分类一线开发下的文章 - 白帽Wiki

2022-10-25 huoji 0 条评论

[2022]通过资源管理器选择文件

懂得都懂
```cpp

_Result_nullonfailure_
LPTSTR SelectTargetFileByExplorer(VOID) {

OPENFILENAME ofn;					// common dialog box structure
	TCHAR szFile[MAX_PATH] = { 0 };		// if using TCHAR macros
	LPTSTR Output = NULL;

// Initialize OPENFILENAME

/*
	if (0 == _RtlZeroMemory)
	{
		_RtlZeroMemory = (__RtlZeroMemory)GetProcAddress(hNtDll, "RtlZeroMemory");
		if (0 == _RtlZeroMemory)
		{
			TprintfC(Red, _T("[-] Error RtlZeroMemory() %d"), GetLastError());
			return NULL;
		}
	}
	_RtlZeroMemory(&ofn, sizeof(OPENFILENAME));*/
	if (SecureZeroMemory(&ofn, sizeof(OPENFILENAME)) == NULL)
	{
		TprintfC(Red, _T("[-] Error SecureZeroMemory() %d"), GetLastError());
		return NULL;
	}

ofn.lStructSize = sizeof(OPENFILENAME);
	ofn.hwndOwner = GetActiveWindow();
	ofn.lpstrFile = szFile;
	ofn.lpstrFile[0] = _T('\0');
	ofn.nMaxFile = MAX_PATH;
	ofn.lpstrFilter = _T("All\0*.*\0Text\0*.pf\0*.db\0");
	ofn.nFilterIndex = 1;
	ofn.lpstrFileTitle = NULL;
	ofn.nMaxFileTitle = 0;
	ofn.lpstrInitialDir = NULL;
	ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;

if (GetOpenFileNameW(&ofn) == TRUE) {
		TprintfC(Green, _T("\n[+] Selected file: \"%s\".\n"), ofn.lpstrFile);
	}
	else {
		TprintfC(Red, _T("[-] Error: GetOpenFileName has failed %d.\n"), GetLastError());
	}

Output = CopyBuffer(ofn.lpstrFile, 0);
	return Output;
}
```

阅读全文

2022-10-16 huoji 0 条评论

C/C++

[2021]XXTEA

阅读全文

2022-10-15 huoji 0 条评论

二进制安全 C/C++

[2022]快速加载shellcode的代码

每次都找,每次都找不到,放着了,不想一个一个找了
```cpp
#include<Windows.h>
#include <stdio.h>
#include <fstream>
#include<iostream>
using namespace std;

void load(char* buf, int shellcode_size)
{
    DWORD dwThreadId; // 线程ID
    HANDLE hThread; // 线程句柄

char* shellcode = (char*)VirtualAlloc(
        NULL,
        shellcode_size,
        MEM_COMMIT,
        PAGE_EXECUTE_READWRITE);

CopyMemory(shellcode, buf, shellcode_size);
    //CreateThread函数，创建线程
    hThread = CreateThread(
        NULL, // 安全描述符
        NULL, // 栈的大小
        (LPTHREAD_START_ROUTINE)shellcode, // 函数
        NULL, // 参数
        NULL, // 线程标志
        &dwThreadId // 若成功，接收新创建的线程的线程ID DWORD变量的地址。
    );
    //通过调用 WaitForSingleObject 函数来监视事件状态,当事件设置为终止状态（WaitForSingleObject 返回 WAIT_OBJECT_0）时，每个线程都将自行终止执行。
    WaitForSingleObject(hThread, INFINITE); // 一直等待线程执行结束
}
int wmain(int argc, char* argv[])
{
    char filename[] = "c:\\f.bin";
    // 以读模式打开文件
    ifstream infile;
    //以二进制方式打开
    infile.open(filename, ios::out | ios::binary);
    infile.seekg(0, infile.end); //追溯到流的尾部
    int length = infile.tellg(); //获取流的长度
    infile.seekg(0, infile.beg);//回溯到流头部

char* data = new char[length]; //存取文件内容
    if (infile.is_open()) {
        cout << "reading from the file" << endl;
        infile.read(data, length);
    }
    cout << "size of data =" << sizeof(data) << endl;
    cout << "size of file =" << length << endl;
    /*
    for (int i = 0; i < length; i++)
    {
        printf("\\%x ", data[i]);
    }
    */
    int shellcode_size = length;
    load(data, shellcode_size);
    //加载成功并不会输出，推测load函数新创建的线程执行结束后，主进程也终止了。
    cout << "加载成功";
    system("pause");
    return 0;
}
```

阅读全文

2022-10-08 huoji 0 条评论

系统安全 C/C++汇编