微小Shellcode编写技术

需积分: 3 67 浏览量更新于2024-08-02 收藏 141KB PDF 举报

"WritingSmallShellcode - NGS Security Research by Dafydd Stuttard" 这篇文档是NGS (Next Generation Security Software Ltd.) 的安全研究团队成员Dafydd Stuttard撰写的一份关于编写小型Shellcode的电子书摘要。Shellcode是一种在计算机安全领域中用于利用漏洞执行特定任务的低级别代码，通常在缓冲区溢出攻击等场景中出现。该文的焦点在于如何在有限的约束条件下，尽可能地减小Win32 Shellcode的大小，以实现一个常见的功能——绑定shell。作者在文中提出了一个仅191字节且不包含空字符(null-free)的Shellcode实现，这个Shellcode可以创建一个绑定shell。在编写Shellcode时，体积是一个关键因素，因为当利用编译软件中的漏洞时，攻击者往往受到可注入数据量的限制。尽管可能有更小的解决方案，但随着Shellcode大小的减少，设计和实现的复杂度会显著增加。在《WritingSmallShellcode》中，作者不仅展示了具体的Shellcode实现，还讨论了一些编写小型Shellcode的通用策略。这些策略可能包括优化指令选择、减少不必要的数据和指令、以及利用编码技巧来压缩代码。此外，文档可能还涵盖了如何在有限的内存空间内高效地安排代码和数据，以及如何处理各种平台和架构的差异性，以确保代码的兼容性和稳定性。在实际的安全研究和漏洞利用中，Shellcode的大小直接影响到攻击的成功率和隐蔽性。通过减小Shellcode的体积，攻击者可以更轻松地绕过某些安全措施，如堆栈保护或数据执行防止（DEP）。同时，小型的Shellcode也更难被反病毒软件检测到，增加了其在恶意软件中的实用性。这篇文档对于理解Shellcode的编写原理、优化技巧，以及在安全研究和逆向工程领域中的应用具有很高的价值。它提供了一个实际的案例，展示了如何在有限的资源下实现复杂的功能，这对于任何想要深入学习系统级编程和安全技术的人来说都是宝贵的参考资料。

Writing Small Shellcode

xchg eax, reg swaps the contents of eax and another register

lodsd / lodsb loads the dword / byte pointed to by esi into eax / al,

and increments esi

stosd / stosb saves the dword / byte in eax / al at the address pointed to

by edi, and increments edi

pushad / popad saves / restores all registers to / from the stack

cdq extends eax into a quad-word using edx – this can be used

to set edx = null if we know that eax < 0x80000000

2. Use instructions with multiple effects.

Sometimes we can achieve two desirable things at once, for example using the

above instructions xchg, lods, or stos.

3. Bend API rules.

Sometimes a Windows API specifies that a parameter should be of a particular type

or in a particular range, however through experimentation we can determine that the

actual implementation is more tolerant. For example, many APIs which take a

structure and a value for the size of the structure will work perfectly well provided that

the size parameter is simply large enough. If we know that an arbitrary large number

already exists on the stack, we can exploit the API’s tolerance to avoid having to set

the parameter explicitly.

Many APIs accept null values in several parameters, and these are often the

parameters at the end of the list which are pushed onto the stack last. Rather than

push a null register several times, we can first “flush” a large portion of stack to zero,

and then only push the non-null parameters, relying on our empty stack to implicitly

pass null values for the rest. When calling several such functions in succession, the

reduction in size of our code can be significant.

We can also use space on the stack when an API requires a large structure as a

parameter. Often, we might find that the one-byte “push esp” instruction is all we

need to pass a “valid” pointer to a structure. In some cases, APIs will tolerate more

than one structure overlapping, particularly when one is an [in] parameter and the

other an [out] parameter.

4. Don’t think like a programmer.

As programmers, we get used to the idea of the call stack working in a particular,

systematic way, where we push a function’s inputs, call the function, maybe adjust

the stack pointer, and then store / process the function’s output. As shellcoders, we

can be more imaginative. To create small code, we can make use of known values in

registers to push parameters long before they will actually be used. We can use

existing values on the stack as implicit parameters without pushing anything. If we

know a suitable value exists up or down the stack, we can just adjust esp to get it in

the right place. We can also do away with the idea of a frame pointer relative to which

we locate calling parameters or local variables. These useful compiler constructs are

often too inefficient for tight shellcode, and in any case the frame pointer register is

fantastically useful for storing information across API calls (see below).

5. Make efficient use of registers.

The x86 registers were not all created equal. Many useful instructions are

implemented for specific registers only, or are shorter for some registers than others.

Certain registers are always, or very often, preserved across API calls (ebp, esi and

edi can be relied upon, and sometimes others in specific cases). It is far more

efficient to use these registers to store information, rather than saving it on the stack.

NGSSoftware Insight Security Research Page 3 of 15 http://www.ngssoftware.com

剩余14页未读，继续阅读

cangc

粉丝: 0
资源: 3

微小Shellcode编写技术

034-基于AT89C52的矩阵键盘扫描proteus仿真设计.rar

双级式储能模型，可做充放电转以及低电压故障穿越，含有负序抑制模块，可做对称故障与不对称故障

郑州升达大学2024-2025第一学期计算机视觉课程期末试卷，

金工实习线上考试线切割课后试题.docx

网络原理课程设计【校园网规划】+思科模拟器，包含pkt文件及完整实验报告，附录含有源码

智慧物联网系统发展战略研究

基于springboot+vue的大创管理系统2（Java毕业设计，附源码，部署教程）.zip

基于springboot+vue的网上点餐系统（Java毕业设计，附源码，部署教程）.zip

直流电机的电枢回路串电阻启动的计算

Java Spring Boot实现基于URL + IP访问频率限制(源代码)

最新资源