 08             movsxd      rcx,dword ptr [rax]  

4C 39 04 39          cmp         qword ptr [rcx+rdi],r8  

 ...
现在您只需移除标签和反汇编代码即可,剩下的就是Shellcode:

48 89 5C 24 08

57

48 83 EC 30

65 48 8B 04 25 60 00 00 00

33 D2

49 B8 47 65 74 50 72 6F 63 41

48 8B 48 18

48 8B 41 20

48 8B 08

48 8B 01

48 8B 78 20

48 63 47 3C

44 8B 8C 38 88 00 00 00

41 8B 44 39 20

48 03 C7

48 63 08

4C 39 04 39

 ...

或者,您可以将代码粘贴到像 godbolt.org 这样的在线编译器中,然后将生成的 MSVC 程序集(不调用任何内部函数,例如缓冲区安全检查或 memcpy)(即使用x64 msvc v19.latest)复制到像 https://defuse.ca/online-x86-assembler.htm/O2 /GS-这样的在线汇编程序中。然后只需复制生成的Shellcode即可。

当使用在线编译器时,你可能需要稍微清理一下汇编代码,如下所示:

x$ = 32

void shellcode_template(void) PROC               ; shellcode_template, COMDAT

$LN10:

        mov     QWORD PTR [rsp+8], rbx

        push    rdi

        sub     rsp, 48                             ; 00000030H

        mov     rax, QWORD PTR gs:96

        xor     edx, edx

        mov     r8, 4711732171926431047             ; 41636f7250746547H

        mov     rcx, QWORD PTR [rax+24]

        mov     rax, QWORD PTR [rcx+32]

        mov     rcx, QWORD PTR [rax]

        mov     rax, QWORD PTR [rcx]

        mov     rdi, QWORD PTR [rax+32]

        movsxd  rax, DWORD PTR [rdi+60]

        mov     r9d, DWORD PTR [rax+rdi+136]

        mov     eax, DWORD PTR [r9+rdi+32]

        add     rax, rdi

        movsxd  rcx, DWORD PTR [rax]

        cmp     QWORD PTR [rcx+rdi], r8

        je      SHORT $LN3@shellcode_

        npad    2

$LL2@shellcode_:

        movsxd  rcx, DWORD PTR [rax+4]

        lea     rax, QWORD PTR [rax+4]

        inc     edx

        cmp     QWORD PTR [rcx+rdi], r8

        jne     SHORT $LL2@shellcode_

$LN3@shellcode_:

        mov     ecx, DWORD PTR [r9+rdi+36]

        mov     rax, 8242266044863967052      ; 7262694c64616f4cH

        ...

可以通过一些查找和替换将代码变成这样:

shellcode_template:

        mov     qword ptr [rsp+8], rbx

        push    rdi

        sub     rsp, 48

        mov     rax, qword ptr gs:96

        xor     edx, edx

        mov     r8, 4711732171926431047

        mov     rcx, qword ptr [rax+24]

        mov     rax, qword ptr [rcx+32]

        mov     rcx, qword ptr [rax]

        mov     rax, qword ptr [rcx]

        mov     rdi, qword ptr [rax+32]

        movsxd  rax, DWORD ptr [rdi+60]

        mov     r9d, DWORD ptr [rax+rdi+136]

        mov     eax, DWORD ptr [r9+rdi+32]

        add     rax, rdi

        movsxd  rcx, DWORD ptr [rax]

        cmp     qword ptr [rcx+rdi], r8

        je      SHORT _function_found

        

        ; `npad    2` can be turned into two `nop`s.

 

        nop

        nop

 

 

_find_next_function:

        movsxd  rcx, DWORD ptr [rax+4]

        lea     rax, qword ptr [rax+4]

        inc     edx

        cmp     qword ptr [rcx+rdi], r8

        jne     SHORT _find_next_function

 

 

_function_found:

        mov     ecx, DWORD ptr [r9+rdi+36]

        mov     rax, 8242266044863967052

        ...

生成的 Shellcode

下面给出的是该项目提供的Shellcode样例,它将执行下列操作:

1、在kernel32.dll中查找GetProcAddress;

2、从kernel32.dll检索LoadLibraryA;

3、加载useR32.dll;

4、从useR32.dll检索MessageBoxA;

5、显示一个消息提示框;

6、从kernel32.dll检索ExitProcess;

7、调用ExitProcess;

0x48, 0x89, 0x5C, 0x24, 0x08, 0x57, 0x48, 0x83, 0xEC, 0x30, 0x65, 0x48, 0x8B, 0x04, 0x25, 0x60,

  0x00, 0x00, 0x00, 0x33, 0xD2, 0x49, 0xB8, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6F, 0x63, 0x41, 0x48,

  0x8B, 0x48, 0x18, 0x48, 0x8B, 0x41, 0x20, 0x48, 0x8B, 0x08, 0x48, 0x8B, 0x01, 0x48, 0x8B, 0x78,

  0x20, 0x48, 0x63, 0x47, 0x3C, 0x44, 0x8B, 0x8C, 0x38, 0x88, 0x00, 0x00, 0x00, 0x41, 0x8B, 0x44,

  0x39, 0x20, 0x48, 0x03, 0xC7, 0x48, 0x63, 0x08, 0x4C, 0x39, 0x04, 0x39, 0x74, 0x12, 0x66, 0x90,

  0x48, 0x63, 0x48, 0x04, 0x48, 0x8D, 0x40, 0x04, 0xFF, 0xC2, 0x4C, 0x39, 0x04, 0x39, 0x75, 0xF0,

  0x41, 0x8B, 0x4C, 0x39, 0x24, 0x48, 0xB8, 0x4C, 0x6F, 0x61, 0x64, 0x4C, 0x69, 0x62, 0x72, 0x48,

  0x03, 0xCF, 0x48, 0x63, 0xD2, 0x4C, 0x0F, 0xBF, 0x04, 0x51, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x41,

  0x8B, 0x4C, 0x39, 0x1C, 0x48, 0x03, 0xCF, 0x4A, 0x63, 0x1C, 0x81, 0x48, 0x8B, 0xCF, 0x48, 0x03,

  0xDF, 0x48, 0x89, 0x44, 0x24, 0x20, 0x48, 0xC7, 0x44, 0x24, 0x28, 0x61, 0x72, 0x79, 0x41, 0xFF,

  0xD3, 0x48, 0xB9, 0x75, 0x73, 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x48, 0xC7, 0x44, 0x24, 0x28,

  0x6C, 0x6C, 0x00, 0x00, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x4C, 0x24, 0x20, 0xFF, 0xD0,

  0x48, 0xB9, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x48, 0xC7, 0x44, 0x24, 0x28, 0x6F,

  0x78, 0x41, 0x00, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0x8B, 0xC8,

  0xFF, 0xD3, 0x48, 0xB9, 0x48, 0x61, 0x73, 0x74, 0x61, 0x20, 0x6C, 0x61, 0x4C, 0x8D, 0x44, 0x24,

  0x2F, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0xB9, 0x20, 0x76, 0x69,

  0x73, 0x74, 0x61, 0x21, 0x00, 0x45, 0x33, 0xC9, 0x48, 0x89, 0x4C, 0x24, 0x28, 0x33, 0xC9, 0xFF,

  0xD0, 0x48, 0xB8, 0x45, 0x78, 0x69, 0x74, 0x50, 0x72, 0x6F, 0x63, 0x48, 0xC7, 0x44, 0x24, 0x28,

  0x65, 0x73, 0x73, 0x00, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0x89, 0x44, 0x24, 0x20, 0x48, 0x8B,

  0xCF, 0xFF, 0xD3, 0xB9, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xD0, 0x48, 0x8B, 0x5C, 0x24, 0x40, 0x48,

  0x83, 0xC4, 0x30, 0x5F, 0xC3

工具使用演示

下面给出的是一个示例应用程序,演示了如何使用Wx64ST在子进程内执行生成的Shellcode:

// Load Process Environment Block.

  PEB *pProcessEnvironmentBlock = (PEB *)__readgsqword(0x60);

 

  // `pProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList` contains a double linked list.

  // `Flink` and `Blink` are pointers to the next and previous element.

  //

  // All Windows executables should have the following module order.

  //  1. The module of the current executable.

  //  2. `ntdll.dll` (`%windir%\System32\ntdll.dll`)

  //  3. `kernel32.dll` (`%windir%\System32\kernel32.dll`)

  //

  //  ... followed by other modules.

  //

  // In order to get the `GetProcAddress` function we need to therefore get the third item (`Flink->Flink->Flink`).

  // We use the `CONTAINING_RECORD` macro to retrieve the associated table entry.

  LDR_DATA_TABLE_ENTRY *pKernel32TableEntry = CONTAINING_RECORD(pProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList.Flink->Flink->Flink, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);

 

  // We've ended up at the base address of `kernel32.dll`.

  IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER *)pKernel32TableEntry->DllBase;

 

  // In order to get the exported functions we need to go to the NT PE header.

  IMAGE_NT_HEADERS *pNtHeader = (IMAGE_NT_HEADERS *)((size_t)pDosHeader + pDosHeader->e_lfanew);

 

  // From the NtHeader we can extract the virtual address of the export directory of this module.

  IMAGE_EXPORT_DIRECTORY *pExports = (IMAGE_EXPORT_DIRECTORY *)((size_t)pDosHeader + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

 

  // The exports directory contains both a list of function _names_ of this module and the associated _addresses_ of the functions.

  const int32_t *pNameOffsets = (const int32_t *)((size_t)pDosHeader + pExports->AddressOfNames);

  

  // We will use this struct to store strings.

  // We are using a struct to make sure strings don't end up in another section of the executable where we wouldn't be able to address them in a different process.

  struct

  {

    uint64_t text0, text1;

  } x;

 

  // We're now looking for the `GetProcAddress` function. Since there's no other function starting with `GetProcA` we'll just find that instead.

  x.text0 = 0x41636F7250746547; // `GetProcA`

 

  int32_t i = 0;

 

  // We're just extracting the first 8 bytes of the strings and compare them to `GetProcA`. We'll find it eventually.

  while (*(uint64_t *)((size_t)pDosHeader + pNameOffsets[i]) != x.text0)

    ++i;

 

  // We have found the index of `GetProcAddress`.

 

  // The entry at an index in `AddressOfNames` corresponds to an entry at the same index in `AddressOfNameOrdinals`, which resolves the index of a given name to it's corresponding entry in `AddressOfFunctions`. (DLLs can export unnamed functions, which will not be listed in `AddressOfNames`.)

  // Let's get the function name ordinal offsets and function offsets in order to retrieve the location of `GetProcAddress` in memory.

  const int16_t *pFunctionNameOrdinalOffsets = (const int16_t *)((size_t)pDosHeader + pExports->AddressOfNameOrdinals);

  const int32_t *pFunctionOffsets = (const int32_t *)((size_t)pDosHeader + pExports->AddressOfFunctions);

 

  // Now resolve the index in `pFunctionOffsets` from `pFunctionNameOrdinalOffsets` to get the address of the desired function in memory.

  typedef FARPROC(*GetProcAddressFunc)(HMODULE, const char *);

  GetProcAddressFunc pGetProcAddress = (GetProcAddressFunc)(const void *)((size_t)pDosHeader + pFunctionOffsets[pFunctionNameOrdinalOffsets[i]]);

 

  // Now that we've got `GetProcAddress`, let's use it to get `LoadLibraryA`.

 

  // A HMODULE is just a pointer to the base address of a module.

  HMODULE kernel32Dll = (HMODULE)pDosHeader;

 

  // Get `LoadLibraryA`.

  x.text0 = 0x7262694C64616F4C; // `LoadLibr`

  x.text1 = 0x0000000041797261; // `aryA\0\0\0\0`

 

  typedef HMODULE(*LoadLibraryAFunc)(const char *);

  LoadLibraryAFunc pLoadLibraryA = (LoadLibraryAFunc)pGetProcAddress(kernel32Dll, (const char *)&x.text0);

项目地址

windows_x64_shellcode_template:【GitHub传送门

参考资料

Compiler Explorer

Online x86 and x64 Intel Instruction Assembler

标签:48,rdi,mov,C语言,Wx64ST,0x48,Shellcode,ptr,rax
From: https://blog.csdn.net/FreeBuf_/article/details/141818393

相关文章

  • 神奇的C语言输出12天圣诞节歌词代码
    12天圣诞节程序怎样运行?1988年,一个令人印象深刻且令人敬畏的C代码,代号为xmas.c,在国际混淆C代码竞赛中获胜。该程序甚至比其输出的“压缩”类型还要小,代表了文本压缩标准的全新方式。评委们认为,这个程序像是随意敲击键盘所得到的。但该程序神奇地打印出12天圣诞节的歌词,仅仅......
  • c语言中条件运算符 + 语句
     001、[root@localhosttest]#lstest.c[root@localhosttest]#cattest.c#include<stdio.h>intmain(void){intn1,n2;puts("pleaseinputtwointegers.");printf("n1=");scanf("%d",&......
  • c语言中的几种运算符
     001、相等运算符==!= 002、关系运算符>>=<<= 003、条件运算符a?b:c[root@localhosttest]#lstest.c[root@localhosttest]#cattest.c#include<stdio.h>intmain(void){intn1,n2;puts("pleaseinputtwointegers.")......
  • C语言零基础入门教程——02 C语言开发环境的配置(Dev C++超详细安装教程)
    文章目录前言DevC++安装一、软件介绍二、软件下载三、软件安装结语前言编写代码一般需要在特定的工具即集成开发环境(IDE)上进行,它可以帮助程序员更高效地编写一些程序,因此在编写程序之前,我们需要安装相应的开发工具从而配置开发环境,考虑到高校教学都广泛使用DevC+......
  • C语言典型例题60
    《C程序设计教程(第四版)——谭浩强》习题4.1统计全单位人员的平均工资。单位的人数是不固定的,工资数从键盘先后输入,当输入-1时,表示输入结束(前面输入的都是有效数字)。代码://《C程序设计教程(第四版)——谭浩强》//习题4.1统计全单位人员的平均工资。单位的人数是不固定......
  • C语言 09 流程控制
    if如果需要判断某个条件,当满足此条件时,才执行某些代码,那这个时候该怎么办呢?可以使用if语句来实现:#include<stdio.h>intmain(){inti=0;//只希望i大于10的时候才执行下面的打印语句if(i>10){printf("该数字大于10");}//后面的代......
  • 《重生到现代之从零开始的C语言生活》—— 指针7
    sizeof和strlen的对比sizeofsizeof是一个操作符,计算的是所占据内存的大小,单位是字节sizeof操作符只关注内存的大小,不关心内存中存放的是什么数据strlenstrlen是C语言的库函数,头文件是string.h功能是求当中字符串字符中的个数strlen函数会一直找\0,当函数找\0字符时,就......
  • C语言初阶6 -指针
    指针是什么在计算机科学中,指针(Pointer)是编程语言中的一个对象,利用地址,它的值直接指向pointsto)存在电脑存储器中另一个地方的值。由于通过地址能找到所需的变量单元,可以说,地址指向该变量单元。因此,将地址形象化的称为“指针”。意思是通过它能找到以它为地址的内存单元.那我们可......
  • 【树莓派C语言开发】实验01:双色LED
    文章目录前言1.实验器材2.实验原理3.控制代码3.1显示器的PWM调光和DC调光3.2编译代码3.2.1直接使用Geany编译器内部选项3.2.2使用linux语言4.如何在使用面包板的同时使用散热小风扇结语前言今晚上没啥事(其实作业没写完),就开始折腾树莓派了我当初买的是树莓派4B(4GB)版本的套件,东......
  • 学习C语言之分支和循环(下)。都是练习,桀桀桀。
    <一>、闰年的判断 <二>、找出100~200内的素数 <三>、猜数字第一种:  第二种:  第三种:限定次数  ......