[原创]ShellCode的另外一种玩法(远程线程注入ShellCode)-编程技术-看雪-安全社区|安全招聘|kanxue.com

最新回复 (5)
仙剑太郎雪币： 214 活跃值： (70) 能力值： ( LV6，RANK：90 ) 在线值：发帖 9 回帖 242 粉丝 0 关注私信	仙剑太郎 2 2 楼帅! 2006-2-9 16:34 0
凌御雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	凌御 3 楼工头牛x 在这看到你的文章了 2006-2-9 18:08 0
雪精灵雪币： 298 活跃值： (75) 能力值： ( LV5，RANK：70 ) 在线值：发帖 5 回帖 12 粉丝 1 关注私信	雪精灵 1 4 楼 ShellCode是通用版本基本上可以在所有Windows系统上跑 CreateRemoteThread 只能在NT里运行..没调用那个DLL的话.可以在注入后写个循环来LoadLibrary 2006-2-13 00:37 0
sixL 雪币： 248 活跃值： (1121) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 168 粉丝 1 关注私信	sixL 5 楼妙！妙！妙！ 2006-2-14 21:37 0
sixL 雪币： 248 活跃值： (1121) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 168 粉丝 1 关注私信	sixL 6 楼 .586 .model flat, stdcall option casemap :none ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> include \masm32\include\windows.inc include \masm32\include\kernel32.inc include \masm32\include\masm32.inc include \masm32\include\User32.inc includelib \masm32\lib\kernel32.lib includelib \masm32\lib\masm32.lib includelib \masm32\lib\User32.lib include \masm32\macros\macros.asm ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ShellSize equ 387 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .data? hInstance HINSTANCE ? CommandLine LPSTR ? hProcess HANDLE ? pThread LPVOID ? PID dword ? hWndNpd dword ? ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .code ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> szShellcode DB 0E8H,00H,00H,00H,00H,05FH,081H,0EFH,01EH,010H,040H,00H,08DH,087H,094H,010H DB 040H,00H,050H,0E8H,083H,00H,00H,00H,08DH,087H,0A5H,010H,040H,00H,050H,0E8H DB 077H,00H,00H,00H,02BH,0C0H,050H,08DH,09FH,083H,010H,040H,00H,053H,08DH,09FH DB 05EH,010H,040H,00H,053H,050H,0FFH,097H,0ACH,010H,040H,00H,06AH,00H,0FFH,097H DB 09DH,010H,040H,00H,0C3H,05BH,02AH,05DH,020H,048H,065H,06CH,06CH,06FH,020H,057H DB 06FH,072H,06CH,064H,020H,043H,06FH,064H,065H,072H,021H,020H,028H,043H,029H,020H DB 041H,06EH,073H,06BH,079H,061H,02EH,0DH,0AH,00H,04DH,073H,067H,042H,06FH,078H DB 020H,042H,079H,020H,041H,06EH,073H,06BH,079H,061H,00H,06BH,065H,072H,06EH,065H DB 06CH,033H,032H,00H,01H,092H,08FH,05H,00H,00H,00H,00H,075H,073H,065H,072H DB 033H,032H,00H,0F7H,06CH,055H,0D8H,00H,00H,00H,00H,060H,08BH,074H,024H,024H DB 0E8H,097H,00H,00H,00H,068H,0ADH,0D1H,034H,041H,050H,0E8H,01FH,00H,00H,00H DB 056H,0FFH,0D0H,08BH,0D8H,02BH,0C0H,0ACH,084H,0C0H,075H,0FBH,08BH,0FEH,0ADH,085H DB 0C0H,074H,0AH,050H,053H,0E8H,05H,00H,00H,00H,0ABH,0EBH,0F1H,061H,0C3H,060H DB 08BH,05CH,024H,024H,08BH,074H,024H,028H,02BH,0EDH,08BH,0D3H,03H,052H,03CH,08BH DB 052H,078H,03H,0D3H,08BH,042H,018H,08BH,07AH,01CH,03H,0FBH,08BH,07AH,020H,03H DB 0FBH,052H,08BH,0D7H,08BH,017H,03H,0D3H,045H,060H,08BH,0F2H,02BH,0C9H,0ACH,041H DB 084H,0C0H,075H,0FAH,089H,04CH,024H,018H,061H,060H,02BH,0C0H,0E8H,051H,00H,00H DB 00H,03BH,0C6H,061H,074H,08H,083H,0C7H,04H,048H,074H,018H,0EBH,0D6H,05AH,04DH DB 08BH,04AH,024H,03H,0CBH,0FH,0B7H,04H,069H,08BH,06AH,01CH,03H,0EBH,08BH,044H DB 085H,00H,03H,0C3H,089H,044H,024H,01CH,061H,0C2H,08H,00H,060H,02BH,0C0H,064H DB 08BH,040H,030H,085H,0C0H,078H,0CH,08BH,040H,0CH,08BH,070H,01CH,0ADH,08BH,040H DB 08H,0EBH,09H,08BH,040H,034H,08DH,040H,07CH,08BH,040H,03CH,089H,044H,024H,01CH DB 061H,0C3H,060H,0E3H,018H,0F7H,0D0H,032H,02H,042H,0B3H,08H,0D1H,0E8H,073H,05H DB 035H,020H,083H,0B8H,0EDH,0FEH,0CBH,075H,0F3H,0E2H,0ECH,0F7H,0D0H,089H,044H,024H DB 01CH,061H,0C3H ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> WinMain proc hInst:HINSTANCE, hPrevInst:HINSTANCE, CmdLine:LPSTR, CmdShow:DWORD invoke FindWindow,SADD("Notepad"),NULL mov hWndNpd,eax invoke GetWindowThreadProcessId, hWndNpd,addr PID invoke OpenProcess, PROCESS_ALL_ACCESS,FALSE,PID mov hProcess, eax invoke VirtualAllocEx,hProcess, NULL, ShellSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE mov pThread, eax invoke WriteProcessMemory, hProcess, pThread, offset szShellcode, ShellSize, NULL invoke CreateRemoteThread, hProcess, 0, 0, pThread, NULL, 0, NULL ret WinMain endp ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> start: invoke GetModuleHandle, NULL mov hInstance, eax invoke GetCommandLine invoke WinMain, hInstance, NULL, eax, SW_HIDE invoke ExitProcess, NULL ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> end start ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2006-2-14 22:55 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

仙剑太郎

雪币： 214

活跃值： (70)

能力值：

( LV6，RANK：90 )

在线值：

发帖

9

回帖

242

粉丝

0

关注

私信

仙剑太郎 2: 2 楼

帅!

2006-2-9 16:34

0

凌御

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

15

粉丝

0

关注

私信

凌御: 3 楼

工头牛x
在这看到你的文章了

2006-2-9 18:08

0

雪精灵

雪币： 298

活跃值： (75)

能力值：

( LV5，RANK：70 )

在线值：

发帖

5

回帖

12

粉丝

1

关注

私信

雪精灵 1: 4 楼

ShellCode是通用版本基本上可以在所有Windows系统上跑

CreateRemoteThread 只能在NT里运行..没调用那个DLL的话.可以在注入后写个循环来LoadLibrary

2006-2-13 00:37

0

sixL

雪币： 248

活跃值： (1121)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

168

粉丝

1

关注

私信

sixL: 5 楼

妙！妙！妙！

2006-2-14 21:37

0

sixL

雪币： 248

活跃值： (1121)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

168

粉丝

1

关注

私信

sixL: 6 楼

.586
.model flat, stdcall
option casemap :none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\masm32.inc
include \masm32\include\User32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\masm32.lib
includelib \masm32\lib\User32.lib

include \masm32\macros\macros.asm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ShellSize equ 387
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data?
hInstance HINSTANCE ?
CommandLine LPSTR ?
hProcess HANDLE ?
pThread LPVOID ?
PID dword ?
hWndNpd dword ?
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szShellcode DB 0E8H,00H,00H,00H,00H,05FH,081H,0EFH,01EH,010H,040H,00H,08DH,087H,094H,010H
      DB 040H,00H,050H,0E8H,083H,00H,00H,00H,08DH,087H,0A5H,010H,040H,00H,050H,0E8H
      DB 077H,00H,00H,00H,02BH,0C0H,050H,08DH,09FH,083H,010H,040H,00H,053H,08DH,09FH
      DB 05EH,010H,040H,00H,053H,050H,0FFH,097H,0ACH,010H,040H,00H,06AH,00H,0FFH,097H
      DB 09DH,010H,040H,00H,0C3H,05BH,02AH,05DH,020H,048H,065H,06CH,06CH,06FH,020H,057H
      DB 06FH,072H,06CH,064H,020H,043H,06FH,064H,065H,072H,021H,020H,028H,043H,029H,020H
      DB 041H,06EH,073H,06BH,079H,061H,02EH,0DH,0AH,00H,04DH,073H,067H,042H,06FH,078H
      DB 020H,042H,079H,020H,041H,06EH,073H,06BH,079H,061H,00H,06BH,065H,072H,06EH,065H
      DB 06CH,033H,032H,00H,01H,092H,08FH,05H,00H,00H,00H,00H,075H,073H,065H,072H
      DB 033H,032H,00H,0F7H,06CH,055H,0D8H,00H,00H,00H,00H,060H,08BH,074H,024H,024H
      DB 0E8H,097H,00H,00H,00H,068H,0ADH,0D1H,034H,041H,050H,0E8H,01FH,00H,00H,00H
      DB 056H,0FFH,0D0H,08BH,0D8H,02BH,0C0H,0ACH,084H,0C0H,075H,0FBH,08BH,0FEH,0ADH,085H
      DB 0C0H,074H,0AH,050H,053H,0E8H,05H,00H,00H,00H,0ABH,0EBH,0F1H,061H,0C3H,060H
      DB 08BH,05CH,024H,024H,08BH,074H,024H,028H,02BH,0EDH,08BH,0D3H,03H,052H,03CH,08BH
      DB 052H,078H,03H,0D3H,08BH,042H,018H,08BH,07AH,01CH,03H,0FBH,08BH,07AH,020H,03H
      DB 0FBH,052H,08BH,0D7H,08BH,017H,03H,0D3H,045H,060H,08BH,0F2H,02BH,0C9H,0ACH,041H
      DB 084H,0C0H,075H,0FAH,089H,04CH,024H,018H,061H,060H,02BH,0C0H,0E8H,051H,00H,00H
      DB 00H,03BH,0C6H,061H,074H,08H,083H,0C7H,04H,048H,074H,018H,0EBH,0D6H,05AH,04DH
      DB 08BH,04AH,024H,03H,0CBH,0FH,0B7H,04H,069H,08BH,06AH,01CH,03H,0EBH,08BH,044H
      DB 085H,00H,03H,0C3H,089H,044H,024H,01CH,061H,0C2H,08H,00H,060H,02BH,0C0H,064H
      DB 08BH,040H,030H,085H,0C0H,078H,0CH,08BH,040H,0CH,08BH,070H,01CH,0ADH,08BH,040H
      DB 08H,0EBH,09H,08BH,040H,034H,08DH,040H,07CH,08BH,040H,03CH,089H,044H,024H,01CH
      DB 061H,0C3H,060H,0E3H,018H,0F7H,0D0H,032H,02H,042H,0B3H,08H,0D1H,0E8H,073H,05H
      DB 035H,020H,083H,0B8H,0EDH,0FEH,0CBH,075H,0F3H,0E2H,0ECH,0F7H,0D0H,089H,044H,024H
      DB 01CH,061H,0C3H
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
WinMain proc hInst:HINSTANCE, hPrevInst:HINSTANCE, CmdLine:LPSTR, CmdShow:DWORD

invoke FindWindow,SADD("Notepad"),NULL
mov hWndNpd,eax
invoke GetWindowThreadProcessId, hWndNpd,addr PID
invoke OpenProcess, PROCESS_ALL_ACCESS,FALSE,PID
mov hProcess, eax
invoke VirtualAllocEx,hProcess, NULL, ShellSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
mov pThread, eax
invoke WriteProcessMemory, hProcess, pThread, offset szShellcode, ShellSize, NULL
invoke CreateRemoteThread, hProcess, 0, 0, pThread, NULL, 0, NULL
ret

WinMain endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke GetModuleHandle, NULL
mov hInstance, eax
invoke GetCommandLine
invoke WinMain, hInstance, NULL, eax, SW_HIDE
invoke ExitProcess, NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

end start

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

2006-2-14 22:55

0