metasploit-framework/lib/metasm/samples/shellcode-dynlink.rb

#    This file is part of Metasm, the Ruby assembly manipulation suite
#    Copyright (C) 2006-2009 Yoann GUILLOT
#
#    Licence is LGPL, see LICENCE in the top-level directory

# this script compiles a source file (asm or C) into a shellcode that will
# dynamically resolve the address of functions it uses
# windows only, supposes the shellcode is run in the address space of a process
# whose PEB allows to find all required libraries.

require 'metasm'

sc = Metasm::Shellcode.new(Metasm::Ia32.new)

case ARGV[0]
when /\.c(pp)?$/i
 	src_c = File.read(ARGV[0])
	sc.assemble 'jmp main'
	sc.compile_c src_c
when /\.asm$/i
	src = File.read(ARGV[0])
	sc.assemble src
when nil; abort "need sourcefile"
else abort "unknown srcfile extension"
end

# find external symbols needed by the shellcode
ext_syms = sc.encoded.reloc_externals

# resolver code
sc.parse <<EOS
get_libbase:
	mov eax, fs:[0x30]	// peb
	mov eax, [eax+12]	// peb_ldr
	add eax, 12		// &inloadorder
libbase_loop:
	mov eax, [eax]		// next
	mov edx, [eax+12*4]	// basename ptr
	mov cl, [edx+6]
	shl ecx, 8
	mov cl, [edx+4]
	shl ecx, 8
	mov cl, [edx+2]
	shl ecx, 8
	mov cl, [edx]
	or ecx, 0x20202020	// downcase
	cmp ecx, [esp+4]
	jnz libbase_loop
	mov eax, [eax+6*4]	// baseaddr
	ret 4

hash_name:
	push ecx
	push edx
	xor eax, eax
	xor ecx, ecx
	mov edx, [esp+12]
	dec edx
hash_loop:
	ror eax, 0dh
	add eax, ecx
	inc edx
	mov cl, [edx]
	test cl, cl
	jnz hash_loop
	pop edx
	pop ecx
	ret 4

resolve_proc:
	push ecx
	push edx
	push ebp
	push dword ptr [esp+0x14]	// arg_2
	call get_libbase
	mov ebp, eax		// imagebase
	add eax, [eax+0x3c]	// coffhdr
	mov edx, [eax+0x78]	// exportdirectory
	add edx, ebp
	or ecx, -1
resolve_loop:
	inc ecx
	mov eax, [edx+0x20]	// name
	add eax, ebp
	mov eax, [eax+4*ecx]
	add eax, ebp
	push eax
	call hash_name
	cmp eax, [esp+0x10]	// cmp hash(name[i]), arg_1
	jnz resolve_loop
	mov eax, [edx+0x24]	// ord
	add eax, ebp
	movzx ecx, word ptr [eax+2*ecx]
	mov eax, [edx+0x1c]	// func
	add eax, ebp
	mov eax, [eax+4*ecx]	// func[ord[i]]
	add eax, ebp
	pop ebp
	pop edx
	pop ecx
	ret 8
EOS

def hash_name(sym)
	hash = 0
	sym.each_byte { |char|
		hash = (((hash >> 0xd) | (hash << (32-0xd))) + char) & 0xffff_ffff
	}
	hash
end

def lib_name(sym)
	raise "unknown libname for #{sym}" if not lib = Metasm::WindowsExports::EXPORT[sym]
	n = lib.downcase[0, 4].unpack('C*')
	n[0] + (n[1]<<8) + (n[2] << 16) + (n[3] << 24)
end

# encode stub for each symbol
ext_syms.uniq.each { |sym|
	next if sym == 'next_payload'
	sc.parse <<EOS
#{sym}:
	push #{lib_name(sym)}
	push #{hash_name(sym)}
	call resolve_proc
	jmp eax
EOS
}

# marker to the next payload if the payload is a stager
sc.assemble "next_payload:"

# output to a file
sc.encode_file 'shellcode-dynlink.raw'

__END__
// sample payload

extern __stdcall int MessageBoxA(int, char*, char*, int);
extern void next_payload(void);

int main(void)
{
	MessageBoxA(0, "Hello, world !", "Hi", 0);
	next_payload();
}