CobaltStrike ShellCode详解

#include <iostream>#include <stdio.h>#include <windows.h> typedef void* (WINAPI* FnLoadLibraryA)(char*);FnLoadLibraryA MyLoadLibraryA; int main(){    UINT_PTR uiBaseAddress = 0;    UINT_PTR uiExportDir = 0;    UINT_PTR uiNameArray = 0;    UINT_PTR uiAddressArray = 0;    UINT_PTR uiNameOrdinals = 0;    DWORD dwCounter = 0;    void* hKernel32 = NULL;     //直接通过PEB获取到Kernel32的基址    __asm {        mov rdx, gs: [60h]        mov rdx, [rdx + 18h]        mov rdx, [rdx + 20h]        mov rdx, [rdx]        mov rdx, [rdx]        mov rdx, [rdx + 20h]        mov hKernel32, rdx    }    uiBaseAddress = (UINT_PTR)hKernel32;    //获取NT头    uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;    //获取数据目录表中的导出表RVA    uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];    //获取导出表    uiExportDir = uiBaseAddress +((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress;    //获取名称表    uiNameArray = uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames;    //获取导出地址表    uiAddressArray = uiBaseAddress +((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions;    //获取导出序号表    uiNameOrdinals = uiBaseAddress +((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals;    //获取名称导出的个数    dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames;    while (dwCounter--)    {         char* cpExportedFunctionName = (char*)(uiBaseAddress + *(DWORD*)(uiNameArray));        //找LoadLibrary        if (strstr(cpExportedFunctionName, "LoadLibraryA") != NULL)        {            // 用导出序号*dword是在获取函数在地址表内的位置+地址表获取到内存中的位置            uiAddressArray += (*(WORD*)(uiNameOrdinals) * sizeof(DWORD));            printf(" LoadLibraryA RVA: % d", *(DWORD*)(uiAddressArray));            // 返回函数地址RVA+基址                       MyLoadLibraryA = (FnLoadLibraryA)( uiBaseAddress+* (DWORD*)uiAddressArray);            //调用后加载            HMODULE hUser32 = (HMODULE)MyLoadLibraryA((char*)"testdll.dll");            //返回LoadLibraryA的rva             return *(DWORD*)(uiAddressArray);        }        // 名称表++        uiNameArray += sizeof(DWORD);        // 序号表++        uiNameOrdinals += sizeof(WORD);    }    return 0;}