Shellcode MessageBox in AutoIt + UDF.

[AvengerPL]

Simple MessageBox in AutoIt.

expandcollapse popup

#cs
===========================================================================================
Description ..... Execute MessageBox via shellcode.
Shellcode size .. 51 bytes
Author .......... Avenger
===========================================================================================
-------------------------------------------------------------------------------------------
push 0x0020206f
push 0x6c6c6548
mov ebx, esp
push 0x0020786f
push 0x42656761
push 0x7373654d
mov ecx, esp
xor eax, eax
push eax
push ebx
push ecx
push eax
mov esi, 0x77d7050b
call esi
xor eax, eax
mov eax, 0x7c81caa2
call eax
-------------------------------------------------------------------------------------------
#ce

$SHELLCODE = "0x686F2020006848656C6C" & _
"89E3" & _
"686F7820006861676542684D657373" & _
"89E1" & _
"31C0" & _
"50" & _
"53" & _
"51" & _
"50" & _
"BE0B05D777" & _
"FFD6" & _
"31C0" & _
"B8A2CA817C" & _
"FFD0"

$SHELLCODE_BUFFER = DllStructCreate("BYTE[51]")
$PUT_SHELLCODE_TO_BUFFER = DllStructSetData($SHELLCODE_BUFFER, 1, $SHELLCODE)
$SHELLCODE_EXECUTE = DllCall("user32.dll", "lresult", "CallWindowProc", "ptr", DllStructGetPtr($SHELLCODE_BUFFER))

UDF here: http://autoit.xaa.pl/download/file.php?id=522

Enjoy!

[FireFox]

If this is a script to make autoit crash then it's a good example

[AvengerPL]

Script crash because you must change MessageBox and ExitProcess address in shellcode.

[Shaggi]

Script crash because you must change MessageBox and ExitProcess address in shellcode.

Why call exitprocess from the asm? autoit has to free it's own resources firstly. Also you can use DllCallAddress instead of callwindowproc.

[AvengerPL]

Why call exitprocess from the asm? autoit has to free it's own resources firstly. Also you can use DllCallAddress instead of callwindowproc.

 

ExitProcess shellcode should be performed. Yes, you're right. DllCalAddress also be used.

[guinness]

Have you applied the necessary fixes as stated above?

[AvengerPL]

Have you applied the necessary fixes as stated above?

 

No, because I think it is a good example

[guinness]

No, because I think it is a good example

I think you need to re-read the constructive comments again AvengerPL.

[AvengerPL]

I think you need to re-read the constructive comments again AvengerPL.

 

I'm sorry but my english is not good because I'm from Poland and I use Google Translate to translate your's answers :-)

You could simply write what you mean?

[Shaggi]

ExitProcess shellcode should be performed. Yes, you're right. DllCalAddress also be used.

 

What if... you wanted to continue the program after the messagebox?

A more interesting case where this is useful is, if you create a thread on the assembly instead.

[wakillon]

No, because I think it is a good example

 

If it's a good example, why _GetTickCount function return always 0 and with the next function, i get an APPCRASH for autoit3.exe  ? 

[AvengerPL]

If it's a good example, why _GetTickCount function return always 0 and with the next function, i get an APPCRASH for autoit3.exe  ? 

 

For me everything is working properly.

#include <ShellcodeFunctions.au3>
MsgBox(64,"TickCount",_GetTickCount())
MsgBox(64,"ACP",_GetACP())

[Danyfirex]

your code going to crash. 

try something like this:

expandcollapse popup

#include <winapi.au3>
#include <Memory.au3>



$pRemoteCode = _MemVirtualAlloc(0, 512, $MEM_COMMIT, $PAGE_EXECUTE_READWRITE)
$CodeBuffer = DllStructCreate("byte[512]", $pRemoteCode)
$MessageBoxAddress = DllCall("Kernel32.dll", "ptr", "GetProcAddress", "ptr", _WinAPI_GetModuleHandle("user32.dll"), "str", "MessageBoxW")
$MessageBoxAddress = $MessageBoxAddress[0]


$texto="hola Mundo"
$titulo="Titulo"

 Local $tDataBuffer = DllStructCreate("wchar texto[" & StringLen($texto) + 1 & "]")
Local $tDataBuffer2 = DllStructCreate("wchar titulo[" & StringLen($titulo) + 1 & "]")

    DllStructSetData($tDataBuffer, "texto", $texto)
    DllStructSetData($tDataBuffer2, "titulo", $titulo)


Local $Opcode
$Opcode &= "0x"
$Opcode &= "68" & SwapEndian(2)
$Opcode &= "68" & SwapEndian(DllStructGetPtr($tDataBuffer2, 1))
$Opcode &= "68" & SwapEndian(DllStructGetPtr($tDataBuffer, 1))
$Opcode &= "68" & SwapEndian(0)
$Opcode &= "B8" & SwapEndian($MessageBoxAddress)
$Opcode &= "FFD0"
$Opcode &= "C3"

DllStructSetData($CodeBuffer, 1, $Opcode)


;Local $Ret = DllCall("user32.dll", "int", "CallWindowProc", "ptr", DllStructGetPtr($CodeBuffer), "int", 0, "int", 0, "int", 0, "int", 0)

local $Ret=DllCallAddress("int",DllStructGetPtr($CodeBuffer))
Consolewrite(@CRLF  & $Ret[0] & @CRLF)

Msgbox(0,"","Normal Msgbox")

Func SwapEndian($hex)
    Return Hex(Binary($hex))
EndFunc   ;==>SwapEndian

if you want only OP-code should be Dynamically code.

saludos

Edited May 13, 2013 by Danyfirex

[Shaggi]

your code going to crash. 

try something like this:

expandcollapse popup

#include <winapi.au3>
#include <Memory.au3>



$pRemoteCode = _MemVirtualAlloc(0, 512, $MEM_COMMIT, $PAGE_EXECUTE_READWRITE)
$CodeBuffer = DllStructCreate("byte[512]", $pRemoteCode)
$MessageBoxAddress = DllCall("Kernel32.dll", "ptr", "GetProcAddress", "ptr", _WinAPI_GetModuleHandle("user32.dll"), "str", "MessageBoxW")
$MessageBoxAddress = $MessageBoxAddress[0]


$texto="hola Mundo"
$titulo="Titulo"

 Local $tDataBuffer = DllStructCreate("wchar texto[" & StringLen($texto) + 1 & "]")
Local $tDataBuffer2 = DllStructCreate("wchar titulo[" & StringLen($titulo) + 1 & "]")

    DllStructSetData($tDataBuffer, "texto", $texto)
    DllStructSetData($tDataBuffer2, "titulo", $titulo)


Local $Opcode
$Opcode &= "0x"
$Opcode &= "68" & SwapEndian(2)
$Opcode &= "68" & SwapEndian(DllStructGetPtr($tDataBuffer2, 1))
$Opcode &= "68" & SwapEndian(DllStructGetPtr($tDataBuffer, 1))
$Opcode &= "68" & SwapEndian(0)
$Opcode &= "B8" & SwapEndian($MessageBoxAddress)
$Opcode &= "FFD0"
$Opcode &= "C3"

DllStructSetData($CodeBuffer, 1, $Opcode)


;Local $Ret = DllCall("user32.dll", "int", "CallWindowProc", "ptr", DllStructGetPtr($CodeBuffer), "int", 0, "int", 0, "int", 0, "int", 0)

local $Ret=DllCallAddress("int",DllStructGetPtr($CodeBuffer))
Consolewrite(@CRLF  & $Ret[0] & @CRLF)

Msgbox(0,"","Normal Msgbox")

Func SwapEndian($hex)
    Return Hex(Binary($hex))
EndFunc   ;==>SwapEndian

if you want only OP-code should be Dynamically code.

saludos

Yeee thats how i like it (have i seen that code before?) 

[Danyfirex]

Yeee thats how i like it (have i seen that code before?) 

sure.  

maybe he should see your good msgbox thread script

 

regards