-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathtest.py
executable file
·66 lines (51 loc) · 1.82 KB
/
test.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/usr/bin/env python3
import sys
import platform
import thunk
ret = b'\xc3'
if platform.system() == 'Darwin':
thunk.doit(ret)
print('--------')
hello_world_x64_macos = \
b'\x48\x8D\x35\x12\x00\x00\x00' + \
b'\xBA\x0E\x00\x00\x00' + \
b'\xBF\x01\x00\x00\x00' + \
b'\xB8\x04\x00\x00\x02' + \
b'\x0F\x05' + \
b'\xC3' + \
b'\x48\x65\x6C\x6C\x6F\x2C\x20\x77\x6F\x72\x6C\x64\x21\x0A'
thunk.doit(hello_world_x64_macos)
elif platform.system() == 'Linux':
thunk.doit(ret)
print('--------')
hello_world_x64_linux = \
b'\x48\x8d\x35\x1d\x00\x00\x00' + \
b'\xba\x0e\x00\x00\x00' + \
b'\xbf\x01\x00\x00\x00' + \
b'\xb8\x01\x00\x00\x00' + \
b'\x0f\x05' + \
b'\xc3\x00\x00\x00\x00' + \
b'\xb8\x3c\x00\x00\x00' + \
b'\x0f\x05' + \
b'\x48\x65\x6c\x6c\x6f\x2c\x20\x77\x6f\x72\x6c\x64\x21\x0a'
thunk.doit(hello_world_x64_linux)
elif platform.system() == 'Windows':
thunk.doit(ret)
print('--------')
# ensure we (host process) has messagebox functions loaded
import ctypes
MessageBoxA = ctypes.windll.user32.MessageBoxA
MessageBoxW = ctypes.windll.user32.MessageBoxW
MessageBoxA(None, b'MessageBoxA', b'MessageBoxA', 0)
hello_msgbox_x64_windows = \
b"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" + \
b"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" + \
b"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" + \
b"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" + \
b"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" + \
b"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" + \
b"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" + \
b"\x49\x0b\x31\xc0\x51\x50\xff\xd7"
thunk.doit(hello_msgbox_x64_windows)
else:
raise Exception('unsupported: %s' % platform.system())