原创 Alpha_h4ck FreeBuf
关于windows_x64_shellcode_template
windows_x64_shellcode_template简称为Wx64ST，它是一款功能强大的Shellcode模板，该模板基于C语言编写，其简单、可扩展和易于修改等特性可以帮助广大安全研究人员轻松开发适用于Windows x64的Shellcode。
值得一提的是，该模板代码可以加载LoadLibraryA和GetProcAddress，并以C语言方式暴露HMODULE给kernel32.dll。
除此之外，模板提供的函数中包含了很多注释内容，以供广大研究人员参考。
工具要求
VS 2015 / VS 2017
工具安装
广大研究人员可以直接使用下列命令将该项目源码克隆至本地：
git clone https://github.com/rainerzufalldererste/windows_x64_shellcode_template.git
cd windows_x64_shellcode_template
git submodule update --init --recursive
create_project.bat
该shellcode_template项目包括开始开发自定义Shellcode的所有内容。
如何检索Shellcode
有很多方法可以检索生成的 shellcode。最简单的方法可能是直接进入Visual Studio 调试器并切换到void shellcode_template()，然后打开反汇编视图 (Ctrl+Alt+D)。请确保打开显示代码字节并关闭显示源代码和地址以简化输出：
48 89 5C 24 08 mov qword ptr [rsp+8],rbx
57 push rdi
48 83 EC 30 sub rsp,30h
65 48 8B 04 25 60 00 00 00 mov rax,qword ptr gs:[0000000000000060h]
33 D2 xor edx,edx
49 B8 47 65 74 50 72 6F 63 41 mov r8,41636F7250746547h
48 8B 48 18 mov rcx,qword ptr [rax+18h]
48 8B 41 20 mov rax,qword ptr [rcx+20h]
48 8B 08 mov rcx,qword ptr [rax]
48 8B 01 mov rax,qword ptr [rcx]
48 8B 78 20 mov rdi,qword ptr [rax+20h]
48 63 47 3C movsxd rax,dword ptr [rdi+3Ch]
44 8B 8C 38 88 00 00 00 mov r9d,dword ptr [rax+rdi+0000000000000088h]
41 8B 44 39 20 mov eax,dword ptr [r9+rdi+20h]
48 03 C7 add rax,rdi
48 63 08 movsxd rcx,dword ptr [rax]
4C 39 04 39 cmp qword ptr [rcx+rdi],r8
...
现在只需移除标签和反汇编代码即可，剩下的就是Shellcode：
48 89 5C 24 08
57
48 83 EC 30
65 48 8B 04 25 60 00 00 00
33 D2
49 B8 47 65 74 50 72 6F 63 41
48 8B 48 18
48 8B 41 20
48 8B 08
48 8B 01
48 8B 78 20
48 63 47 3C
44 8B 8C 38 88 00 00 00
41 8B 44 39 20
48 03 C7
48 63 08
4C 39 04 39
...
或者，您可以将代码粘贴到像(godbolt.org)这样的在线编译器中，然后将生成的 MSVC 程序集（不调用任何内部函数，例如缓冲区安全检查或 memcpy）（即使用x64 msvc v19.latest）复制到像(https://defuse.ca/online-x86-assembler.htm/O2 /GS-)这样的在线汇编程序中。然后只需复制生成的Shellcode即可。
当使用在线编译器时，你可能需要稍微清理一下汇编代码，如下所示：
x$ = 32
void shellcode_template(void) PROC ; shellcode_template, COMDAT
$LN10:
mov QWORD PTR [rsp+8], rbx
push rdi
sub rsp, 48 ; 00000030H
mov rax, QWORD PTR gs:96
xor edx, edx
mov r8, 4711732171926431047 ; 41636f7250746547H
mov rcx, QWORD PTR [rax+24]
mov rax, QWORD PTR [rcx+32]
mov rcx, QWORD PTR [rax]
mov rax, QWORD PTR [rcx]
mov rdi, QWORD PTR [rax+32]
movsxd rax, DWORD PTR [rdi+60]
mov r9d, DWORD PTR [rax+rdi+136]
mov eax, DWORD PTR [r9+rdi+32]
add rax, rdi
movsxd rcx, DWORD PTR [rax]
cmp QWORD PTR [rcx+rdi], r8
je SHORT $LN3@shellcode_
npad 2
$LL2@shellcode_:
movsxd rcx, DWORD PTR [rax+4]
lea rax, QWORD PTR [rax+4]
inc edx
cmp QWORD PTR [rcx+rdi], r8
jne SHORT $LL2@shellcode_
$LN3@shellcode_:
mov ecx, DWORD PTR [r9+rdi+36]
mov rax, 8242266044863967052 ; 7262694c64616f4cH
...
可以通过一些查找和替换将代码变成这样：
shellcode_template:
mov qword ptr [rsp+8], rbx
push rdi
sub rsp, 48
mov rax, qword ptr gs:96
xor edx, edx
mov r8, 4711732171926431047
mov rcx, qword ptr [rax+24]
mov rax, qword ptr [rcx+32]
mov rcx, qword ptr [rax]
mov rax, qword ptr [rcx]
mov rdi, qword ptr [rax+32]
movsxd rax, DWORD ptr [rdi+60]
mov r9d, DWORD ptr [rax+rdi+136]
mov eax, DWORD ptr [r9+rdi+32]
add rax, rdi
movsxd rcx, DWORD ptr [rax]
cmp qword ptr [rcx+rdi], r8
je SHORT _function_found
; `npad 2` can be turned into two `nop`s.
nop
nop
_find_next_function:
movsxd rcx, DWORD ptr [rax+4]
lea rax, qword ptr [rax+4]
inc edx
cmp qword ptr [rcx+rdi], r8
jne SHORT _find_next_function
_function_found:
mov ecx, DWORD ptr [r9+rdi+36]
mov rax, 8242266044863967052
...
生成的Shellcode
下面给出的是该项目提供的Shellcode样例，它将执行下列操作：
1、在kernel32.dll中查找GetProcAddress；
2、从kernel32.dll检索LoadLibraryA；
3、加载useR32.dll；
4、从useR32.dll检索MessageBoxA；
5、显示一个消息提示框；
6、从kernel32.dll检索ExitProcess；
7、调用ExitProcess；
0x48, 0x89, 0x5C, 0x24, 0x08, 0x57, 0x48, 0x83, 0xEC, 0x30, 0x65, 0x48, 0x8B, 0x04, 0x25, 0x60,
0x00, 0x00, 0x00, 0x33, 0xD2, 0x49, 0xB8, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6F, 0x63, 0x41, 0x48,
0x8B, 0x48, 0x18, 0x48, 0x8B, 0x41, 0x20, 0x48, 0x8B, 0x08, 0x48, 0x8B, 0x01, 0x48, 0x8B, 0x78,
0x20, 0x48, 0x63, 0x47, 0x3C, 0x44, 0x8B, 0x8C, 0x38, 0x88, 0x00, 0x00, 0x00, 0x41, 0x8B, 0x44,
0x39, 0x20, 0x48, 0x03, 0xC7, 0x48, 0x63, 0x08, 0x4C, 0x39, 0x04, 0x39, 0x74, 0x12, 0x66, 0x90,
0x48, 0x63, 0x48, 0x04, 0x48, 0x8D, 0x40, 0x04, 0xFF, 0xC2, 0x4C, 0x39, 0x04, 0x39, 0x75, 0xF0,
0x41, 0x8B, 0x4C, 0x39, 0x24, 0x48, 0xB8, 0x4C, 0x6F, 0x61, 0x64, 0x4C, 0x69, 0x62, 0x72, 0x48,
0x03, 0xCF, 0x48, 0x63, 0xD2, 0x4C, 0x0F, 0xBF, 0x04, 0x51, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x41,
0x8B, 0x4C, 0x39, 0x1C, 0x48, 0x03, 0xCF, 0x4A, 0x63, 0x1C, 0x81, 0x48, 0x8B, 0xCF, 0x48, 0x03,
0xDF, 0x48, 0x89, 0x44, 0x24, 0x20, 0x48, 0xC7, 0x44, 0x24, 0x28, 0x61, 0x72, 0x79, 0x41, 0xFF,
0xD3, 0x48, 0xB9, 0x75, 0x73, 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x48, 0xC7, 0x44, 0x24, 0x28,
0x6C, 0x6C, 0x00, 0x00, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x4C, 0x24, 0x20, 0xFF, 0xD0,
0x48, 0xB9, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x48, 0xC7, 0x44, 0x24, 0x28, 0x6F,
0x78, 0x41, 0x00, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0x8B, 0xC8,
0xFF, 0xD3, 0x48, 0xB9, 0x48, 0x61, 0x73, 0x74, 0x61, 0x20, 0x6C, 0x61, 0x4C, 0x8D, 0x44, 0x24,
0x2F, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0xB9, 0x20, 0x76, 0x69,
0x73, 0x74, 0x61, 0x21, 0x00, 0x45, 0x33, 0xC9, 0x48, 0x89, 0x4C, 0x24, 0x28, 0x33, 0xC9, 0xFF,
0xD0, 0x48, 0xB8, 0x45, 0x78, 0x69, 0x74, 0x50, 0x72, 0x6F, 0x63, 0x48, 0xC7, 0x44, 0x24, 0x28,
0x65, 0x73, 0x73, 0x00, 0x48, 0x8D, 0x54, 0x24, 0x20, 0x48, 0x89, 0x44, 0x24, 0x20, 0x48, 0x8B,
0xCF, 0xFF, 0xD3, 0xB9, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xD0, 0x48, 0x8B, 0x5C, 0x24, 0x40, 0x48,
0x83, 0xC4, 0x30, 0x5F, 0xC3
工具使用演示
下面给出的是一个示例应用程序，演示了如何使用Wx64ST在子进程内执行生成的Shellcode：
// Load Process Environment Block.
PEB *pProcessEnvironmentBlock = (PEB *)__readgsqword(0x60);
// `pProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList` contains a double linked list.
// `Flink` and `Blink` are pointers to the next and previous element.
//
// All Windows executables should have the following module order.
// 1. The module of the current executable.
// 2. `ntdll.dll` (`%windir%\System32\ntdll.dll`)
// 3. `kernel32.dll` (`%windir%\System32\kernel32.dll`)
//
// ... followed by other modules.
//
// In order to get the `GetProcAddress` function we need to therefore get the third item (`Flink->Flink->Flink`).
// We use the `CONTAINING_RECORD` macro to retrieve the associated table entry.
LDR_DATA_TABLE_ENTRY *pKernel32TableEntry = CONTAINING_RECORD(pProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList.Flink->Flink->Flink, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
// We've ended up at the base address of `kernel32.dll`.
IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER *)pKernel32TableEntry->DllBase;
// In order to get the exported functions we need to go to the NT PE header.
IMAGE_NT_HEADERS *pNtHeader = (IMAGE_NT_HEADERS *)((size_t)pDosHeader + pDosHeader->e_lfanew);
// From the NtHeader we can extract the virtual address of the export directory of this module.
IMAGE_EXPORT_DIRECTORY *pExports = (IMAGE_EXPORT_DIRECTORY *)((size_t)pDosHeader + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
// The exports directory contains both a list of function _names_ of this module and the associated _addresses_ of the functions.
const int32_t *pNameOffsets = (const int32_t *)((size_t)pDosHeader + pExports->AddressOfNames);
// We will use this struct to store strings.
// We are using a struct to make sure strings don't end up in another section of the executable where we wouldn't be able to address them in a different process.
struct
{
uint64_t text0, text1;
} x;
// We're now looking for the `GetProcAddress` function. Since there's no other function starting with `GetProcA` we'll just find that instead.
x.text0 = 0x41636F7250746547; // `GetProcA`
int32_t i = 0;
// We're just extracting the first 8 bytes of the strings and compare them to `GetProcA`. We'll find it eventually.
while (*(uint64_t *)((size_t)pDosHeader + pNameOffsets[i]) != x.text0)
++i;
// We have found the index of `GetProcAddress`.
// The entry at an index in `AddressOfNames` corresponds to an entry at the same index in `AddressOfNameOrdinals`, which resolves the index of a given name to it's corresponding entry in `AddressOfFunctions`. (DLLs can export unnamed functions, which will not be listed in `AddressOfNames`.)
// Let's get the function name ordinal offsets and function offsets in order to retrieve the location of `GetProcAddress` in memory.
const int16_t *pFunctionNameOrdinalOffsets = (const int16_t *)((size_t)pDosHeader + pExports->AddressOfNameOrdinals);
const int32_t *pFunctionOffsets = (const int32_t *)((size_t)pDosHeader + pExports->AddressOfFunctions);
// Now resolve the index in `pFunctionOffsets` from `pFunctionNameOrdinalOffsets` to get the address of the desired function in memory.
typedef FARPROC(*GetProcAddressFunc)(HMODULE, const char *);
GetProcAddressFunc pGetProcAddress = (GetProcAddressFunc)(const void *)((size_t)pDosHeader + pFunctionOffsets[pFunctionNameOrdinalOffsets[i]]);
// Now that we've got `GetProcAddress`, let's use it to get `LoadLibraryA`.
// A HMODULE is just a pointer to the base address of a module.
HMODULE kernel32Dll = (HMODULE)pDosHeader;
// Get `LoadLibraryA`.
x.text0 = 0x7262694C64616F4C; // `LoadLibr`
x.text1 = 0x0000000041797261; // `aryA\0\0\0\0`
typedef HMODULE(*LoadLibraryAFunc)(const char *);
LoadLibraryAFunc pLoadLibraryA = (LoadLibraryAFunc)pGetProcAddress(kernel32Dll, (const char *)&x.text0);
项目地址
windows_x64_shellcode_template：
https://github.com/rainerzufalldererste/windows_x64_shellcode_template