diff --git a/external/source/shellcode/windows/x86/build.py b/external/source/shellcode/windows/x86/build.py index ad8ef97384..4380f4b382 100644 --- a/external/source/shellcode/windows/x86/build.py +++ b/external/source/shellcode/windows/x86/build.py @@ -104,6 +104,9 @@ def main( argv=None ): for root, dirs, files in os.walk( "./src/stager/" ): for name in files: build( name[:-4] ) + for root, dirs, files in os.walk( "./src/kernel/" ): + for name in files: + build( name[:-4] ) else: build( argv[1] ) except Exception, e: diff --git a/external/source/shellcode/windows/x86/src/kernel/stager_sysenter_hook.asm b/external/source/shellcode/windows/x86/src/kernel/stager_sysenter_hook.asm index 49122edc2a..ad4e7957ca 100644 --- a/external/source/shellcode/windows/x86/src/kernel/stager_sysenter_hook.asm +++ b/external/source/shellcode/windows/x86/src/kernel/stager_sysenter_hook.asm @@ -3,8 +3,13 @@ ; Compatible: Windows 7, 2008, Vista (Possibly 2003, XP) ; Size: 202 bytes ; Build: >build.py stager_sysenter_hook +; ; Recommended Reading: Kernel-mode Payloads on Windows, 2005, bugcheck & skape. ; http://www.uninformed.org/?v=3&a=4&t=sumry +; +; Description of the implementation of this stager_sysenter_hook shellcode: +; http://www.harmonysecurity.com/blog/2009/11/implementing-win32-kernel-shellcode.html +; ;-----------------------------------------------------------------------------; [bits 32] [org 0]