Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <stdio.h>
- #include <Windows.h>
- #include <winternl.h>
- #include <wchar.h>
- #include <tlhelp32.h>
- #include <tchar.h>
- #include <stdio.h>
- #include <strsafe.h>
- PPEB get_peb(void);
- DWORD __stdcall unicode_ror13_hash(const WCHAR *unicode_string);
- DWORD __stdcall ror13_hash(const char *string);
- HMODULE __stdcall find_module_by_hash(DWORD hash);
- FARPROC __stdcall find_function(HMODULE module, DWORD hash);
- void __stdcall shell_code()
- {
- HMODULE kern32 = find_module_by_hash(0x8FECD63F);
- FARPROC FindFirstFileA = find_function(kern32, 0x63D6C065);
- FARPROC FindNextFileA = find_function(kern32, 0xA5E1AC97);
- FARPROC FindClose = find_function(kern32, 0x23545978);
- FARPROC CreateFileA = find_function(kern32, 0x7C0017A5);
- FARPROC WriteFile = find_function(kern32, 0xE80A791F);
- FARPROC CloseHandle = find_function(kern32, 0x0FFD97FB);
- DWORD dwBytesWritten = 0;
- char path[] = { 'C', ':', '\\', 'P', 'r', 'o', 'g', 'r', 'a', 'm', ' ','F','i','l','e','s','\\','*', 0 };
- char file_name[] = { 'r', 'e', 's', 'u', 'l', 't', '.', 't', 'x', 't', 0 };
- char n[] = { '\n', 0 };
- WIN32_FIND_DATA ffd;
- HANDLE hFind = FindFirstFileA(path, &ffd);
- HANDLE hFile = CreateFileA(file_name, // name of the write
- GENERIC_WRITE, // open for writing
- 0, // do not share
- NULL, // default security
- CREATE_NEW, // create new file only
- FILE_ATTRIBUTE_NORMAL, // normal file
- NULL); // no attr. template
- do
- {
- //printf(TEXT(" %s %d\n"), ffd.cFileName,strlen2(ffd.cFileName));
- WriteFile(
- hFile, // open file handle
- ffd.cFileName, // start of data to write
- (DWORD)strlen2(ffd.cFileName), // number of bytes to write
- &dwBytesWritten, // number of bytes that were written
- NULL); // no overlapped structure
- WriteFile(
- hFile, // open file handle
- n, // start of data to write
- (DWORD)strlen2(n), // number of bytes to write
- &dwBytesWritten, // number of bytes that were written
- NULL);
- } while (FindNextFileA(hFind, &ffd) != 0);
- CloseHandle(hFile);
- FindClose(hFind);
- return;
- }
- int strlen2(str){
- register const char *s;
- for (s = str; *s; ++s);
- return(s - str);
- }
- HMODULE __stdcall find_module_by_hash(DWORD hash)
- {
- PPEB peb;
- /*__asm {
- mov eax, fs:[0x30]
- mov [peb], eax
- }*/
- LDR_DATA_TABLE_ENTRY *module_ptr, *first_mod;
- peb = get_peb();
- module_ptr = (PLDR_DATA_TABLE_ENTRY)peb->Ldr->InMemoryOrderModuleList.Flink;
- first_mod = module_ptr;
- do {
- if (unicode_ror13_hash((WCHAR *)module_ptr->FullDllName.Buffer) == hash)
- return (HMODULE)module_ptr->Reserved2[0];
- else
- module_ptr = (PLDR_DATA_TABLE_ENTRY)module_ptr->Reserved1[0];
- } while (module_ptr && module_ptr != first_mod);
- return INVALID_HANDLE_VALUE;
- }
- DWORD __stdcall ror13_hash(const char *string)
- {
- DWORD hash = 0;
- while (*string) {
- DWORD val = (DWORD)*string++;
- hash = (hash >> 13) | (hash << 19);
- hash += val;
- }
- return hash;
- }
- DWORD __stdcall unicode_ror13_hash(const WCHAR *unicode_string)
- {
- DWORD hash = 0;
- while (*unicode_string != 0)
- {
- DWORD val = (DWORD)*unicode_string++;
- hash = (hash >> 13) | (hash << 19);
- hash += val;
- }
- return hash;
- }
- PPEB __declspec(naked) get_peb(void)
- {
- __asm {
- mov eax, fs:[0x30]
- ret
- }
- }
- FARPROC __stdcall find_function(HMODULE module, DWORD hash)
- {
- IMAGE_DOS_HEADER *dos_header;
- IMAGE_NT_HEADERS *nt_headers;
- IMAGE_EXPORT_DIRECTORY *export_dir;
- DWORD *names, *funcs;
- WORD *nameords;
- int i;
- dos_header = (IMAGE_DOS_HEADER *)module;
- nt_headers = (IMAGE_NT_HEADERS *)((char *)module + dos_header->e_lfanew);
- export_dir = (IMAGE_EXPORT_DIRECTORY *)((char *)module + nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
- names = (DWORD *)((char *)module + export_dir->AddressOfNames);
- funcs = (DWORD *)((char *)module + export_dir->AddressOfFunctions);
- nameords = (WORD *)((char *)module + export_dir->AddressOfNameOrdinals);
- for (i = 0; i < export_dir->NumberOfNames; i++)
- {
- char *string = (char *)module + names[i];
- if (hash == ror13_hash(string))
- {
- WORD nameord = nameords[i];
- DWORD funcrva = funcs[nameord];
- return (FARPROC)((char *)module + funcrva);
- }
- }
- return NULL;
- }
- void __declspec(naked) END_SHELLCODE(void) {}
- int main(int argc, char *argv[])
- {
- FILE* file = fopen("shellcode.bin", "w");
- fwrite(&shell_code, ((int)END_SHELLCODE - (int)shell_code), 1, file);
- fclose(file);
- shell_code();
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement