├── .gitignore
├── .gitmodules
├── README.md
├── cc_shellcode.sln
├── cc_shellcode.v12.suo
├── cc_shellcode
├── cc_shellcode.vcxproj
├── cc_shellcode.vcxproj.filters
├── cc_shellcode.vcxproj.user
└── src
│ └── main.cpp
└── imports.def
/.gitignore:
--------------------------------------------------------------------------------
1 | # Windows image file caches
2 | Thumbs.db
3 | ehthumbs.db
4 |
5 | # Folder config file
6 | Desktop.ini
7 |
8 | # Recycle Bin used on file shares
9 | $RECYCLE.BIN/
10 |
11 | # Windows Installer files
12 | *.cab
13 | *.msi
14 | *.msm
15 | *.msp
16 |
17 | # =========================
18 | # Operating System Files
19 | # =========================
20 |
21 | # OSX
22 | # =========================
23 |
24 | .DS_Store
25 | .AppleDouble
26 | .LSOverride
27 |
28 | # Icon must ends with two \r.
29 | Icon
30 |
31 | # Thumbnails
32 | ._*
33 |
34 | # Files that might appear on external disk
35 | .Spotlight-V100
36 | .Trashes
37 | # Compiled Object files
38 | *.slo
39 | *.lo
40 | *.o
41 | *.obj
42 |
43 | # Precompiled Headers
44 | *.gch
45 | *.pch
46 |
47 | # Compiled Dynamic libraries
48 | *.so
49 | *.dylib
50 | *.dll
51 |
52 | # Fortran module files
53 | *.mod
54 |
55 | # Compiled Static libraries
56 | *.lai
57 | *.la
58 | *.a
59 | *.lib
60 |
61 | # Executables
62 | *.exe
63 | *.out
64 | *.app
65 |
66 | *.tlog
67 | *.inf
68 | *.cer
69 | *.pdb
70 | *.sys
71 | *.log
--------------------------------------------------------------------------------
/.gitmodules:
--------------------------------------------------------------------------------
1 | [submodule "Common"]
2 | path = Common
3 | url = https://github.com/k33nteam/Common.git
4 | [submodule "LIBC"]
5 | path = LIBC
6 | url = https://github.com/k33nteam/LIBC.git
7 | [submodule "LOADER"]
8 | path = LOADER
9 | url = https://github.com/k33nteam/LOADER.git
10 | [submodule "CVE"]
11 | path = CVE
12 | url = https://github.com/k33nteam/CVE.git
13 | [submodule "Core"]
14 | path = Core
15 | url = https://github.com/k33nteam/Core.git
16 | [submodule "boost"]
17 | path = boost
18 | url = https://github.com/boostorg/boost
19 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | CC-SHELLCODING framework
2 | ==========================
3 |
4 | **info**
5 |
6 | - http://www.k33nteam.org/blog.htm -
7 | - CC-SHELLCODING
8 |
9 | **branches**
10 |
11 | - master, including boost
12 | - lights, without boost, all boost dependencies should be carried by you (clone apropriate libs)
13 |
14 | **requirements**
15 |
16 | - Visual Studio 2013
17 | - python 2.7 x86
18 |
19 | **note**
20 |
21 | - for playing with imports look at CreateLoader.py
22 | - imports dependet files : imports.def, imports.ii, ImportDeclaration.h, ImportWrapper.hpp, usr_imports.asm
23 |
--------------------------------------------------------------------------------
/cc_shellcode.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 2013
4 | VisualStudioVersion = 12.0.21005.1
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cc_shellcode", "cc_shellcode\cc_shellcode.vcxproj", "{A24AE05E-430D-4699-8141-4C37E761DA12}"
7 | EndProject
8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libc", "LIBC\libc.vcxproj", "{6B090B01-76A1-4521-902D-6011FE9AA4ED}"
9 | EndProject
10 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "loader", "LOADER\loader.vcxproj", "{8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}"
11 | EndProject
12 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE", "CVE\CVE.vcxproj", "{444C9878-7D1A-4028-8416-3C7D8672FDEB}"
13 | EndProject
14 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Core", "Core\Core.vcxproj", "{8F56699B-2357-48BC-A739-D831F3421C97}"
15 | EndProject
16 | Global
17 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
18 | Debug|Mixed Platforms = Debug|Mixed Platforms
19 | Debug|Win32 = Debug|Win32
20 | Debug|x64 = Debug|x64
21 | Release|Mixed Platforms = Release|Mixed Platforms
22 | Release|Win32 = Release|Win32
23 | Release|x64 = Release|x64
24 | EndGlobalSection
25 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
26 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
27 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Mixed Platforms.Build.0 = Debug|Win32
28 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Win32.ActiveCfg = Debug|Win32
29 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Win32.Build.0 = Debug|Win32
30 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|x64.ActiveCfg = Debug|Win32
31 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Mixed Platforms.ActiveCfg = Release|Win32
32 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Mixed Platforms.Build.0 = Release|Win32
33 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Win32.ActiveCfg = Release|Win32
34 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Win32.Build.0 = Release|Win32
35 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.ActiveCfg = Release|x64
36 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.Build.0 = Release|x64
37 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.Deploy.0 = Release|x64
38 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
39 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Mixed Platforms.Build.0 = Debug|Win32
40 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Win32.ActiveCfg = Debug|Win32
41 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Win32.Build.0 = Debug|Win32
42 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.ActiveCfg = Debug|x64
43 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.Build.0 = Debug|x64
44 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.Deploy.0 = Debug|x64
45 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Mixed Platforms.ActiveCfg = Release|Win32
46 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Mixed Platforms.Build.0 = Release|Win32
47 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Win32.ActiveCfg = Release|Win32
48 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Win32.Build.0 = Release|Win32
49 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.ActiveCfg = Release|x64
50 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.Build.0 = Release|x64
51 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.Deploy.0 = Release|x64
52 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
53 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Mixed Platforms.Build.0 = Debug|Win32
54 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Win32.ActiveCfg = Debug|Win32
55 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Win32.Build.0 = Debug|Win32
56 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|x64.ActiveCfg = Debug|Win32
57 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Mixed Platforms.ActiveCfg = Release|Win32
58 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Mixed Platforms.Build.0 = Release|Win32
59 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Win32.ActiveCfg = Release|Win32
60 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Win32.Build.0 = Release|Win32
61 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.ActiveCfg = Release|x64
62 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.Build.0 = Release|x64
63 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.Deploy.0 = Release|x64
64 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
65 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Mixed Platforms.Build.0 = Debug|Win32
66 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Win32.ActiveCfg = Debug|Win32
67 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Win32.Build.0 = Debug|Win32
68 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|x64.ActiveCfg = Debug|x64
69 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|x64.Build.0 = Debug|x64
70 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Mixed Platforms.ActiveCfg = Release|Win32
71 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Mixed Platforms.Build.0 = Release|Win32
72 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.ActiveCfg = Release|Win32
73 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.Build.0 = Release|Win32
74 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.Deploy.0 = Release|Win32
75 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.ActiveCfg = Release|x64
76 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.Build.0 = Release|x64
77 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.Deploy.0 = Release|x64
78 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
79 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Mixed Platforms.Build.0 = Debug|Win32
80 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Win32.ActiveCfg = Debug|Win32
81 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Win32.Build.0 = Debug|Win32
82 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|x64.ActiveCfg = Debug|x64
83 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|x64.Build.0 = Debug|x64
84 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Mixed Platforms.ActiveCfg = Release|Win32
85 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Mixed Platforms.Build.0 = Release|Win32
86 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Win32.ActiveCfg = Release|Win32
87 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Win32.Build.0 = Release|Win32
88 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|x64.ActiveCfg = Release|x64
89 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|x64.Build.0 = Release|x64
90 | EndGlobalSection
91 | GlobalSection(SolutionProperties) = preSolution
92 | HideSolutionNode = FALSE
93 | EndGlobalSection
94 | EndGlobal
95 |
--------------------------------------------------------------------------------
/cc_shellcode.v12.suo:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/k33nteam/cc-shellcoding/HEAD/cc_shellcode.v12.suo
--------------------------------------------------------------------------------
/cc_shellcode/cc_shellcode.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Debug
10 | x64
11 |
12 |
13 | Release
14 | Win32
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | {A24AE05E-430D-4699-8141-4C37E761DA12}
23 | Win32Proj
24 | cc_shellcode
25 |
26 |
27 |
28 | Application
29 | true
30 | v120
31 | Unicode
32 |
33 |
34 | Application
35 | true
36 | v120
37 | Unicode
38 |
39 |
40 | Application
41 | false
42 | v120_xp
43 | true
44 | Unicode
45 | Static
46 |
47 |
48 | Application
49 | false
50 | v120
51 | true
52 | Unicode
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 | true
73 |
74 |
75 | true
76 |
77 |
78 | false
79 | false
80 | $(SolutionDir)/out/
81 |
82 |
83 | false
84 | false
85 | false
86 | .exe
87 |
88 |
89 |
90 |
91 |
92 | Level3
93 | Disabled
94 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
95 | true
96 |
97 |
98 | Console
99 | true
100 |
101 |
102 |
103 |
104 |
105 |
106 | Level3
107 | Disabled
108 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
109 | true
110 |
111 |
112 | Console
113 | true
114 |
115 |
116 |
117 |
118 | Level3
119 |
120 |
121 | MinSpace
122 | true
123 | true
124 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
125 | true
126 | $(WindowsSDKDir)\Include\um\;$(WindowsSDKDir)\Include\shared\;$(SolutionDir);%(AdditionalIncludeDirectories);$(SolutionDir)/boost/libs/integer/include;$(SolutionDir)/boost/libs/functional/include;$(SolutionDir)/boost/libs/detail/include;$(SolutionDir)/boost/libs/move/include;$(SolutionDir)/boost/libs/intrusive/include;$(SolutionDir)/boost/libs/static_assert/include;$(SolutionDir)/boost/libs/preprocessor/include;$(SolutionDir)/boost/libs/mpl/include;$(SolutionDir)/boost/libs/type_traits/include;$(SolutionDir)/boost/libs/exception/include;$(SolutionDir)/boost/libs/utility/include;$(SolutionDir)/boost/libs/config/include;$(SolutionDir)/boost/libs/assert/include;$(SolutionDir)/boost/libs/smart_ptr/include;$(SolutionDir)/boost/
127 | false
128 | Size
129 | false
130 | false
131 | StreamingSIMDExtensions2
132 | false
133 | false
134 | false
135 |
136 | false
137 | MultiThreaded
138 | false
139 | StdCall
140 | Default
141 |
142 |
143 | Console
144 | true
145 | true
146 | true
147 | true
148 | libcmt.lib; mscvrt.lib
149 | Main
150 |
151 | false
152 | 4096
153 | false
154 | $(SolutionDir)cve\$(Configuration)\;
155 | $(SolutionDir)loader\$(Configuration)\usr_imports.obj;Gate.obj;Door.obj;$(WindowsSDKDir)\Lib\winv6.3\km\x86\libcntpr.lib;
156 | false
157 | false
158 | $(SolutionDir)imports.def
159 | /FILEALIGN:4096 %(AdditionalOptions)
160 |
161 |
162 |
163 |
164 | Level3
165 |
166 |
167 | MinSpace
168 | true
169 | true
170 | _WIN64;_AMD64_;AMD64;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
171 | true
172 | $(SolutionDir);$(WindowsSDKDir)\include\km\;%(AdditionalIncludeDirectories);$(SolutionDir)/boost/libs/integer/include;$(SolutionDir)/boost/libs/functional/include;$(SolutionDir)/boost/libs/detail/include;$(SolutionDir)/boost/libs/move/include;$(SolutionDir)/boost/libs/intrusive/include;$(SolutionDir)/boost/libs/static_assert/include;$(SolutionDir)/boost/libs/preprocessor/include;$(SolutionDir)/boost/libs/mpl/include;$(SolutionDir)/boost/libs/type_traits/include;$(SolutionDir)/boost/libs/exception/include;$(SolutionDir)/boost/libs/utility/include;$(SolutionDir)/boost/libs/config/include;$(SolutionDir)/boost/libs/assert/include;$(SolutionDir)/boost/libs/smart_ptr/include;$(SolutionDir)/boost/;
173 | false
174 | false
175 | FastCall
176 | false
177 | false
178 | Size
179 | false
180 |
181 | NotSet
182 | true
183 | false
184 | MultiThreaded
185 |
186 | false
187 | true
188 | false
189 |
190 |
191 | Console
192 | true
193 | true
194 | true
195 | Main
196 | true
197 | libcmt.lib; msvcrt.lib
198 | Gate.obj;Door.obj;
199 | $(SolutionDir)/loader/$(Platform)/$(Configuration)/;$(SolutionDir)/cve/$(Platform)/$(Configuration)/;$(SolutionDir)
200 |
201 | DefaultThreadingAttribute
202 |
203 | false
204 | false
205 | 64
206 |
207 |
208 | false
209 |
210 |
211 |
212 |
213 |
214 |
215 |
216 | {444c9878-7d1a-4028-8416-3c7d8672fdeb}
217 |
218 |
219 | {6b090b01-76a1-4521-902d-6011fe9aa4ed}
220 |
221 |
222 | {8eb9e40f-f3cd-469e-83ff-78c7fb2e6dbe}
223 |
224 |
225 |
226 |
227 |
228 |
229 |
--------------------------------------------------------------------------------
/cc_shellcode/cc_shellcode.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
--------------------------------------------------------------------------------
/cc_shellcode/cc_shellcode.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | TestSign
5 | CN="WDKTestCert zer0mem,130478420001425861" | CE6D60774354F593A55495B6DDA6BAC1EA809F2F
6 |
7 |
--------------------------------------------------------------------------------
/cc_shellcode/src/main.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | #define USER
5 |
6 | #ifdef USER
7 | #include
8 | #include
9 | #include
10 | #else
11 | #include
12 | #include
13 | #include
14 | #endif
15 |
16 | #include
17 |
18 | #include
19 |
20 | //all final compilation settings are set in this lib
21 | //code it is just wrapper to your custom Project (CVE) which exports exploit function!
22 |
23 | #include
24 |
25 | bool
26 | main()
27 | {
28 | exploit();
29 | return true;
30 | };
31 |
--------------------------------------------------------------------------------
/imports.def:
--------------------------------------------------------------------------------
1 | EXPORTS
2 | _ZwQuerySystemInformation@16
3 | DbgPrint
4 | _RtlInitUnicodeString@8
5 | _IoQueueWorkItem@16
6 | _IoGetDeviceObjectPointer@16
7 | _IoFreeWorkItem@4
8 | _IoDetachDevice@4
9 | _IoAllocateWorkItem@4
10 | @ObfReferenceObject@4
11 | @ObfDereferenceObject@4
12 | @IofCallDriver@8
13 | _ExFreePoolWithTag@8
14 | _ExAllocatePoolWithTag@12
15 | _stricmp
16 |
17 | _vsnprintf
18 | _RtlUnicodeToMultiByteN@20
19 | _RtlRaiseException@4
20 | _OutputDebugStringA@4
21 | _HeapReAlloc@16
22 | _HeapFree@12
23 | _HeapAlloc@12
24 | _GetProcessHeap@0
25 | _GetModuleHandleW@4
26 | _GetCommandLineW@0
27 | _strnicmp
28 |
--------------------------------------------------------------------------------