当然代码没有优化,而且有些杂乱,只是因为半途遇到一个小麻烦...如果某人想用,可以发信询问一下详细信息,或者只是看看思路,很简单,差不多大家都会吧:)这是前天晚上有这么个想法,但是因为昨天的例会没有实现.今天和agou在实验室里琢磨了半天,也算将就完成了.比较垃圾的东西,希望能找到点有用的信息.
搞linux实在头疼,没有半点思绪.想想也是,弄linux的时候,也就是不更新blog的时候.虽然linux下的任务还是很重,但是看着某台机器空闲在那里实在不舒服,就浪费了一天弄出来了.
其实工具真的挺垃圾,不过从做exp到现在,不少是'aaaa...'的形式来触发的,可能稍微有点价值.当然包含运气成分,懒人的懒办法:)
--------------------------------violence.asm---------------------------------
.586
.model flat,stdcall
option casemap:none
include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
includelib c:\masm32\lib\kernel32.lib
include c:\masm32\include\user32.inc
includelib c:\masm32\lib\user32.lib
include c:\masm32\include\shell32.inc
includelib c:\masm32\lib\shell32.lib
.data?
hOriginal dd ?
hNew dd ?
dwByteWritten dd ?
dwFileSize dd ?
hCapWnd dd ?
hCmdWnd dd ?
dwThreadID dd ?
.data
szAbnormalFile db MAX_PATH dup(0)
szOperation db 'open',0
szErrExec db '无法装载执行文件!',0
szConfigPath db MAX_PATH dup(0)
szPluginPath db MAX_PATH dup(0)
szConfigFileName db '\config.ini',0
szSectionName db 'Violence Config',0
szDefault db 'Default',0
szKeyTargetProg db 'TargetProg',0
szTargetProg db MAX_PATH dup(0)
szKeyAbnormalCap db 'AbnormalCap',0
szAbnormalCap db MAX_PATH dup(0)
szKeyAbnormalCmd db 'AbnormalCmd',0
szAbnormalCmd db MAX_PATH dup(0)
szKeyOriginal db 'Original',0
szOriginal db MAX_PATH dup(0)
szKeyNew db 'New',0
szNew db MAX_PATH dup(0)
szKeyViolenceString db 'ViolenceString',0
szViolenceString db MAX_PATH dup(0)
szKeyNormalCap db 'NormalCap',0
szNormalCap db MAX_PATH dup(0)
szKeyStartInterval db 'StartInterval',0
dwStartInterval dd 0
szKeyCloseInterval db 'CloseInterval',0
dwCloseInterval dd 0
szKeyAbnormalIndex db 'AbnormalIndex',0
dwAbnormalIndex dd 0
dwViolenceStringLen dd 0
szViolenceChar db 'A',0
szKeyFileOffset db 'FileOffset',0
dwFileOffset dd 0
szCaption db MAX_PATH dup(0)
szCaptionTemp db MAX_PATH dup(0)
szCmd db MAX_PATH dup(0)
szMainCaption db 'Violence-penetrate test,develop by PLL,is now running',0
szMainInfo db 'Click OK to exit!',0
szFileOffset db MAX_PATH dup(0)
szFileOffsetFmt db '%d',0
.code
assume fs:nothing
_penetrate proc _hWnd:DWORD
invoke RtlZeroMemory,addr szConfigPath,sizeof szConfigPath
invoke GetCurrentDirectory,MAX_PATH,addr szPluginPath
invoke lstrcpy,addr szConfigPath,addr szPluginPath
mov esi,offset szConfigPath
invoke lstrlen,esi
mov ecx,offset szConfigFileName
.if byte ptr [esi+eax-1] == '\'
inc ecx
.endif
invoke lstrcat,esi,ecx
invoke GetPrivateProfileInt,addr szSectionName,addr szKeyStartInterval,50,addr szConfigPath
mov dwStartInterval,eax
invoke GetPrivateProfileInt,addr szSectionName,addr szKeyCloseInterval,50,addr szConfigPath
mov dwCloseInterval,eax
invoke GetPrivateProfileInt,addr szSectionName,addr szKeyAbnormalIndex,50,addr szConfigPath
mov dwAbnormalIndex,eax
invoke GetPrivateProfileString,addr szSectionName,addr szKeyNormalCap,addr szDefault,addr szNormalCap,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyAbnormalCap,addr szDefault,addr szAbnormalCap,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyAbnormalCmd,addr szDefault,addr szAbnormalCmd,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyTargetProg,addr szDefault,addr szTargetProg,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyOriginal,addr szDefault,addr szOriginal,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyNew,addr szDefault,addr szNew,MAX_PATH,addr szConfigPath
invoke GetPrivateProfileString,addr szSectionName,addr szKeyViolenceString,addr szDefault,addr szViolenceString,MAX_PATH,addr szConfigPath
invoke lstrlen,addr szViolenceString
mov dwViolenceStringLen,eax
invoke GetPrivateProfileInt,addr szSectionName,addr szKeyFileOffset,50,addr szConfigPath
mov dwFileOffset,eax
invoke CreateFile,addr szOriginal,GENERIC_WRITE,FILE_SHARE_READ,\
0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
.if eax!=INVALID_HANDLE_VALUE
mov hOriginal,eax
invoke GetFileSize,eax,NULL
mov dwFileSize,eax
invoke CloseHandle,hOriginal
.endif
.while TRUE
invoke CopyFileA,addr szOriginal,addr szNew,FALSE
mov eax,dwFileOffset
add eax,dwViolenceStringLen
.if eax>dwFileSize
invoke lstrcat,addr szViolenceString,addr szViolenceChar
mov eax,dwViolenceStringLen
inc eax
mov dwViolenceStringLen,eax
mov dwFileOffset,0
invoke lstrlen,addr szViolenceString
.if eax==MAX_PATH
;save some key in config.ini
.endif
;save some key in config.ini
invoke WritePrivateProfileString,addr szSectionName,addr szKeyViolenceString,addr szViolenceString,addr szConfigPath
invoke wsprintf,addr szFileOffset,addr szFileOffsetFmt,dwFileOffset
invoke WritePrivateProfileString,addr szSectionName,addr szKeyFileOffset,addr szFileOffset,addr szConfigPath
.endif
invoke CreateFile,addr szNew,GENERIC_WRITE,FILE_SHARE_READ,\
0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
.if eax!=INVALID_HANDLE_VALUE
mov hNew,eax
mov eax,dwFileOffset
invoke SetFilePointer,hNew,eax,0,FILE_BEGIN
mov eax,dwViolenceStringLen
invoke WriteFile,hNew,addr szViolenceString,eax,addr dwByteWritten,0
invoke CloseHandle,hNew
.endif
invoke ShellExecute,NULL,addr szOperation,addr szTargetProg,addr szNew,NULL,SW_SHOWNORMAL
invoke Sleep,dwStartInterval
;find windows
invoke GetDesktopWindow
invoke GetWindow,eax,GW_CHILD
invoke GetWindow,eax,GW_HWNDFIRST
mov hCapWnd,eax
.while eax
invoke GetWindowText,hCapWnd,addr szCaption,sizeof szCaption
.if eax
invoke RtlZeroMemory,addr szCaptionTemp,sizeof szCaptionTemp
invoke lstrlen,addr szAbnormalCap
inc eax
invoke lstrcpyn,addr szCaptionTemp,addr szCaption,eax
invoke lstrcmp,addr szCaptionTemp,addr szAbnormalCap
.if eax==0
invoke GetWindow,hCapWnd,GW_CHILD
invoke GetWindow,eax,GW_HWNDFIRST
mov hCmdWnd,eax
.while eax
invoke GetWindowText,hCmdWnd,addr szCmd,sizeof szCmd
invoke RtlZeroMemory,addr szCaptionTemp,sizeof szCaptionTemp
invoke lstrlen,addr szAbnormalCmd
inc eax
invoke lstrcpyn,addr szCaptionTemp,addr szCmd,eax
invoke lstrcmp,addr szCaptionTemp,addr szAbnormalCmd
.if eax==0
;record the importent information
;copy the importent file
invoke lstrcpy,addr szAbnormalFile,addr szNew
invoke lstrlen,addr szAbnormalFile
lea ecx,offset szAbnormalFile
add ecx,eax
sub ecx,5
mov eax,dwAbnormalIndex
mov byte ptr[ecx],al
inc eax
mov dwAbnormalIndex,eax
invoke CopyFileA,addr szNew,addr szAbnormalFile,FALSE
.endif
invoke GetWindow,hCmdWnd,GW_HWNDNEXT
mov hCmdWnd,eax
invoke GetParent,eax
mov eax,hCmdWnd
.endw
.endif
.endif
invoke GetWindow,hCapWnd,GW_HWNDNEXT
mov hCapWnd,eax
invoke GetParent,eax
mov eax,hCapWnd
.endw
invoke FindWindow,NULL,addr szNormalCap
.if eax
invoke GetWindowThreadProcessId,eax,addr hCapWnd
invoke OpenProcess,PROCESS_TERMINATE,TRUE,hCapWnd
invoke TerminateProcess,eax,NULL
.endif
invoke FindWindow,NULL,addr szAbnormalCap
.if eax
invoke GetWindowThreadProcessId,eax,addr hCapWnd
invoke OpenProcess,PROCESS_TERMINATE,TRUE,hCapWnd
invoke TerminateProcess,eax,NULL
.endif
invoke Sleep,dwCloseInterval
mov eax,dwFileOffset
inc eax
mov dwFileOffset,eax
.endw
_penetrate endp
start:
invoke CreateThread,NULL,0,addr _penetrate,NULL,NULL,addr dwThreadID
invoke MessageBoxA,NULL,addr szMainInfo,addr szMainCaption,NULL
invoke WritePrivateProfileString,addr szSectionName,addr szKeyViolenceString,addr szViolenceString,addr szConfigPath
invoke wsprintf,addr szFileOffset,addr szFileOffsetFmt,dwFileOffset
invoke WritePrivateProfileString,addr szSectionName,addr szKeyFileOffset,addr szFileOffset,addr szConfigPath
invoke ExitProcess,NULL
end start
--------------------------------violence end---------------------------------
---------------------------------config.ini------------------------------------
[Violence Config]
TargetProg=C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
Original=D:\workspace\exploit\violence\code\basic.pdf
New=D:\workspace\exploit\violence\code\new.pdf
ViolenceString=A
FileOffset=0
NormalCap=Adobe Acrobat Standard
AbnormalCap=Adobe Acrobat 6.0
AbnormalCmd=发送错误报告
AbnormalIndex=65
StartInterval=20000
CloseInterval=5000
--------------------------------config end--------------------------------