diff --git a/DotNet/Program.cs b/DotNet/Program.cs index d480570..bda557d 100644 --- a/DotNet/Program.cs +++ b/DotNet/Program.cs @@ -673,7 +673,7 @@ namespace RDIShellcodeLoader else // 32 Bit { var rdiShellcode = rdiShellcode32; - int bootstrapSize = 45; + int bootstrapSize = 46; // call next instruction (Pushes next instruction address to stack) newShellcode.Add(0xe8); @@ -685,9 +685,16 @@ namespace RDIShellcodeLoader // Set the offset to our DLL from pop result dllOffset = (uint)(bootstrapSize - newShellcode.Count + rdiShellcode.Length); - // pop ecx - Capture our current location in memory + // pop eax - Capture our current location in memory newShellcode.Add(0x58); + // push ebp + newShellcode.Add(0x55); + + // mov ebp, esp + newShellcode.Add(0x89); + newShellcode.Add(0xe5); + // mov ebx, eax - copy our location in memory to ebx before we start modifying eax newShellcode.Add(0x89); newShellcode.Add(0xc3); @@ -731,10 +738,8 @@ namespace RDIShellcodeLoader newShellcode.Add(0x00); newShellcode.Add(0x00); - // add esp, 0x14 - correct the stack pointer - newShellcode.Add(0x83); - newShellcode.Add(0xc4); - newShellcode.Add(0x14); + // leave + newShellcode.Add(0xc9); // ret - return to caller newShellcode.Add(0xc3); diff --git a/PowerShell/ConvertTo-Shellcode.ps1 b/PowerShell/ConvertTo-Shellcode.ps1 index 26d9a05..77d4848 100644 --- a/PowerShell/ConvertTo-Shellcode.ps1 +++ b/PowerShell/ConvertTo-Shellcode.ps1 @@ -483,7 +483,7 @@ public class sRDI else // 32 Bit { var rdiShellcode = rdiShellcode32; - int bootstrapSize = 45; + int bootstrapSize = 46; // call next instruction (Pushes next instruction address to stack) newShellcode.Add(0xe8); @@ -495,10 +495,16 @@ public class sRDI // Set the offset to our DLL from pop result dllOffset = (uint)(bootstrapSize - newShellcode.Count + rdiShellcode.Length); - //Here is where the we pop the address of our shellcode off the stack and into the first register - // pop ecx + // pop eax - Capture our current location in memory newShellcode.Add(0x58); + // push ebp + newShellcode.Add(0x55); + + // mov ebp, esp + newShellcode.Add(0x89); + newShellcode.Add(0xe5); + // mov ebx, eax - copy our location in memory to ebx before we start modifying eax newShellcode.Add(0x89); newShellcode.Add(0xc3); @@ -542,10 +548,8 @@ public class sRDI newShellcode.Add(0x00); newShellcode.Add(0x00); - // add esp, 0x14 - correct the stack pointer - newShellcode.Add(0x83); - newShellcode.Add(0xc4); - newShellcode.Add(0x14); + // leave + newShellcode.Add(0xc9); // ret - return to caller newShellcode.Add(0xc3); diff --git a/Python/ShellcodeRDI.py b/Python/ShellcodeRDI.py index 01f4fe6..40121e2 100644 --- a/Python/ShellcodeRDI.py +++ b/Python/ShellcodeRDI.py @@ -127,6 +127,9 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): # ret - return to caller bootstrap += b'\xc3' + if len(bootstrap) != bootstrapSize: + raise Exception("x64 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize)) + # Ends up looking like this in memory: # Bootstrap shellcode # RDI shellcode @@ -138,7 +141,7 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): rdiShellcode = rdiShellcode32 bootstrap = b'' - bootstrapSize = 45 + bootstrapSize = 46 # call next instruction (Pushes next instruction address to stack) bootstrap += b'\xe8\x00\x00\x00\x00' @@ -146,9 +149,15 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): # Set the offset to our DLL from pop result dllOffset = bootstrapSize - len(bootstrap) + len(rdiShellcode) - # pop ecx - Capture our current location in memory + # pop eax - Capture our current location in memory bootstrap += b'\x58' + # push ebp + bootstrap += b'\x55' + + # mov ebp, esp + bootstrap += b'\x89\xe5' + # mov ebx, eax - copy our location in memory to ebx before we start modifying eax bootstrap += b'\x89\xc3' @@ -184,12 +193,15 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): bootstrap += pack('b', bootstrapSize - len(bootstrap) - 4) # Skip over the remainder of instructions bootstrap += b'\x00\x00\x00' - # add esp, 0x14 - correct the stack pointer - bootstrap += b'\x83\xc4\x14' + # leave + bootstrap += b'\xc9' # ret - return to caller bootstrap += b'\xc3' + if len(bootstrap) != bootstrapSize: + raise Exception("x86 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize)) + # Ends up looking like this in memory: # Bootstrap shellcode # RDI shellcode