-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtemplate.py
More file actions
164 lines (145 loc) · 8.07 KB
/
Copy pathtemplate.py
File metadata and controls
164 lines (145 loc) · 8.07 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
import ctypes, struct
from keystone import *
CODE = (
" start: " #
" int3 ;" # Breakpoint for Windbg. REMOVE ME WHEN NOT DEBUGGING!!!!
" mov ebp, esp ;" #
"find_kernel32: ;" #
" xor ecx, ecx ;" # ECX = 0
" mov eax, fs:[ecx + 0x30] ;" # EAX = PEB
" mov eax, [eax + 0xc] ;" # EAX = PEB -> Ldr
" mov esi, [eax + 0x14] ;" # ESI = PEB -> Ldr.InMemOrder
" lodsd ;" # EAX = Second module
" xchg eax, esi ;" # EAX <=> ESI
" lodsd ;" # EAX = Third(kernel32)
" mov ebx, [eax + 0x10] ;" # EBX = Kernel32 base address
" mov edx, [ebx + 0x3c] ;" # EDX = DOS -> e_lfanew
" add edx, ebx ;" # EDX = PE Header
" mov edx, [edx + 0x78] ;" # EDX = Offset export table
" add edx, ebx ;" # EDX = Export table
" mov esi, [edx + 0x20] ;" # ESI = Offset name table
" add esi, ebx ;" # ESI = Names tables
" xor ecx, ecx ;" # ECX = 0
"Get_Function: ;" #
" inc ecx ;" # ECX = 1
" lodsd ;" # Get name offset
" add eax, ebx ;" # Get function name
" cmp dword ptr[eax], 0x50746547 ;" # GetP
" jnz Get_Function ;" #
" cmp dword ptr[eax + 0x4], 0x41636f72;" # rocA
" jnz Get_Function ;" #
" cmp dword ptr[eax + 0x8], 0x65726464;" # ddre
" jnz Get_Function ;" #
" mov esi, [edx + 0x24] ;" # ESi = Offset ordinals
" add esi, ebx ;" # ESI = Ordinals table
" mov cx, [esi + ecx * 2] ;" # CX = Number of function
" dec ecx ;" # ECX = -1
" mov esi, [edx + 0x1c] ;" # ESI = Offset address table
" add esi, ebx ;" # ESI = Address table
" mov edx, [esi + ecx * 4] ;" # EDX = Pointer(offset)
" add edx, ebx ;" # EDX = GetProcAddress
" mov [ebp], ebx ;" # [EBP] = Kernel32
" mov [ebp + 4], edx ;" # [EBP+4] = GetProcAddressStub
# " ret "
"LoadLibrary: ;" #
" xor ecx, ecx ;" # ECX = 0
" push ecx ;" # ECX = 0
" push 0x41797261 ;" # aryA
" push 0x7262694c ;" # Libr
" push 0x64616f4c ;" # Load
" push esp ;" # "LoadLibrary"
" push [ebp] ;" # Kernel32 base address
" call [ebp + 4] ;" # GetProcAddress(LL) | if success, LoadLibrary address should be at EAX
" mov [ebp + 8], eax ;" # [EBP+8] = LoadLibraryAStub
# " ret "
"Load_User32.dll: ;"
" add esp, 0xc ;" # 'clean stack'
" pop ecx ;" # ECX = 0
" push ecx ;" # ECX = 0 -> ESP
" mov cx, 0x6c6c ;" # ll
" push ecx ;" # ECX = ll -> ESP
" push 0x642e3233 ;" # 32.d
" push 0x72657355 ;" # User
" push esp ;" # "User32.dll"
" call [ebp + 8] ;" # LoadLibrary("User32.dll")
" mov [ebp + 0xC], eax ;" # [EBP+C] = User32.dll
# " ret "
"Load_Advapi32.dll: ;"
" xor ecx, ecx ;" # ECX = 0
" push ecx ;" # ECX = 0 -> ESP
" push 0x6c6c642e ;" # .dll
" push 0x32336970 ;" # pi32
" push 0x61766441 ;" # Adva
" push esp ;" # "Advapi32.dll"
" call [ebp + 8] ;" # LoadLibrary("Advapi32.dll")
" mov [ebp + 0x10], eax ;" # [EBP+10] = Advapi32.dll
# " ret "
"GPA_GetUserNameA: ;"
" push ecx ;" # ECX = 0 -> ESP
" push 0x41656d61 ;" # ameA
" push 0x4e726573 ;" # serN
" push 0x55746547 ;" # GetU
" push esp ;" # "GetUserNameA"
" push [ebp + 0x10] ;" # Advapi32 base address
" call [ebp + 4] ;" # GetProcAddress(GetUserNameA) | if success, GetUserNameA address should be at EAX
" mov [ebp + 0x14], eax ;" # Put GetUserNameA into [EBP+14]
# " ret "
"GPA_MessageBoxA: ;"
" xor ecx, ecx ;" # ECX = 0
" push ecx ;" # ECX = 0 -> ESP
" mov ecx, 0xffbe8791 ;" # oxA
" neg ecx ;" # -oxA
" push ecx ;" # ECX -> ESP
" push 0x42656761 ;" # ageB
" push 0x7373654d ;" # Mess
" push esp ;" # "MessageBoxA"
" push [ebp + 0xC] ;" # User32 base address
" call [ebp + 4] ;" # GetProcAddress(MessageBoxA) | if success, MessageBoxA address should be at EAX
" mov [ebp + 0x18], eax ;" # Put MessageBox into [EBP+18]
# " ret "
"Call_GetUserNameA: ;"
" sub esp, 0x0A ;" # ESP - 0x0A (10)
" mov edx, esp ;" # ESP -> EDX
" mov [ebp + 0x1C], edx ;" # [EBP + 0x1C] = Username
" sub esp, 0x0A ;" # ESP - 0x0A (10) - Saves another area to store the pointer
" mov ecx, esp ;" # ESP -> ECX
" push ecx ;" # ECX -> ESP
" push edx ;" # EDX -> ESP
" call [ebp + 0x14] ;" # GetUserNameA
# " ret "
"Call_MessageBox: ;"
" xor eax, eax ;" # EAX = 0
" inc eax ;" # EAX = 1
" push eax ;" # EAX -> ESP
" dec eax ;" # EAX = 0
" push eax ;" # EAX -> ESP
" push [ebp + 0x1C] ;" # 'username' -> ESP
" push eax ;" # EAX -> ESP
" call [ebp + 0x18] ;" # MessageBox
" ret "
)
# Initialize engine in X86-32bit mode
ks = Ks(KS_ARCH_X86, KS_MODE_32)
encoding, count = ks.asm(CODE)
print("Encoded %d instructions..." % count)
sh = b""
for e in encoding:
sh += struct.pack("B", e)
shellcode = bytearray(sh)
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
ctypes.c_int(len(shellcode)),
ctypes.c_int(0x3000),
ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
buf,
ctypes.c_int(len(shellcode)))
print("Shellcode located at address %s" % hex(ptr))
input("...ENTER TO EXECUTE SHELLCODE...")
ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
ctypes.c_int(0),
ctypes.c_int(ptr),
ctypes.c_int(0),
ctypes.c_int(0),
ctypes.pointer(ctypes.c_int(0)))
ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht), ctypes.c_int(-1))