forked from ohjeongwook/RunShellcode
-
Notifications
You must be signed in to change notification settings - Fork 0
/
RunShellcode.cpp
111 lines (91 loc) · 3.04 KB
/
RunShellcode.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
// InjectShellcode.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <Windows.h>
#include <tchar.h>
#include <stdio.h>
#include <strsafe.h>
#define BUFFERSIZE 1024
void display_error(LPTSTR lpszFunction)
{
LPVOID lp_message_buffer;
LPVOID lp_display_buffer;
DWORD dw = GetLastError();
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
dw,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR)&lp_message_buffer,
0,
NULL);
lp_display_buffer =
(LPVOID)LocalAlloc(LMEM_ZEROINIT,
(lstrlen((LPCTSTR)lp_message_buffer)
+ lstrlen((LPCTSTR)lpszFunction)
+ 40) // account for format string
* sizeof(TCHAR));
if (FAILED(StringCchPrintf((LPTSTR)lp_display_buffer,
LocalSize(lp_display_buffer) / sizeof(TCHAR),
TEXT("%s failed with error code %d as follows:\n%s"),
lpszFunction,
dw,
lp_message_buffer)))
{
printf("FATAL ERROR: Unable to output error code.\n");
}
_tprintf(TEXT("ERROR: %s\n"), (LPCTSTR)lp_display_buffer);
LocalFree(lp_message_buffer);
LocalFree(lp_display_buffer);
}
int wmain(int argc, WCHAR *argv[])
{
if (argc < 2)
{
printf("Usage: %s <shellcode file>", argv[0]);
exit(0);
}
printf("Opening %S\n", argv[1]);
HANDLE file_handle = CreateFile(
argv[1], // file to open
GENERIC_READ, // open for reading
FILE_SHARE_READ, // share for reading
NULL, // default security
OPEN_EXISTING, // existing file only
FILE_ATTRIBUTE_NORMAL, // normal file
NULL); // no attr. template
if (file_handle == INVALID_HANDLE_VALUE)
{
display_error(TEXT("CreateFile"));
_tprintf(TEXT("Terminal failure: unable to open file \"%s\" for read.\n"), argv[1]);
return -1;
}
LARGE_INTEGER file_size;
GetFileSizeEx(file_handle, &file_size);
DWORD shellcodeSize = file_size.LowPart;
BYTE *p_shellcode_buffer = reinterpret_cast<BYTE*>(VirtualAlloc(NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE));
if (!p_shellcode_buffer)
{
printf("Failed to allocate %d\n", shellcodeSize);
return -1;
}
printf("Allocated %d bytes at @%p\n", shellcodeSize, p_shellcode_buffer);
DWORD read_bytes;
DWORD offset = 0;
char ReadBuffer[BUFFERSIZE] = { 0 };
while (ReadFile(file_handle, ReadBuffer, BUFFERSIZE - 1, &read_bytes, NULL) == TRUE && read_bytes>0)
{
memcpy(p_shellcode_buffer + offset, reinterpret_cast<BYTE*>(ReadBuffer), read_bytes);
offset += read_bytes;
}
printf("Read %d bytes\n", offset);
int(*shellcode_ptr)() = (int(__cdecl *)(void))p_shellcode_buffer;
printf("Calling function pointer: %p\n", shellcode_ptr);
_asm {
int 3;
}
shellcode_ptr();
return 0;
}