0

I am writing a simple assembly program that will just execute windows commands. I will attach the current working code below. The code works if I hard code the base address of WinExec which is a function from Kernel32.dll, I used another program called Arwin to locate this address. However a reboot breaks this because of the windows memory protection Address Space Layout randomization (ASLR)

What I am looking to do is find a way to execute windows shell commands without having to hard code a memory address into my code that will change at the next reboot. I have found similar code around but nothing that I either understand or fits the purpose. I know this can be written in C but I am specifically using assembler to keep the size as small as possible.

Thanks for you advice/help.

;Just runs a simple netstat command.
;compile with nasm -f bin cmd.asm -o cmd.bin

[BITS 32]

global _start

section .text

_start:
jmp short command        


function:                 ;Label 
;WinExec("Command to execute",NULL)
pop     ecx
xor     eax,eax
push    eax
push    ecx
mov     eax,0x77e6e5fd  ;Address found by arwin for WinExec in Kernel32.dll
call    eax

xor eax,eax
push    eax
mov eax,0x7c81cafa
call    eax

command:                  ;Label
call function
db "cmd.exe /c netstat /naob"
db 0x00
JohnSmith
  • 63
  • 1
  • 9

1 Answers1

1

Just an update to say I found a way for referencing windows API hashes to perform any action I want in the stack. This negates the need to hard code memory addresses and allows you to write dynamic shellcode.

There are defenses against this however this would still work against the myriad of un-patched and out of date machines still around.

The following two sites were useful in finding what I needed:

http://blog.harmonysecurity.com/2009_08_01_archive.html

https://www.scriptjunkie.us/2010/03/shellcode-api-hashes/

JohnSmith
  • 63
  • 1
  • 9