ShellCode Kernel32

// ShellCode que obtiene la direccion de Kernel32.DLL en el proceso
// Programada por Juan fary (mDrinky)
// [email protected]

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

char code[] = "\x31\xFF\x64\x03\x7F\x30\x8B\x7F\x0C\x8B\x7F\x1C\x8B\x3F\x8B\x57"\
              "\x20\x8B\x4F\x08\x52\x51\x57\x56\xE8\x00\x00\x00\x00\x5B\x81\xEB"\
              "\x1D\x10\x40\x00\x53\x59\x81\xC1\x8A\x10\x40\x00\x53\x81\xC3\x46"\
              "\x10\x40\x00\x51\x52\xFF\xD3\x5B\x5E\x5F\x59\x5A\x8B\x3F\x83\xF8"\
              "\x01\x75\xCB\x89\xC8\xC3\xE8\x00\x00\x00\x00\x5B\x81\xEB\x4B\x10"\
              "\x40\x00\x81\xC3\x62\x10\x40\x00\x55\x89\xE5\x8B\x75\x08\x8B\x4D"\
              "\x0C\x49\x41\xAC\x38\x01\x75\x0D\x3C\x00\x74\x02\xFF\xE3\x80\x39"\
              "\x00\x74\x0B\x75\x00\xB8\x00\x00\x00\x00\x5D\xC2\x08\x00\xB8\x01"\
              "\x00\x00\x00\x5D\xC2\x08\x00\x0A\x0D\x00\x6B\x00\x65\x00\x72\x00"\
              "\x6E\x00\x65\x00\x6C\x00\x33\x00\x32\x00\x2E\x00\x64\x00\x6C\x00\x6C\x00";

int main()
{
        int (*func)();
        func = (int (*)()) code;
        printf("Kernel32 Shellcode: 0x%x\n",(int)(*func)());
        printf("KernelGetModuleHandle: 0x%x\n",GetModuleHandle("KERNEL32.DLL"));
        system("PAUSE");
        
        return 0;
}

; mDrinky

format PE Console
 
include 'win32ax.inc'
entry start
 
section '.text' code readable executable
start:
;db 0x31,0xFF,0x64,0x03,0x7F,0x30,0x8B,0x7F,0x0C,0x8B,0x7F,0x1C,0x8B,0x3F,0x8B,0x57
;db 0x20,0x8B,0x4F,0x08,0x52,0x51,0x57,0x56,0xE8,0x00,0x00,0x00,0x00,0x5B,0x81,0xEB
;db 0x1D,0x10,0x40,0x00,0x53,0x59,0x81,0xC1,0x88,0x10,0x40,0x00,0x53,0x81,0xC3,0x44
;db 0x10,0x40,0x00,0x51,0x52,0xFF,0xD3,0x5B,0x5E,0x5F,0x59,0x5A,0x8B,0x3F,0x83,0xF8
;db 0x01,0x75,0xCB,0xC3,0xE8,0x00,0x00,0x00,0x00,0x5B,0x81,0xEB,0x49,0x10,0x40,0x00
;db 0x81,0xC3,0x60,0x10,0x40,0x00,0x55,0x89,0xE5,0x8B,0x75,0x08,0x8B,0x4D,0x0C,0x49
;db 0x41,0xAC,0x38,0x01,0x75,0x0D,0x3C,0x00,0x74,0x02,0xFF,0xE3,0x80,0x39,0x00,0x74
;db 0x0B,0x75,0x00,0xB8,0x00,0x00,0x00,0x00,0x5D,0xC2,0x08,0x00,0xB8,0x01,0x00,0x00
;db 0x00,0x5D,0xC2,0x08,0x00,0x0A,0x0D,0x00,0x6B,0x00,0x65,0x00,0x72,0x00,0x6E,0x00
;db 0x65,0x00,0x6C,0x00,0x33,0x00,0x32,0x00,0x2E,0x00,0x64,0x00,0x6C,0x00,0x6C,0x00
;db 0x00

       xor edi,edi
       add edi,[fs:edi+30h]
       mov edi,[edi+0ch]
       mov edi,[edi+1ch]
       mov edi,[edi]
 
       next_module:
 
       mov edx,[edi+0x20]
       mov ecx,[edi+0x8]
 
       push edx
       push ecx
       push edi ;..
       push esi ;..

       call offset1
       offset1:
       pop ebx
       sub ebx,offset1

       push ebx
       pop ecx  ; Para calcular kernel
       add ecx,Kernel

       push ebx ; guardamos delta

       add ebx,CompararCadenas

       push ecx
       push edx
       call ebx ; Funcion comparar

       ;stdcall ebx,edx,ecx

       pop ebx  ; salvamos el delta

       pop esi ;..
       pop edi ;..
       pop ecx
       pop edx
 
       mov edi,[edi]

       ;add ebx,next_module

       cmp eax,1
       jne next_module

       mov eax,ecx   ; EAX = KERNEL32.DLL


       cinvoke printf,"Mediante el PEB: %x",eax;ecx
       cinvoke printf,salto
 
       cinvoke GetModuleHandleW,Kernel
       cinvoke printf,"Mediante GetModuleHandle: %x",eax
       cinvoke printf,salto
 
 
       ret

CompararCadenas:
        ; registros que usa EAX, ECX, ESI, EDI, EBX

        call offset2   ; delta offset
        offset2:
        pop ebx
        sub ebx,offset2

        add ebx, bucle   ; delta para la etiquta bucle

        push ebp
        mov ebp, esp

        mov esi,dword[ebp+8]
        mov ecx,dword[ebp+12]
        dec ecx
        bucle:
            inc ecx
            lodsb
            cmp byte[ecx],al
            jne diferentes
            cmp al,0
            je comprobar
            jmp ebx
        comprobar:
            cmp byte[ecx],0
            je iguales
            jne diferentes
        diferentes:
            mov eax,0
            pop ebp
            ret 8
        iguales:
            mov eax,1
            pop ebp
            ret 8

       salto              db 10,13,0
       Kernel             db 0x6B,0x00,0x65,0x00,0x72,0x00,0x6E,0x00,0x65,0x00,0x6C,0x00,0x33,0x00,0x32,0x00,0x2E,0x00,0x64,0x00,0x6C,0x00,0x6C,0x00,0x00,0x00

section '.idata' import data readable writeable
        library MSVCRT,'msvcrt.dll',\
                KERNEL32,'KERNEL32.DLL'
 
        import MSVCRT,printf,'printf'
 
        import KERNEL32,lstrcmpW,'lstrcmpW',\
               GetModuleHandleW,'GetModuleHandleW'         

cinvoke GetModuleHandleW,Kernel

invoke GetModuleHandleW,Kernel

db 0x64,0x8B,0x40,0x30,0x8B,0x40,0x0C,0x8D,0x40,0x14,0x31,0xC0,0x64,0x8B,0x40,0x30
db 0x8B,0x40,0x0C,0x8B,0x40,0x14,0x8B,0x00,0x89,0xC2,0x8B,0x52,0x28,0x80,0x7A,0x0C
db 0x33,0x75,0xF3,0x8B,0x40,0x10 ;,0xC3

; eax = Kernel32.dll