Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit afca3ed

Browse filesBrowse files
author
陈子轩
authored
Add files via upload
1 parent d8dbefb commit afca3ed
Copy full SHA for afca3ed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

43 files changed

+616
-0
lines changed
Open diff view settings
Collapse file

‎README.md‎

Copy file name to clipboard
+143Lines changed: 143 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
[TOC]
2+
3+
## 前言
4+
5+
现阶段，shellcode编写门槛高，大多需要有较深的汇编功底，而Metersploit上的Shellcode开源生成框架，功能单一，扩展性差，大多只能在demo中测试使用，难以在实战中发挥作用。
6+
7+
我的这个版本用纯C语言实现了Windows平台下自己的Shellcode生成器，能在实战中根据现实情况，自动生成所需功能的Shellcode。
8+
9+
## 项目预览
10+
11+
整个项目大致如下：后面会讲解每一个文件的作用
12+
13+
![1558755206913](assets/1558755206913.png)
14+
15+
## 项目配置
16+
17+
首先来说一下自己的这个项目的设置，本项目使用VS2013编译
18+
19+
1. 编译时选择 realse版本 属性->C/C++->代码生成->运行库->多线程 (/MT)
20+
2. 为了防止编译器自动生成的一系列代码造成的干扰 需要修改入口点 在属性->链接器->高级
21+
3. 属性->C/C++->代码生成->禁用安全检查GS
22+
4. 关闭生成清单 属性->链接器->清单文件->生成清单 选择否
23+
5. 关闭调试信息 属性->链接器->生成调试信息->否
24+
6. 取消SDL安全检查
25+
7. 兼容XP 选择属性->常规->平台工具集->Visual Studio 2013 - Windows XP (v120_xp)
26+
8. C/C++优化 优化->使大小最小化 (/O1) 优化大小或速度->代码大小优先 (/Os)
27+
28+
## 文件命名与作用
29+
30+
我的这个框架分为两个部分，一个是ShellCode的生成部分，还有一个是ShellCode部分
31+
32+
![1558755600047](assets/1558755600047.png)
33+
34+
之所以采用这样的文件命名的方式是为了方便计算ShellCoede的大小。文件的编译顺序就是编译后的exe函数的排列顺序。具体来说这个项目的文件编译顺序是0.entry.cpp->a.start.cpp->b.work.cpp->z.end.cpp(main.cpp是另外一个工程)，那么代码段中的函数排列顺序也会和文件的编译顺序一致 下面说一下每个文件的作用
35+
36+
- api.h->存放所有和api函数相关的结构体及函数指针
37+
- hash.h->存放需要用到的API函数的哈希定义宏
38+
- header.h->存放头文件及函数声明
39+
- 0.entry.cpp->存放ShellCode函数的入口
40+
- a.start.cpp->存放ShellCodeStart(标记一个起始位置)和真正的ShellCode代码
41+
- b.work.cpp->存放ShellCode中的起作用的代码
42+
- z.end.cpp->存放ShellCodeEnd函数(标记一个结束位置)
43+
44+
## ShellCode大小的计算方法
45+
46+
![1558756407861](assets/1558756407861.png)
47+
48+
首先我在a.start.cpp中放了一个ShellCodeStart函数，用于标记ShellCode的开始位置
49+
50+
![1558756450558](assets/1558756450558.png)
51+
52+
然后在z.end中放了一个ShellCodeEnd函数，用来标记ShellCode的结束位置，然后将真正的ShellCode放在a和z之间
53+
54+
![1558755600047](assets/1558755600047.png)
55+
56+
那么根据文件的编译顺序，只需要用ShellCodeEnd函数的位置减去ShellCodeStart函数的位置，就能得到ShellCode的大小
57+
58+
## 第一部分 ShellCode生成
59+
60+
![1558756080435](assets/1558756080435.png)
61+
62+
首先来说明ShellCode的生成部分，这个部分在0.entry.cpp中，同时将入口点修改为EntryMain，也就是说这是整个工程的main函数
63+
64+
![1558756175900](assets/1558756175900.png)
65+
66+
这个ShellCode生成函数会计算ShellCode的大小，然后将ShellCode写到一个二进制文件，可以省去在OD中提取ShellCode的步骤
67+
68+
## 第二部分 ShellCode部分
69+
70+
![1558756655105](assets/1558756655105.png)
71+
72+
真正的ShellCode代码存放在a.start中的ShellCodeEntry函数里
73+
74+
首先我定义了一个结构体Functions，这个结构体存放所有需要用到的函数指针
75+
76+
![1558756710472](assets/1558756710472.png)
77+
78+
接着通过计算哈希的方式获取到需要的函数地址并将所需要的模块加载进来
79+
80+
![1558756754010](assets/1558756754010.png)
81+
82+
接着调用MessageBox函数
83+
84+
![1558756949663](assets/1558756949663.png)
85+
86+
## ShellCode加载器
87+
88+
![1558757042473](assets/1558757042473.png)
89+
90+
另外我还写了一个ShellCodeLoader用于测试写好的ShellCode，代码相对来说比较简单
91+
92+
![1558757093179](assets/1558757093179.png)
93+
94+
![1558757113068](assets/1558757113068.png)
95+
96+
就是将ShellCode读取到内存然后执行
97+
98+
如果你所编写的ShellCode没有文件，当双击ShellCodeLoader时，就会执行生成的ShellCode.bin文件
99+
100+
![1558757156826](assets/1558757156826.png)
101+
102+
![1558757149457](assets/1558757149457.png)
103+
104+
如果执行成功，说明ShellCode没有问题
105+
106+
## 如何提取ShellCode
107+
108+
![1558758185276](assets/1558758185276.png)
109+
110+
在编写好ShellCode之后点击ShellCodeFrame.exe会生成ShellCode.bin，然后用二进制文件打开ShellCode.bin，复制所有代码即可
111+
112+
![1558758235893](assets/1558758235893.png)
113+
114+
## 如何扩展ShellCode框架？
115+
116+
我的这个框架并只写了一个示例的MessageBox函数，具体扩展的步骤如下：
117+
118+
1. 在api.h中定义所需要的函数指针，并将函数指针存放到结构体
119+
120+
![1558757399087](assets/1558757399087.png)
121+
122+
2. 在hash.h中定义需要用的到函数的哈希值
123+
124+
![1558757303102](assets/1558757303102.png)
125+
126+
3. 在b.work的Initfunctions函数中获取函数指针和加载需要的模块
127+
128+
![1558757343202](assets/1558757343202.png)
129+
130+
4. 在ShellCodeEntry中调用函数
131+
132+
![1558757439808](assets/1558757439808.png)
133+
134+
## 参考资料
135+
136+
《Windows平台高效Shellcode编程技术实战》
137+
138+
PIC_BINDSHELL(Github)：
139+
<https://github.com/mattifestation/PIC_Bindshell>
140+
141+
## 项目下载
142+
143+
<https://github.com/TonyChen56/ShellCodeFrame>
Collapse file

‎README.pdf‎

Copy file name to clipboard
810 KB
Binary file not shown.
Collapse file

‎ShellCodeFrame/Release/ShellCode.bin‎

Copy file name to clipboard
328 Bytes
Binary file not shown.
Collapse file

‎ShellCodeFrame/Release/ShellCodeFrame.exe‎

Copy file name to clipboard
2.5 KB
Binary file not shown.
Collapse file

‎ShellCodeFrame/Release/ShellCodeLoader.exe‎

Copy file name to clipboard
7 KB
Binary file not shown.
Collapse file

‎ShellCodeFrame/ShellCodeFrame.sln‎

Copy file name to clipboard
+28Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2013
4+
VisualStudioVersion = 12.0.40629.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShellCodeFrame", "ShellCodeFrame\ShellCodeFrame.vcxproj", "{16CAC46F-DFD5-44B6-A17F-25C0892912CB}"
7+
EndProject
8+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShellCodeLoader", "ShellCodeLoader\ShellCodeLoader.vcxproj", "{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}"
9+
EndProject
10+
Global
11+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
12+
Debug|Win32 = Debug|Win32
13+
Release|Win32 = Release|Win32
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Debug|Win32.ActiveCfg = Debug|Win32
17+
{16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Debug|Win32.Build.0 = Debug|Win32
18+
{16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Release|Win32.ActiveCfg = Release|Win32
19+
{16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Release|Win32.Build.0 = Release|Win32
20+
{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Debug|Win32.ActiveCfg = Debug|Win32
21+
{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Debug|Win32.Build.0 = Debug|Win32
22+
{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Release|Win32.ActiveCfg = Release|Win32
23+
{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Release|Win32.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
EndGlobal
Collapse file

‎ShellCodeFrame/ShellCodeFrame.v12.suo‎

Copy file name to clipboard
42 KB
Binary file not shown.
Collapse file

‎ShellCodeFrame/ShellCodeFrame/0.entry.cpp‎

Copy file name to clipboard
+38Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#include "header.h"
2+
#pragma comment(linker,"/entry:EntryMain")
3+
4+
//************************************************************
5+
// 函数名称: EntryMain
6+
// 函数说明: 入口函数
7+
// 作 者: GuiShou
8+
// 时 间: 2019/5/19
9+
// 参 数: void
10+
// 返 回 值: void
11+
//************************************************************
12+
void EntryMain()
13+
{
14+
CreateShellCode();
15+
}
16+
17+
18+
//************************************************************
19+
// 函数名称: CreateShellCode
20+
// 函数说明: 将ShellCode写到文件
21+
// 作 者: GuiShou
22+
// 时 间: 2019/5/19
23+
// 参 数: void
24+
// 返 回 值: void
25+
//************************************************************
26+
void CreateShellCode()
27+
{
28+
HANDLE hFile = CreateFileA("ShellCode.bin", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, 0, NULL);
29+
if (hFile==INVALID_HANDLE_VALUE)
30+
{
31+
MessageBoxA(NULL, "CreateFileA Error", "Error", MB_ERR_INVALID_CHARS);
32+
return;
33+
}
34+
DWORD dwSize = (DWORD)ShellCodeEnd - (DWORD)ShellCodeStart;
35+
DWORD dwWrite = 0;;
36+
WriteFile(hFile, ShellCodeStart, dwSize, &dwWrite,NULL);
37+
CloseHandle(hFile);
38+
}
Collapse file

‎ShellCodeFrame/ShellCodeFrame/ShellCodeFrame.vcxproj‎

Copy file name to clipboard
+102Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
</ItemGroup>
13+
<PropertyGroup Label="Globals">
14+
<ProjectGuid>{16CAC46F-DFD5-44B6-A17F-25C0892912CB}</ProjectGuid>
15+
<Keyword>Win32Proj</Keyword>
16+
<RootNamespace>ShellCodeFrame</RootNamespace>
17+
</PropertyGroup>
18+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
19+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
20+
<ConfigurationType>Application</ConfigurationType>
21+
<UseDebugLibraries>true</UseDebugLibraries>
22+
<PlatformToolset>v120_xp</PlatformToolset>
23+
<CharacterSet>Unicode</CharacterSet>
24+
</PropertyGroup>
25+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
26+
<ConfigurationType>Application</ConfigurationType>
27+
<UseDebugLibraries>false</UseDebugLibraries>
28+
<PlatformToolset>v120_xp</PlatformToolset>
29+
<WholeProgramOptimization>true</WholeProgramOptimization>
30+
<CharacterSet>Unicode</CharacterSet>
31+
</PropertyGroup>
32+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
33+
<ImportGroup Label="ExtensionSettings">
34+
</ImportGroup>
35+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
36+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
37+
</ImportGroup>
38+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
39+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
40+
</ImportGroup>
41+
<PropertyGroup Label="UserMacros" />
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
43+
<LinkIncremental>true</LinkIncremental>
44+
<GenerateManifest>false</GenerateManifest>
45+
</PropertyGroup>
46+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
47+
<LinkIncremental>false</LinkIncremental>
48+
<GenerateManifest>false</GenerateManifest>
49+
</PropertyGroup>
50+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
51+
<ClCompile>
52+
<PrecompiledHeader>
53+
</PrecompiledHeader>
54+
<WarningLevel>Level3</WarningLevel>
55+
<Optimization>Disabled</Optimization>
56+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
57+
<BufferSecurityCheck>false</BufferSecurityCheck>
58+
</ClCompile>
59+
<Link>
60+
<SubSystem>Console</SubSystem>
61+
<GenerateDebugInformation>false</GenerateDebugInformation>
62+
<EntryPointSymbol>EntryMain</EntryPointSymbol>
63+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
64+
</Link>
65+
</ItemDefinitionGroup>
66+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
67+
<ClCompile>
68+
<WarningLevel>Level3</WarningLevel>
69+
<PrecompiledHeader>
70+
</PrecompiledHeader>
71+
<Optimization>MinSpace</Optimization>
72+
<FunctionLevelLinking>true</FunctionLevelLinking>
73+
<IntrinsicFunctions>true</IntrinsicFunctions>
74+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
75+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
76+
<BufferSecurityCheck>false</BufferSecurityCheck>
77+
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
78+
</ClCompile>
79+
<Link>
80+
<SubSystem>Console</SubSystem>
81+
<GenerateDebugInformation>false</GenerateDebugInformation>
82+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
83+
<OptimizeReferences>true</OptimizeReferences>
84+
<EntryPointSymbol>
85+
</EntryPointSymbol>
86+
</Link>
87+
</ItemDefinitionGroup>
88+
<ItemGroup>
89+
<ClCompile Include="0.entry.cpp" />
90+
<ClCompile Include="a.start.cpp" />
91+
<ClCompile Include="b.work.cpp" />
92+
<ClCompile Include="z.end.cpp" />
93+
</ItemGroup>
94+
<ItemGroup>
95+
<ClInclude Include="api.h" />
96+
<ClInclude Include="hash.h" />
97+
<ClInclude Include="header.h" />
98+
</ItemGroup>
99+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
100+
<ImportGroup Label="ExtensionTargets">
101+
</ImportGroup>
102+
</Project>
Collapse file

‎ShellCodeFrame/ShellCodeFrame/ShellCodeFrame.vcxproj.filters‎

Copy file name to clipboard
+38Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="源文件">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="头文件">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
</ItemGroup>
13+
<ItemGroup>
14+
<ClCompile Include="0.entry.cpp">
15+
<Filter>源文件</Filter>
16+
</ClCompile>
17+
<ClCompile Include="a.start.cpp">
18+
<Filter>源文件</Filter>
19+
</ClCompile>
20+
<ClCompile Include="z.end.cpp">
21+
<Filter>源文件</Filter>
22+
</ClCompile>
23+
<ClCompile Include="b.work.cpp">
24+
<Filter>源文件</Filter>
25+
</ClCompile>
26+
</ItemGroup>
27+
<ItemGroup>
28+
<ClInclude Include="header.h">
29+
<Filter>头文件</Filter>
30+
</ClInclude>
31+
<ClInclude Include="api.h">
32+
<Filter>头文件</Filter>
33+
</ClInclude>
34+
<ClInclude Include="hash.h">
35+
<Filter>头文件</Filter>
36+
</ClInclude>
37+
</ItemGroup>
38+
</Project>

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.