FilesExpand file tree

 master

/

Shellcode_Checksum_Routine.c

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

executable file

·

45 lines (34 loc) · 1.54 KB

 master

/

Shellcode_Checksum_Routine.c

Copy path

Top

File metadata and controls

• Code
• Blame

executable file

·

45 lines (34 loc) · 1.54 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

;Exploit Title: Shellcode Checksum Routine

;Date: Sept 1 2010

;Author: dijital1

;Software Link: http://www.ciphermonk.net/code/exploits/shellcode-checksum.asm

;Tested on: Omelet Hunter Shellcode in MSF

[BITS 32]

;Author: Ron Henry - dijital1

;Email: rlh@ciphermonk.net

;Site: http://www.ciphermonk.net

;Greetz to Exploit-db and Team Corelan

;Ok... couple of assumptions with this code. First, we're using a single

;byte as the checksum which gives us a 1 in 255 or ~0.39% chance of a

;collision.

;We consider this a worthwhile risk given the overall size of the code; 18 bytes.

;There are a couple ways to implement this, but a good example is how it

;was used in Peter Van Eeckhoutte's omelet egghunter mixin that was recently

;added to the Metasploit Framework.

;We're using a 1 byte footer at the end of the shellcode that contains the

;checksum generated at shellcode creation.

; Variables eax: accumulator

; edx: points to current byte in shellcode

; ecx: counter

egg_size equ 0x7a ;we're testing 122 bytes in this instance

find_egg:

xor ecx, ecx ;zero the counter

xor eax, eax ;zero the accumlator

calc_chksum_loop:

add al, byte [edx+ecx] ;add the byte to running total

inc ecx ;increment the counter

cmp cl, egg_size ;cmp counter to egg_size

jnz calc_chksum_loop ;if it's not equal repeat

test_ckksum:

cmp al, byte [edx+ecx] ;cmp eax with 1 byte checksum

jnz find_egg ;search for another egg if checksum is bogus