Running windows shell commands NASM X86 Assembly language

Question

I am writing a simple assembly program that will just execute windows commands. I will attach the current working code below. The code works if I hard code the base address of WinExec which is a function from Kernel32.dll, I used another program called Arwin to locate this address. However a reboot breaks this because of the windows memory protection Address Space Layout randomization (ASLR)

What I am looking to do is find a way to execute windows shell commands without having to hard code a memory address into my code that will change at the next reboot. I have found similar code around but nothing that I either understand or fits the purpose. I know this can be written in C but I am specifically using assembler to keep the size as small as possible.

Thanks for you advice/help.

;Just runs a simple netstat command.
;compile with nasm -f bin cmd.asm -o cmd.bin

[BITS 32]

global _start

section .text

_start:
jmp short command        


function:                 ;Label 
;WinExec("Command to execute",NULL)
pop     ecx
xor     eax,eax
push    eax
push    ecx
mov     eax,0x77e6e5fd  ;Address found by arwin for WinExec in Kernel32.dll
call    eax

xor eax,eax
push    eax
mov eax,0x7c81cafa
call    eax

command:                  ;Label
call function
db "cmd.exe /c netstat /naob"
db 0x00

I link it with ld into a windows .exe if I wish to run it manually. However I am mainly using the .bin file to simply generate hex code. — JohnSmith
– JohnSmith, Commented Apr 19, 2016 at 7:17

JohnSmith · Accepted Answer · 2016-04-21 03:17:44Z

1

Just an update to say I found a way for referencing windows API hashes to perform any action I want in the stack. This negates the need to hard code memory addresses and allows you to write dynamic shellcode.

There are defenses against this however this would still work against the myriad of un-patched and out of date machines still around.

The following two sites were useful in finding what I needed:

http://blog.harmonysecurity.com/2009_08_01_archive.html

https://www.scriptjunkie.us/2010/03/shellcode-api-hashes/

answered Apr 21, 2016 at 3:17

JohnSmith

631 silver badge9 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Running windows shell commands NASM X86 Assembly language

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related