-
Notifications
You must be signed in to change notification settings - Fork 16
/
wDirectSyscall.asm
120 lines (103 loc) · 3 KB
/
wDirectSyscall.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
format MS64 COFF
public go
extrn 'BeaconPrintf' as BeaconPrintf:qword
section '.text' code readable executable align 8
align 8
go:
.STACK_SIZE = 128+8
sub rsp, .STACK_SIZE ; allocate stack space and align it to 16 bytes
mov rax, [gs:0x60] ; PEB address
mov rax, [rax+32] ; ProcessParameters address
mov rax, [rax+72] ; CurrentDirectory.Handle
mov [file_object_attributes.RootDirectory], rax
mov rcx, file_handle
mov edx, FILE_GENERIC_WRITE
mov r8, file_object_attributes
mov r9, file_status_block
mov qword [rsp+32], 0 ; AllocationSize
mov dword [rsp+40], FILE_ATTRIBUTE_NORMAL
mov dword [rsp+48], 0 ; ShareAccess
mov dword [rsp+56], FILE_OVERWRITE_IF ; CreateDisposition
mov dword [rsp+64], FILE_SYNCHRONOUS_IO_NONALERT ; CreateOptions
mov qword [rsp+72], 0 ; EaBuffer
mov dword [rsp+80], 0 ; EaLength
call nt_create_file
mov ecx, 0 ; `type`
mov rdx, str_fmt ; `fmt`
mov r8d, eax ; `...`
call BeaconPrintf ; print result returned from syscall (NTSTATUS)
add rsp, .STACK_SIZE
xor eax, eax ; BOF exit code
ret
; syscall numbers for Windows 10+ x64:
; https://hfiref0x.github.io/NT10_syscalls.html
; https://j00ru.vexillium.org/syscalls/nt/64
align 8
nt_create_file:
mov r10, rcx ; first argument needs to be in 'r10' register
mov eax, 85 ; NtCreateFile syscall number on Windows 10+
syscall
ret
section '.data' data readable writeable align 8
align 8
str_fmt db 'NtCreateFile syscall (called directly) returned: %d', 0xd, 0xa, 0
; https://codeverge.com/utf16-encode
; 'file.txt'
align 8
filename dw 0x0066,0x0069,0x006c,0x0065,0x002e,0x0074,0x0078,0x0074
.SIZE = $ - filename
align 8
file_unicode_string:
.Length dw filename.SIZE
.MaximumLength dw filename.SIZE
dd 0
.ObjectName.Buffer dq filename
align 8
file_object_attributes:
.Length dd .SIZE
dd 0
.RootDirectory dq 0
.ObjectName dq file_unicode_string
.Attributes dd 0
dd 0
.SecurityDescriptor dq 0
.SecurityQualityOfService dq 0
.SIZE = $ - file_object_attributes
align 8
file_status_block:
virtual at $
.Status dd ?
end virtual
virtual at $
.Pointer dq ?
end virtual
dq 0 ; storage for the above union
.Information dq 0
align 8
file_handle dq 0
READ_CONTROL = 0x00020000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_WRITE = READ_CONTROL
FILE_READ_DATA = 0x0001
FILE_READ_EA = 0x0008
FILE_READ_ATTRIBUTES = 0x0080
FILE_WRITE_DATA = 0x0002
FILE_WRITE_EA = 0x0010
FILE_WRITE_ATTRIBUTES = 0x0100
FILE_APPEND_DATA = 0x0004
FILE_GENERIC_READ = STANDARD_RIGHTS_READ or\
FILE_READ_DATA or\
FILE_READ_ATTRIBUTES or\
FILE_READ_EA or\
SYNCHRONIZE
FILE_GENERIC_WRITE = STANDARD_RIGHTS_WRITE or\
FILE_WRITE_DATA or\
FILE_WRITE_ATTRIBUTES or\
FILE_WRITE_EA or\
FILE_APPEND_DATA or\
SYNCHRONIZE
SYNCHRONIZE = 0x00100000
STANDARD_RIGHTS_REQUIRED = 0x000F0000
FILE_ATTRIBUTE_NORMAL = 0x00000080
FILE_OVERWRITE_IF = 0x00000005
FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020