使用汇编语言编写注入代码

发表于 2022-04-14 更新于 2022-04-20 Valine：本文字数： 3.7k 阅读时长 ≈ 3 分钟

代码注入-汇编

¶0x00-设置

修改EIP

关闭自动填充nop

¶0x01-修改汇编

输入字符串，Ctrl+E修改，注意字符串以0结尾，最后要加上00

可以发现得到的是汇编代码，OD会自动识别

只需要选中字符串按下Ctrl+A即可转为字符串

同理修改好www.reversecore.com字符串

¶提取汇编

接下来将插入的asm的机器码进行复制（在内存窗口中复制对应长度的十六进制数据），并修改格式

得到

char shellcode[] = {
0x55,0x8B,0xEC,0x8B,0x75,0x08,0x68,0x6C,0x6C,0x00,0x00,0x68,0x33,0x32,0x2E,0x64
,0x68,0x75,0x73,0x65,0x72,0x54,0xFF,0x16,0x68,0x6F,0x78,0x41,0x00,0x68,0x61,0x67
,0x65,0x42,0x68,0x4D,0x65,0x73,0x73,0x54,0x50,0xFF,0x56,0x04,0x6A,0x00,0xE8,0x0C
,0x00,0x00,0x00,0x52,0x65,0x76,0x65,0x72,0x73,0x65,0x43,0x6F,0x72,0x65,0x00,0xE8
,0x14,0x00,0x00,0x00,0x77,0x77,0x77,0x2E,0x72,0x65,0x76,0x65,0x72,0x73,0x65,0x63
,0x6F,0x72,0x65,0x2E,0x63,0x6F,0x6D,0x00,0x6A,0x00,0xFF,0xD0,0x33,0xC0,0x8B,0xE5
,0x5D,0xC3
};

¶0x02-代码实现

#include<stdio.h>
#include<Windows.h>
#include<string.h>

BYTE shellcode[] = {
 0x55,0x8B,0xEC,0x8B,0x75,0x08,0x68,0x6C,0x6C,0x00,0x00,0x68,0x33,0x32,0x2E,0x64
,0x68,0x75,0x73,0x65,0x72,0x54,0xFF,0x16,0x68,0x6F,0x78,0x41,0x00,0x68,0x61,0x67
,0x65,0x42,0x68,0x4D,0x65,0x73,0x73,0x54,0x50,0xFF,0x56,0x04,0x6A,0x00,0xE8,0x0C
,0x00,0x00,0x00,0x52,0x65,0x76,0x65,0x72,0x73,0x65,0x43,0x6F,0x72,0x65,0x00,0xE8
,0x14,0x00,0x00,0x00,0x77,0x77,0x77,0x2E,0x72,0x65,0x76,0x65,0x72,0x73,0x65,0x63
,0x6F,0x72,0x65,0x2E,0x63,0x6F,0x6D,0x00,0x6A,0x00,0xFF,0xD0,0x33,0xC0,0x8B,0xE5
,0x5D,0xC3
};

typedef struct _Thread_Param
{
	FARPROC pFunc[2];//Loadlibrary,GetProcAddress
}Thread_Param, * pThread_Param;

void Asm_Inject(DWORD PID)
{
	HMODULE hMod = NULL;
	HANDLE hProcess = NULL;
	Thread_Param param[2] = { 0, };
	HANDLE hThread = NULL;
	LPVOID pRemoteBuf[2] = { 0, };

	//获取kernel32.dll的句柄
	hMod = GetModuleHandleA("kernel32.dll");
	//将需要使用的函数存储
	param->pFunc[0] = GetProcAddress(hMod, "LoadLibraryA");
	param->pFunc[1] = GetProcAddress(hMod, "GetProcAddress");

	//开启进程
	if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID)))
	{
		printf("Open Failed!!Error Code:%d\n", GetLastError());
		return;
	}

	//开辟空间并写入
	if (!(pRemoteBuf[0] = VirtualAllocEx(hProcess, NULL, sizeof(Thread_Param), MEM_COMMIT, PAGE_READWRITE)))
	{
		printf("VirtualAlloc Failed!!Error Code:%d\n", GetLastError());
		return;
	}

	if (!WriteProcessMemory(hProcess, pRemoteBuf[0], (LPVOID)&param, sizeof(Thread_Param), NULL))
	{
		printf("WriteProcess Failed!!Error Code:%d\n", GetLastError());
		return;
	}

	//将我们的shellcode写入
	if (!(pRemoteBuf[1] = VirtualAllocEx(hProcess, NULL, sizeof(shellcode), MEM_COMMIT, PAGE_READWRITE)))
	{
		printf("VirtualAlloc Failed!!Error Code:%d\n", GetLastError());
		return;
	}

	if (!WriteProcessMemory(hProcess, pRemoteBuf[1], (LPVOID)&shellcode, sizeof(shellcode), NULL))
	{
		printf("WriteProcess Failed!!Error Code:%d\n", GetLastError());
		return;
	}
	hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteBuf[1], pRemoteBuf[0], 0, NULL);

	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
	CloseHandle(hProcess);
	return;
}


int main(int argc,char*argv[])
{
	Asm_Inject((DWORD)atol(argv[1]));
	return 0;
}