shellcode.c

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char* argv[])
{
	// Our shellcode buffer.
	DWORD previous;
	unsigned char *scbuffer, *start;
	size_t szbuf, i = 0;
	szbuf = 130 * sizeof(unsigned char);

	if(!(scbuffer = (unsigned char*)VirtualAlloc(NULL, szbuf, MEM_RESERVE, PAGE_READWRITE))) { return NULL; }
	VirtualAlloc(scbuffer, szbuf, MEM_COMMIT, PAGE_READWRITE);
	memset(scbuffer, 0, szbuf);

	// Jump Point: entry
	// mov eax, [esp]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x4;
	scbuffer[i++] = 0x24;

	// ret
	scbuffer[i++] = 0xc3;

	// Jump Point: main
	start = (unsigned char*)&(scbuffer[i]);
	// call entry
	scbuffer[i++] = 0xe8;
	scbuffer[i++] = 0xf7;
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xff;

	// EAX = L"procrewriter\0"
	// add eax, wsDllPath - $
	scbuffer[i++] = 0x5;
	scbuffer[i++] = 0x57;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;

	// Stack: 0*4, EBP, caller
	// push DWORD 0x0
	scbuffer[i++] = 0x68;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;

	// Stack: L"procrewriter\0", 0*4, EBP, caller
	// push DWORD eax
	scbuffer[i++] = 0x50;

	// ECX = 0
	// xor ecx, ecx
	scbuffer[i++] = 0x31;
	scbuffer[i++] = 0xc9;

	// ESI = &(PEB) ([FS:0x30])
	// mov esi, [ fs:ecx + 0x30 ]
	scbuffer[i++] = 0x64;
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x71;
	scbuffer[i++] = 0x30;

	// ESI = PEB->Ldr
	// mov esi, [ esi + 0x0C ]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x76;
	scbuffer[i++] = 0xc;

	// ESI = PEB->Ldr.InInitOrder (first module)
	// mov esi, [ esi + 0x1C ]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x76;
	scbuffer[i++] = 0x1c;

	// Jump Point: next_module
	// EBP = InInitOrder[X].base_address
	// mov ebp, [ esi + 0x08 ]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x6e;
	scbuffer[i++] = 0x8;

	// EDI = InInitOrder[X].module_name (unicode string)
	// mov edi, [ esi + 0x20 ]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x7e;
	scbuffer[i++] = 0x20;

	// ESI = InInitOrder[X].flink (next module)
	// mov esi, [ esi]
	scbuffer[i++] = 0x8b;
	scbuffer[i++] = 0x36;

	// modulename[9] == 0 ? strlen("ntdll.dll") == 9
	// cmp [ edi + 9*SZWCHAR ], cl
	scbuffer[i++] = 0x38;
	scbuffer[i++] = 0x4f;
	scbuffer[i++] = 0x12;

	// je set_ntdll
	scbuffer[i++] = 0x74;
	scbuffer[i++] = 0xa;

	// modulename[12] == 0 ? strlen("kernel32.dll") == 12
	// cmp [ edi + 12*SZWCHAR ], cl
	scbuffer[i++] = 0x38;
	scbuffer[i++] = 0x4f;
	scbuffer[i++] = 0x18;

	// No: try next module.
	// jne next_module
	scbuffer[i++] = 0x75;
	scbuffer[i++] = 0xee;

	// jmp begin_calls
	scbuffer[i++] = 0xe9;
	scbuffer[i++] = 0x9;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;

	// Jump Point: set_ntdll
	// L"procrewriter\0", ntdll.base, EBP, caller
	// mov [ esp + 0x4 ], dword ebp
	scbuffer[i++] = 0x89;
	scbuffer[i++] = 0x6c;
	scbuffer[i++] = 0x24;
	scbuffer[i++] = 0x4;

	// jmp next_module
	scbuffer[i++] = 0xe9;
	scbuffer[i++] = 0xe0;
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xff;

	// Jump Point: begin_calls
	// EDI = kernel32.base_address
	// mov edi, dword ebp
	scbuffer[i++] = 0x89;
	scbuffer[i++] = 0xef;

	// EDI = kernel32.LoadLibraryW
	// add edi, dword 0x14913
	scbuffer[i++] = 0x81;
	scbuffer[i++] = 0xc7;
	scbuffer[i++] = 0x13;
	scbuffer[i++] = 0x49;
	scbuffer[i++] = 0x1;
	scbuffer[i++] = 0x0;

	// Stack: L"procrewriter\0", EBP, caller
	// call dword edi
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xd7;

	// EDI = procrewriter.base
	// mov edi, eax
	scbuffer[i++] = 0x89;
	scbuffer[i++] = 0xc7;

	// EDI = procrewriter.Initialize
	// add edi, dword 0x110EB
	scbuffer[i++] = 0x81;
	scbuffer[i++] = 0xc7;
	scbuffer[i++] = 0xeb;
	scbuffer[i++] = 0x10;
	scbuffer[i++] = 0x1;
	scbuffer[i++] = 0x0;

	// Call procrewriter.Initialize(ntdll)
	// call dword edi
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xd7;

	// EDX = Return Code
	// mov edx, eax
	scbuffer[i++] = 0x89;
	scbuffer[i++] = 0xc2;

	// EDI = ntdll.base
	// pop edi
	scbuffer[i++] = 0x5f;

	// EDI = ntdll.RtlExitUserThread
	// add edi, dword 0x57FDC
	scbuffer[i++] = 0x81;
	scbuffer[i++] = 0xc7;
	scbuffer[i++] = 0xdc;
	scbuffer[i++] = 0x7f;
	scbuffer[i++] = 0x5;
	scbuffer[i++] = 0x0;

	// push edx
	scbuffer[i++] = 0x52;

	// call dword edi
	scbuffer[i++] = 0xff;
	scbuffer[i++] = 0xd7;

	// Jump Point: wsDllPath
	// db u('procrewriter.dll'), 0x0, 0x0
	scbuffer[i++] = 0x70;
	scbuffer[i++] = 0x0;

	scbuffer[i++] = 0x72;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x6f;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x63;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x72;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x65;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x77;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x72;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x69;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x74;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x65;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x72;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x2e;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x64;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x6c;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x6c;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;
	scbuffer[i++] = 0x0;

	// Execute code
	VirtualProtect(scbuffer, i, PAGE_EXECUTE_READWRITE, &previous);
	(*(void(*)())start)();
	VirtualFree(scbuffer, 0, MEM_RELEASE);
	return 0;
}