Writing Manual - Shellcode by Hand.pdf

(1348 KB) Pobierz
Writing Manual
Shellcode by Hand
Overview
Assembly is the language to know when developing buffer
overflow exploits in software exploitation scenarios. This
short document is designed to give an introduction to this
sort of programming language where the Windows API will
be used to demonstrate how it is possible to call a message
box directly by using hardcoded memory addresses.
Contents
Chapter 0 – Prerequisites ..............................................................................................................2
Chapter 1 – Preparing the Environment .....................................................................................3
Chapter 2 – Writing a Dummy Popup ........................................................................................5
Chapter 3 – Writing a “LOL” Popup ........................................................................................10
Chapter 4 – Using the Stack for a Popup ..................................................................................13
Chapter 5 – The Easy Way – Part 1 ...........................................................................................17
Chapter 6 – The Easy Way – Part 2 ...........................................................................................20
Ending Words & References.......................................................................................................28
Page 1
Chapter 0
Prerequisites
Tools
Arwin (http://www.vividmachines.com/shellcode/arwin.c)
Code::Blocks (http://www.codeblocks.org/)
OllyDbg (http://www.ollydbg.de/version2.html)
Goals
Create minimalistic shellcode
Include custom text input
This is for educational purposes only.
Page 2
Chapter 1
Preparing the Environment
First download and install the Code Blocks IDE environment, which you’re going to use to
compile the Arwin source code. Simply download “arwin.c” from the link in the previous
chapter and open this in Code Blocks or your own preferred C compiler.
When you’ve opened this file in Code Blocks, browse to the “Build” menu and choose “Build”.
Figure 1.0.1 – Compiling Arwin.c in Code::Blocks
Page 3
Now you’re ready to use Arwin, which will be located in the same directory as where the source
code is located. Browse to this location in a command prompt window. If the directory is located
deep within your computer, consider copying arwin.exe to a directory near the root.
Then issue the following command without quotes: “arwin.exe User32.dll MessageBoxA”.
When you’ve done this, you’ll be searching for the MessageBoxA function within User32.dll
Figure 1.0.2 – Using Arwin.exe to find the MessageBoxA memory address
If you’ve done this right, you’ll see a text string like: MessageBoxA is located at …
It is important to note, that this address is not static and it is therefore usually not the same on
another machine. If you’re running Windows Vista or 7, then the address will change each time
you reboot your computer. If you’re running certain IPS’s on Windows XP, this will occur too.
After remembering these precautions, note down the memory address Arwin returned.
In our shellcode we’re going to assume User32.dll is already loaded within the given executable
which we are injecting our own shellcode into directly and manually. A file which already has
this DLL file loaded when it is run is: GenuineCheck.exe
You can of course, use other files as well but I will be using this executable as an example.
(Any executable file with a graphical user interface should have User32.dll loaded.)
Page 4

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin