lordran.polymorphic.shellcode

This mini project was inspired by the following meme tweeted by @jamieantisocial:

And, I found it really interesting so here is a mini PoC of some of the things mentioned in the meme.

Objectives

I had 3 main objectives with this program - Produce a shellcode which :

• Does normal execution stuff
• Overwrites previously executed stub to prevent forensic analysis
• Reuse the memory segment for executing new shellcode

Usage:

Compile everything with:

$ make

Running the EXE:

$ ./overwrite.exe

Running the shellcode:

$ python runshellcode.py shellcode.bin

Output

First, you should get a MessageBox popup with the text: Bonfire, which signifies that the first part of the shellcode has run successfully, and then a Hello World messagebox as a result of the execution of the second shellcode blob

Notes:

• The __attribute__ ((section (".text.A"))) tags on every function except the entrypoint is to make sure the entrypoint is at the beginning of the .text section. See: https://stackoverflow.com/questions/19470666/gcc-how-to-tell-gcc-to-put-the-main-function-at-the-start-of-the-text-sectio
• the shellcode variable cannot be placed in the bonfire() function because mingw places it in the .rdata section
• This project is NOT opsec safe and is just a PoC and hence isn't the best code

K. Bye.