vbs로 만든 shell code를 mfc로 자동 포팅 하기

vbs로 만든 shell code를 mfc로 자동 포팅 하기

우리는 종종 word파일 안에 매크로의 shellcode를 보게 됩니다.. 

그런 shellcode를 자동으로 읽어 와서 mfc 만드는 툴을 만들어 봤습니다...

1. 사용법 

2. 파일 기능 설명

   * vba_to_cpp.py는 vba로 만든 shellcode를 mfc로 변경 해주는 툴

   * vba_shellcode.txt는 vba로 만든 shellcode  

3. 실행

4. 실행이 성공하면 vba_shellcode.cpp가 생성된다.

5.  입력할 파일 vba_shellcode.txt

  
  arrShellCode(0) = CLng("&H51EC8B55")
    arrShellCode(1) = CLng("&H0000E850")
    arrShellCode(2) = CLng("&H89580000")
    arrShellCode(3) = CLng("&H8B58FC45")
    arrShellCode(4) = CLng("&H4D8B0845")
    arrShellCode(5) = CLng("&H8C8803FC")
    arrShellCode(6) = CLng("&H8B000001")
    arrShellCode(7) = CLng("&H928B0855")
    arrShellCode(8) = CLng("&H00000188")

6. 만든 툴 vba_to_cpp.py 

  
#
# black falcon team
# vba to mfc 
# write by jang, kyoung chip
#
#
#
import os
import sys

# Args management
import optparse


class CVbaToMfc :



    def __init__(self ,path=None):
        self.m_path = ""
        self.filename = ""
        self.m_data = ""
	
    def setPath(self, path ) :
	
        self.m_path = path

		
    def doReadVba(self) :	
        #self.m_path =  "arrShellCode_vba_01.txt"
        self.f = open( self.m_path, 'r')
        self.filename = os.path.splitext(self.m_path)

        print self.filename
		
		
        self.m_data =" #include \"stdafx.h\""
        self.m_data +="\r\n #include <stdlib.h>"
        self.m_data +="\r\n #include <string.h>"
        self.m_data +="\r\n #include <windows.h>"
        self.m_data +="\r\n"
        self.m_data +="\r\n"
        self.m_data += "char arrShellcode[] = "

        lines = self.f.readlines()


        print len(lines)	

        count = 0
        for line in lines:

            count = count + 1
            #print "line = " + line
            line = line.strip()

            if line and not line.isspace() :
                split_data01 = line.split('&H')

                split_data02 = split_data01[1].split('\"')
                line = split_data02[0]
            else :
                continue	
				
            self.m_data += "\""		
            for i in range( len(line) -2, -1 , -2 ):

                self.m_data = self.m_data + "\\x" + line[i:i+2]
					
            if count == len(lines) :	
                self.m_data += "\";\r\n"
                print "a"
            else :
                self.m_data += "\"\r\n"
				
			
			
			
        self.m_data +="\r\n"
        self.m_data +="\r\n"
        self.m_data +="int main(int argc, char* argv[])"		
        self.m_data +="\r\n{"	
        self.m_data +="\r\n    int * ret;"	
        self.m_data +="\r\n    ret = (int*)&ret+2;"	
        self.m_data +="\r\n    *ret = (int)arrShellcode;"	
        self.m_data +="\r\n    return 0;"
        self.m_data +="\r\n}"	

        #print "self.m_data = %s" % self.m_data	
			
			
			
        self.f.close()

    def doWrite(self) :
        file = open(self.filename[0]+".cpp","wb")
        file.write(self.m_data)
		
    def doWork( self , path ) :
        self.setPath(path)
        self.doReadVba()
        self.doWrite()        


if __name__ == "__main__":

		
    commandList = optparse.OptionParser('\n\n\
	write by BlackFalcon \n\n\
        usage: %prog -f filename.txt ')


    commandList.add_option('-f', '--file', action="store",
                      help="Insert file name, ex: word.vbs",
                      )
				  
    options, remainder = commandList.parse_args()

    # Check args
    if not options.file:

        commandList.print_help()
        sys.exit(1)

    vba_to_mfc = CVbaToMfc()
    vba_to_mfc.doWork(options.file)

7. 최종 결과물 vba_shellcode.cpp

 #include "stdafx.h"
 #include <stdlib.h>
 #include <string.h>
 #include <windows.h>

char arrShellcode[] = "\x55\x8B\xEC\x51"
"\x50\xE8\x00\x00"
"\x00\x00\x58\x89"
"\x45\xFC\x58\x8B"
"\x45\x08\x8B\x4D"
"\xFC\x03\x88\x8C"
"\x01\x00\x00\x8B"
"\x55\x08\x8B\x92"
"\x88\x01\x00\x00";


int main(int argc, char* argv[])
{
    int * ret;
    ret = (int*)&ret+2;
    *ret = (int)arrShellcode;
    return 0;
}