├── README.pdf ├── ShellCodeFrame ├── ShellCodeFrame │ ├── hash.h │ ├── z.end.cpp │ ├── api.h │ ├── 0.entry.cpp │ ├── a.start.cpp │ ├── b.work.cpp │ ├── ShellCodeFrame.vcxproj.user │ ├── header.h │ ├── ShellCodeFrame.vcxproj.filters │ └── ShellCodeFrame.vcxproj ├── Release │ ├── ShellCode.bin │ ├── ShellCodeFrame.exe │ └── ShellCodeLoader.exe ├── ShellCodeFrame.v12.suo ├── ShellCodeLoader │ └── mian.cpp └── ShellCodeFrame.sln ├── assets ├── 1558755196832.png ├── 1558755206913.png ├── 1558755600047.png ├── 1558756080435.png ├── 1558756175900.png ├── 1558756407861.png ├── 1558756450558.png ├── 1558756655105.png ├── 1558756710472.png ├── 1558756751734.png ├── 1558756754010.png ├── 1558756949663.png ├── 1558757042473.png ├── 1558757093179.png ├── 1558757113068.png ├── 1558757149457.png ├── 1558757156826.png ├── 1558757281186.png ├── 1558757301207.png ├── 1558757303102.png ├── 1558757343202.png ├── 1558757399087.png ├── 1558757439808.png ├── 1558758185276.png └── 1558758235893.png └── README.md /README.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/README.pdf -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/hash.h: -------------------------------------------------------------------------------- 1 | #define HASH_LoadLibraryA 0x0726774C 2 | #define HASH_MessageBoxA 0x07568345 -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/z.end.cpp: -------------------------------------------------------------------------------- 1 | #include "header.h" 2 | 3 | void ShellCodeEnd() 4 | { 5 | 6 | } -------------------------------------------------------------------------------- /assets/1558755196832.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558755196832.png -------------------------------------------------------------------------------- /assets/1558755206913.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558755206913.png -------------------------------------------------------------------------------- /assets/1558755600047.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558755600047.png -------------------------------------------------------------------------------- /assets/1558756080435.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756080435.png -------------------------------------------------------------------------------- /assets/1558756175900.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756175900.png -------------------------------------------------------------------------------- /assets/1558756407861.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756407861.png -------------------------------------------------------------------------------- /assets/1558756450558.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756450558.png -------------------------------------------------------------------------------- /assets/1558756655105.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756655105.png -------------------------------------------------------------------------------- /assets/1558756710472.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756710472.png -------------------------------------------------------------------------------- /assets/1558756751734.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756751734.png -------------------------------------------------------------------------------- /assets/1558756754010.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756754010.png -------------------------------------------------------------------------------- /assets/1558756949663.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558756949663.png -------------------------------------------------------------------------------- /assets/1558757042473.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757042473.png -------------------------------------------------------------------------------- /assets/1558757093179.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757093179.png -------------------------------------------------------------------------------- /assets/1558757113068.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757113068.png -------------------------------------------------------------------------------- /assets/1558757149457.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757149457.png -------------------------------------------------------------------------------- /assets/1558757156826.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757156826.png -------------------------------------------------------------------------------- /assets/1558757281186.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757281186.png -------------------------------------------------------------------------------- /assets/1558757301207.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757301207.png -------------------------------------------------------------------------------- /assets/1558757303102.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757303102.png -------------------------------------------------------------------------------- /assets/1558757343202.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757343202.png -------------------------------------------------------------------------------- /assets/1558757399087.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757399087.png -------------------------------------------------------------------------------- /assets/1558757439808.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558757439808.png -------------------------------------------------------------------------------- /assets/1558758185276.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558758185276.png -------------------------------------------------------------------------------- /assets/1558758235893.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/assets/1558758235893.png -------------------------------------------------------------------------------- /ShellCodeFrame/Release/ShellCode.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/Release/ShellCode.bin -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/api.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeFrame/api.h -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame.v12.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeFrame.v12.suo -------------------------------------------------------------------------------- /ShellCodeFrame/Release/ShellCodeFrame.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/Release/ShellCodeFrame.exe -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/0.entry.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeFrame/0.entry.cpp -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/a.start.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeFrame/a.start.cpp -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/b.work.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeFrame/b.work.cpp -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeLoader/mian.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/ShellCodeLoader/mian.cpp -------------------------------------------------------------------------------- /ShellCodeFrame/Release/ShellCodeLoader.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TonyChen56/ShellCodeFrame/HEAD/ShellCodeFrame/Release/ShellCodeLoader.exe -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/ShellCodeFrame.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/header.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "api.h" 3 | #include 4 | #include 5 | 6 | 7 | void ShellCodeStart(); 8 | void ShellCodeEntry(); 9 | void ShellCodeEnd(); 10 | void CreateShellCode(); 11 | 12 | 13 | void Initfunctions(Pfunctions pfn); 14 | HMODULE GetProcAddressWithHash(DWORD dwModuleFunctionHash); -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/ShellCodeFrame.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | 14 | 15 | 源文件 16 | 17 | 18 | 源文件 19 | 20 | 21 | 源文件 22 | 23 | 24 | 源文件 25 | 26 | 27 | 28 | 29 | 头文件 30 | 31 | 32 | 头文件 33 | 34 | 35 | 头文件 36 | 37 | 38 | -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2013 4 | VisualStudioVersion = 12.0.40629.0 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShellCodeFrame", "ShellCodeFrame\ShellCodeFrame.vcxproj", "{16CAC46F-DFD5-44B6-A17F-25C0892912CB}" 7 | EndProject 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShellCodeLoader", "ShellCodeLoader\ShellCodeLoader.vcxproj", "{A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}" 9 | EndProject 10 | Global 11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 12 | Debug|Win32 = Debug|Win32 13 | Release|Win32 = Release|Win32 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Debug|Win32.Build.0 = Debug|Win32 18 | {16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Release|Win32.ActiveCfg = Release|Win32 19 | {16CAC46F-DFD5-44B6-A17F-25C0892912CB}.Release|Win32.Build.0 = Release|Win32 20 | {A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Debug|Win32.ActiveCfg = Debug|Win32 21 | {A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Debug|Win32.Build.0 = Debug|Win32 22 | {A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Release|Win32.ActiveCfg = Release|Win32 23 | {A206F0D3-86CA-41D8-8D6A-B6DF58F3139A}.Release|Win32.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | EndGlobal 29 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | [TOC] 2 | 3 | ## 前言 4 | 5 | 现阶段，shellcode编写门槛高，大多需要有较深的汇编功底，而Metersploit上的Shellcode开源生成框架，功能单一，扩展性差，大多只能在demo中测试使用，难以在实战中发挥作用。 6 | 7 | 我的这个版本用纯C语言实现了Windows平台下自己的Shellcode生成器，能在实战中根据现实情况，自动生成所需功能的Shellcode。 8 | 9 | ## 项目预览 10 | 11 | 整个项目大致如下：后面会讲解每一个文件的作用 12 | 13 | ![1558755206913](assets/1558755206913.png) 14 | 15 | ## 项目配置 16 | 17 | 首先来说一下自己的这个项目的设置，本项目使用VS2013编译 18 | 19 | 1. 编译时选择 realse版本 属性->C/C++->代码生成->运行库->多线程 (/MT) 20 | 2. 为了防止编译器自动生成的一系列代码造成的干扰 需要修改入口点 在属性->链接器->高级 21 | 3. 属性->C/C++->代码生成->禁用安全检查GS 22 | 4. 关闭生成清单 属性->链接器->清单文件->生成清单 选择否 23 | 5. 关闭调试信息 属性->链接器->生成调试信息->否 24 | 6. 取消SDL安全检查 25 | 7. 兼容XP 选择属性->常规->平台工具集->Visual Studio 2013 - Windows XP (v120_xp) 26 | 8. C/C++优化 优化->使大小最小化 (/O1) 优化大小或速度->代码大小优先 (/Os) 27 | 28 | ## 文件命名与作用 29 | 30 | 我的这个框架分为两个部分，一个是ShellCode的生成部分，还有一个是ShellCode部分 31 | 32 | ![1558755600047](assets/1558755600047.png) 33 | 34 | 之所以采用这样的文件命名的方式是为了方便计算ShellCoede的大小。文件的编译顺序就是编译后的exe函数的排列顺序。具体来说这个项目的文件编译顺序是0.entry.cpp->a.start.cpp->b.work.cpp->z.end.cpp(main.cpp是另外一个工程)，那么代码段中的函数排列顺序也会和文件的编译顺序一致 下面说一下每个文件的作用 35 | 36 | - api.h->存放所有和api函数相关的结构体及函数指针 37 | - hash.h->存放需要用到的API函数的哈希定义宏 38 | - header.h->存放头文件及函数声明 39 | - 0.entry.cpp->存放ShellCode函数的入口 40 | - a.start.cpp->存放ShellCodeStart(标记一个起始位置)和真正的ShellCode代码 41 | - b.work.cpp->存放ShellCode中的起作用的代码 42 | - z.end.cpp->存放ShellCodeEnd函数(标记一个结束位置) 43 | 44 | ## ShellCode大小的计算方法 45 | 46 | ![1558756407861](assets/1558756407861.png) 47 | 48 | 首先我在a.start.cpp中放了一个ShellCodeStart函数，用于标记ShellCode的开始位置 49 | 50 | ![1558756450558](assets/1558756450558.png) 51 | 52 | 然后在z.end中放了一个ShellCodeEnd函数，用来标记ShellCode的结束位置，然后将真正的ShellCode放在a和z之间 53 | 54 | ![1558755600047](assets/1558755600047.png) 55 | 56 | 那么根据文件的编译顺序，只需要用ShellCodeEnd函数的位置减去ShellCodeStart函数的位置，就能得到ShellCode的大小 57 | 58 | ## 第一部分 ShellCode生成 59 | 60 | ![1558756080435](assets/1558756080435.png) 61 | 62 | 首先来说明ShellCode的生成部分，这个部分在0.entry.cpp中，同时将入口点修改为EntryMain，也就是说这是整个工程的main函数 63 | 64 | ![1558756175900](assets/1558756175900.png) 65 | 66 | 这个ShellCode生成函数会计算ShellCode的大小，然后将ShellCode写到一个二进制文件，可以省去在OD中提取ShellCode的步骤 67 | 68 | ## 第二部分 ShellCode部分 69 | 70 | ![1558756655105](assets/1558756655105.png) 71 | 72 | 真正的ShellCode代码存放在a.start中的ShellCodeEntry函数里 73 | 74 | 首先我定义了一个结构体Functions，这个结构体存放所有需要用到的函数指针 75 | 76 | ![1558756710472](assets/1558756710472.png) 77 | 78 | 接着通过计算哈希的方式获取到需要的函数地址并将所需要的模块加载进来 79 | 80 | ![1558756754010](assets/1558756754010.png) 81 | 82 | 接着调用MessageBox函数 83 | 84 | ![1558756949663](assets/1558756949663.png) 85 | 86 | ## ShellCode加载器 87 | 88 | ![1558757042473](assets/1558757042473.png) 89 | 90 | 另外我还写了一个ShellCodeLoader用于测试写好的ShellCode，代码相对来说比较简单 91 | 92 | ![1558757093179](assets/1558757093179.png) 93 | 94 | ![1558757113068](assets/1558757113068.png) 95 | 96 | 就是将ShellCode读取到内存然后执行 97 | 98 | 如果你所编写的ShellCode没有文件，当双击ShellCodeLoader时，就会执行生成的ShellCode.bin文件 99 | 100 | ![1558757156826](assets/1558757156826.png) 101 | 102 | ![1558757149457](assets/1558757149457.png) 103 | 104 | 如果执行成功，说明ShellCode没有问题 105 | 106 | ## 如何提取ShellCode 107 | 108 | ![1558758185276](assets/1558758185276.png) 109 | 110 | 在编写好ShellCode之后点击ShellCodeFrame.exe会生成ShellCode.bin，然后用二进制文件打开ShellCode.bin，复制所有代码即可 111 | 112 | ![1558758235893](assets/1558758235893.png) 113 | 114 | ## 如何扩展ShellCode框架？ 115 | 116 | 我的这个框架并只写了一个示例的MessageBox函数，具体扩展的步骤如下： 117 | 118 | 1. 在api.h中定义所需要的函数指针，并将函数指针存放到结构体 119 | 120 | ![1558757399087](assets/1558757399087.png) 121 | 122 | 2. 在hash.h中定义需要用的到函数的哈希值 123 | 124 | ![1558757303102](assets/1558757303102.png) 125 | 126 | 3. 在b.work的Initfunctions函数中获取函数指针和加载需要的模块 127 | 128 | ![1558757343202](assets/1558757343202.png) 129 | 130 | 4. 在ShellCodeEntry中调用函数 131 | 132 | ![1558757439808](assets/1558757439808.png) 133 | 134 | ## 参考资料 135 | 136 | 《Windows平台高效Shellcode编程技术实战》 137 | 138 | PIC_BINDSHELL(Github)： 139 | 140 | 141 | ## 项目下载 142 | 143 | -------------------------------------------------------------------------------- /ShellCodeFrame/ShellCodeFrame/ShellCodeFrame.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | 14 | {16CAC46F-DFD5-44B6-A17F-25C0892912CB} 15 | Win32Proj 16 | ShellCodeFrame 17 | 18 | 19 | 20 | Application 21 | true 22 | v120_xp 23 | Unicode 24 | 25 | 26 | Application 27 | false 28 | v120_xp 29 | true 30 | Unicode 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | true 44 | false 45 | 46 | 47 | false 48 | false 49 | 50 | 51 | 52 | 53 | 54 | Level3 55 | Disabled 56 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 57 | false 58 | 59 | 60 | Console 61 | false 62 | EntryMain 63 | false 64 | 65 | 66 | 67 | 68 | Level3 69 | 70 | 71 | MinSpace 72 | true 73 | true 74 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 75 | MultiThreaded 76 | false 77 | Size 78 | 79 | 80 | Console 81 | false 82 | true 83 | true 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | --------------------------------------------------------------------------------