1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
| #include <Windows.h>
#include <stdio.h>
int main(int argc, char* argv[])
{
HANDLE hFileShellcode = INVALID_HANDLE_VALUE;
HANDLE hFileOutput = INVALID_HANDLE_VALUE;
DWORD dwRead, dwWritten;
LARGE_INTEGER liFileSize;
PVOID pShellcode = NULL;
IMAGE_DOS_HEADER imageDosHeader = { 0 };
IMAGE_NT_HEADERS64 imageNtHeaders64 = { 0 };
IMAGE_SECTION_HEADER imageSectionHeader = { 0 };
unsigned char text[8] = { ',', 't', 'e', 'x', 't', '\x00', '\x00', '\x00' };
if (argc != 3)
{
printf(".\\%s <Shellcode.bin> <Output.exe>\n", argv[0]);
return 0;
}
do
{
hFileShellcode = CreateFileA(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFileShellcode == INVALID_HANDLE_VALUE)
{
printf("[*] 打开shellcode文件失败 %s\n", argv[1]);
break;
}
if (!GetFileSizeEx(hFileShellcode, &liFileSize))
{
printf("[*] shellcode文件大小异常\n");
break;
}
pShellcode = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, liFileSize.LowPart);
if (!pShellcode)
{
printf("[*] 无法为 shellcode 分配内存\n");
break;
}
if (!ReadFile(hFileShellcode, pShellcode, liFileSize.LowPart, &dwRead, NULL))
{
printf("[*] 读取shellcode失败\n");
break;
}
printf("[*] Shellcode 读取到大小为 %d\n", liFileSize.LowPart);
printf("[*] 创建 PE 头\n");
printf("[*] 创建imageDosHeader\n");
imageDosHeader.e_magic = 0x5A4D;
imageDosHeader.e_lfanew = sizeof(IMAGE_DOS_HEADER);
printf("[*] 创建imageNtHeaders64\n");
imageNtHeaders64.Signature = 0x00004550;
imageNtHeaders64.FileHeader.Machine = 0x8664;
imageNtHeaders64.FileHeader.NumberOfSections = 1;
imageNtHeaders64.FileHeader.Characteristics = 0022;
imageNtHeaders64.FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER64);
imageNtHeaders64.OptionalHeader.Magic = 0x020B;
imageNtHeaders64.OptionalHeader.AddressOfEntryPoint = 0x1000;
imageNtHeaders64.OptionalHeader.SectionAlignment = 0x1000;
imageNtHeaders64.OptionalHeader.FileAlignment = 0x200;
imageNtHeaders64.OptionalHeader.MajorOperatingSystemVersion = 0x6;
imageNtHeaders64.OptionalHeader.MinorOperatingSystemVersion = 0x0;
imageNtHeaders64.OptionalHeader.MajorImageVersion = 0x0;
imageNtHeaders64.OptionalHeader.MinorImageVersion = 0x0;
imageNtHeaders64.OptionalHeader.MajorSubsystemVersion = 0x6;
imageNtHeaders64.OptionalHeader.MinorSubsystemVersion = 0x0;
imageNtHeaders64.OptionalHeader.SizeOfImage = 0x1000 + liFileSize.LowPart;
imageNtHeaders64.OptionalHeader.SizeOfHeaders = sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_NT_HEADERS64) + sizeof(IMAGE_SECTION_HEADER);
imageNtHeaders64.OptionalHeader.Subsystem = 0x2;
imageNtHeaders64.OptionalHeader.DllCharacteristics = 0x8160;
imageSectionHeader.SizeOfRawData = liFileSize.LowPart;
imageSectionHeader.Misc.VirtualSize = liFileSize.LowPart;
imageSectionHeader.VirtualAddress = 0x1000;
imageSectionHeader.PointerToRawData = 0x200;
imageSectionHeader.Characteristics = 0x60000020;
for (size_t i = 0; i < 8; i++)
{
imageSectionHeader.Name[i] = text[i];
}
printf("[*] 完成构建文件，开始输出\n");
hFileOutput = CreateFileA(argv[2], GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFileOutput == INVALID_HANDLE_VALUE)
{
printf("[*] 无法创建输出文件 %s\n", argv[2]);
break;
}
printf("[*] 写Header\n");
if (!WriteFile(hFileOutput, &imageDosHeader, sizeof(imageDosHeader), &dwWritten, NULL) ||
!WriteFile(hFileOutput, &imageNtHeaders64, sizeof(imageNtHeaders64), &dwWritten, NULL) ||
!WriteFile(hFileOutput, &imageSectionHeader, sizeof(imageSectionHeader), &dwWritten, NULL))
{
printf("[*] 无法将Header写入输出文件\n");
break;
}
printf("[*] 写填充\n");
BOOL flag = true;
for (size_t i = 0; i < 0x200 - sizeof(imageDosHeader) - sizeof(imageNtHeaders64) - sizeof(imageSectionHeader); i++)
{
char pad = '\x00';
if (!WriteFile(hFileOutput, &pad, 1, &dwWritten, NULL))
{
flag = false;
break;
}
}
if (!flag)
{
printf("[*] 无法将填充内容写入输出文件\n");
break;
}
printf("[*] 写shellcode\n");
if (!WriteFile(hFileOutput, pShellcode, liFileSize.LowPart, &dwWritten, NULL))
{
printf("[*] 无法将 shellcode 写入输出文件\n");
break;
}
} while (false);
printf("[*] 善后一下\n");
if (hFileShellcode != INVALID_HANDLE_VALUE)
{
CloseHandle(hFileShellcode);
}
if (hFileOutput != INVALID_HANDLE_VALUE)
{
CloseHandle(hFileOutput);
}
if (pShellcode)
{
HeapFree(GetProcessHeap(), 0, pShellcode);
}
return 0;
}
|
