Bueno hice estas dos funciones partiendo de unos codigos asm y shellcode de Karcrack & The Swash.


#cs ----------------------------------------------------------------------------
AutoIt Version: 3.3.8.1
Autor..........: Pink
Script Function...: Kernel32() "kernel32 base address"
Shellcode...... ..:Karcrack
Uso..............:msgbox(0,"",Kernel32())
#ce ----------------------------
;Ejemplo
msgbox(0,"",Kernel32())
Func Kernel32()
$shellcode = "0x8B4C2408565531C0648B70308B760C8B761C8B6E088B7E208B3638471875F3803F6B7407803F4B7402EBE789295D5EC3"
$struct = DllStructCreate("byte["& binarylen($shellcode) & "]")
$Pointer=DllStructCreate("ptr")
DllStructSetData($struct, 1, $shellcode)
DllCall("user32.dll", "lresult", "CallWindowProcW", "ptr",DllStructGetPtr($struct),"int",0,"ptr",DllStructGetPtr($Pointer),"int", 0, "int", 0)
return DllStructGetData($Pointer,1)
EndFunc


#cs ----------------------------------------------------------------------------
AutoIt Version: 3.3.8.1
Autor..........: Pink
Script Function...: Kernel32() "kernel32 base address"
Shellcode...... ..:The Swash
Uso..............:msgbox(0,"",Kernel32())
#ce ----------------------------
;Ejemplo
msgbox(0,"",Kernel32())
Func Kernel32()
$shellcode = "0x64A1300000008B400C8B400C8B008B008b4018C3"
$struct = DllStructCreate("byte["& binarylen($shellcode) & "]")
DllStructSetData($struct, 1, $shellcode)
$Pointer=DllCall("user32.dll", "ptr", "CallWindowProcW", "ptr",DllStructGetPtr($struct),"int",0,"int",0,"int", 0, "int", 0)
return $Pointer[0]
EndFunc
saludos
Imagen
Responder

Volver a “Fuentes”