mirror of
https://github.com/peterferrie/win-exec-calc-shellcode
synced 2026-06-08 16:43:44 +00:00
SkyLined
67 lines
3.4 KiB
Markdown
67 lines
3.4 KiB
Markdown
win-exec-calc-shellcode
|
|
-----------------------
|
|
Small null-free shellcode that execute calc.exe.
|
|
Runs on x86 and x64 versions of Windows 5.0-6.3 (2000, XP, 2003, 2008, 7, 8, 8.1), all service packs.
|
|
|
|
Sizes (build 306)
|
|
-----------------
|
|
<table class="wikitable">
|
|
<tr>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> platform </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> size </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> stack align </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> function wrapper </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> func+save regs </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> func+stack </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> func+stack+regs </td>
|
|
</tr><tr>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> x86 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 72 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 75 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 77 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 77 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 84 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 84 </td>
|
|
</tr><tr>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> x64 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 85 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 90 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 98 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 105 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 106 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 112 </td>
|
|
</tr><tr>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> x86+x64 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 113 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 118 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 179 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 188 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 188 </td>
|
|
<td style="border: 1px solid #ccc; padding: 5px;"> 196 </td>
|
|
</tr>
|
|
</table>
|
|
|
|
Features
|
|
--------
|
|
* NUL Free
|
|
* Windows version and service pack independent.
|
|
* <a href="http://en.wikipedia.org/wiki/Instruction_set">ISA</a> independent:
|
|
runs on x86 (w32-exec-calc-shellcode) or x64 (w64-exec-calc-shellcode)
|
|
architecture, or both (win-exec-calc-shellcode).
|
|
* Stack pointer can be aligned if needed (if you are seeing crashes in
|
|
WinExec, try using the stack aligning version).
|
|
* No assumptions are made about the values in registers or on the stack.
|
|
* x86: <a href="http://en.wikipedia.org/wiki/3_GB_barrier">/3GB</a> and
|
|
<a href="http://en.wikipedia.org/wiki/WoW64">WoW64</a>" compatible (pointers
|
|
are not assumed to be smaller than 0x80000000).
|
|
* <a href="http://en.wikipedia.org/wiki/Data_Execution_Prevention">DEP</a> /
|
|
<a href="http://en.wikipedia.org/wiki/Address_space_layout_randomization">ASLR</a>
|
|
compatible: data is not executed, code is not modified.
|
|
* Able to save and restore registers and return, for use in PoC code that calls
|
|
the shellcode as a function (using <a href="http://en.wikipedia.org/wiki/X86_calling_conventions">
|
|
cdecl/stdcall/fastcall</a> calling convention.
|
|
|
|
Credits
|
|
-------
|
|
<a href="http://skylined.nl/">Skylined</a> and <a href="http://pferrie.host22.com/">Peter Ferrie</a>
|