Win32 Shellcoding Enviornment Setup
2 minute read
Enviornment Setup
Operating System
- Windows XP Professional - 32-bit - Version 2002 - Service Pack 3
Debuggers
- Immunity Debugger v1.85 - 32-bit
- WinDbg 6.12.0002.633 x86 - Version 5.1 (Build 2600.xpsp.080413-2111: Service Pack 3)
Compilers
- PuTTY 0.73 - 32-bit x86
- Used to SSH to Host computer within the Windows XP VM
- python 2.7.3 - 32-bit
- Required for immunity Debugger Mona plugin
- BETA 3 v1.1
- arwin
- Used to find addresses of functions (symbols) within DLL’s
- Downloaded arwin.c source code, then compiled locally with MSVS C++ 2008 Express.
Arwin Source Code
#include <windows.h>
#include <stdio.h>
/*
arwin - win32 address resolution program by steve hanna v.01
vividmachines.com
shanna@uiuc.edu
you are free to modify this code but please attribute me if you
change the code. bugfixes & additions are welcome please email me!
to compile:
you will need a win32 compiler with the win32 SDK
this program finds the absolute address of a function in a specified DLL.
happy shellcoding!
*/
int main(int argc, char** argv)
{
HMODULE hmod_libname;
FARPROC fprc_func;
printf("arwin - win32 address resolution program - by steve hanna - v.01\n");
if(argc < 3)
{
printf("%s <Library Name> <Function Name>\n",argv[0]);
exit(-1);
}
hmod_libname = LoadLibrary(argv[1]);
if(hmod_libname == NULL)
{
printf("Error: could not load library!\n");
exit(-1);
}
fprc_func = GetProcAddress(hmod_libname,argv[2]);
if(fprc_func == NULL)
{
printf("Error: could find the function in the library!\n");
exit(-1);
}
printf("%s is located at 0x%08x in %s\n",argv[2],(unsigned int)fprc_func,argv[1]);
}
Testing Win32 Shellcode
- This program can be used to test windows 32-bit shellcode.
- Use the lcc-win32 program to compile the shellcode.
- Compiling with dev-cpp will launch 100+ failing processes of the program in an endless loop.
// Replace the NOP's with your shellcode
char code[] ="\x90\x90\x90\x90\x90\x90\x90\x90\x90"
int main(int argc, char **argv)
{
int (*func)();
func = (int(*)()) code;
(int)(*func)();
}
- Compile and then run the program to test out your shellcode.
Resources
