├── .gitignore ├── .gitmodules ├── README.md ├── cc_shellcode.sln ├── cc_shellcode.v12.suo ├── cc_shellcode ├── cc_shellcode.vcxproj ├── cc_shellcode.vcxproj.filters ├── cc_shellcode.vcxproj.user └── src │ └── main.cpp └── imports.def /.gitignore: -------------------------------------------------------------------------------- 1 | # Windows image file caches 2 | Thumbs.db 3 | ehthumbs.db 4 | 5 | # Folder config file 6 | Desktop.ini 7 | 8 | # Recycle Bin used on file shares 9 | $RECYCLE.BIN/ 10 | 11 | # Windows Installer files 12 | *.cab 13 | *.msi 14 | *.msm 15 | *.msp 16 | 17 | # ========================= 18 | # Operating System Files 19 | # ========================= 20 | 21 | # OSX 22 | # ========================= 23 | 24 | .DS_Store 25 | .AppleDouble 26 | .LSOverride 27 | 28 | # Icon must ends with two \r. 29 | Icon 30 | 31 | # Thumbnails 32 | ._* 33 | 34 | # Files that might appear on external disk 35 | .Spotlight-V100 36 | .Trashes 37 | # Compiled Object files 38 | *.slo 39 | *.lo 40 | *.o 41 | *.obj 42 | 43 | # Precompiled Headers 44 | *.gch 45 | *.pch 46 | 47 | # Compiled Dynamic libraries 48 | *.so 49 | *.dylib 50 | *.dll 51 | 52 | # Fortran module files 53 | *.mod 54 | 55 | # Compiled Static libraries 56 | *.lai 57 | *.la 58 | *.a 59 | *.lib 60 | 61 | # Executables 62 | *.exe 63 | *.out 64 | *.app 65 | 66 | *.tlog 67 | *.inf 68 | *.cer 69 | *.pdb 70 | *.sys 71 | *.log -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "Common"] 2 | path = Common 3 | url = https://github.com/k33nteam/Common.git 4 | [submodule "LIBC"] 5 | path = LIBC 6 | url = https://github.com/k33nteam/LIBC.git 7 | [submodule "LOADER"] 8 | path = LOADER 9 | url = https://github.com/k33nteam/LOADER.git 10 | [submodule "CVE"] 11 | path = CVE 12 | url = https://github.com/k33nteam/CVE.git 13 | [submodule "Core"] 14 | path = Core 15 | url = https://github.com/k33nteam/Core.git 16 | [submodule "boost"] 17 | path = boost 18 | url = https://github.com/boostorg/boost 19 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | CC-SHELLCODING framework 2 | ========================== 3 | 4 | **info** 5 | 6 | - http://www.k33nteam.org/blog.htm - 7 | - CC-SHELLCODING 8 | 9 | **branches** 10 | 11 | - master, including boost 12 | - lights, without boost, all boost dependencies should be carried by you (clone apropriate libs) 13 | 14 | **requirements** 15 | 16 | - Visual Studio 2013 17 | - python 2.7 x86 18 | 19 | **note** 20 | 21 | - for playing with imports look at CreateLoader.py 22 | - imports dependet files : imports.def, imports.ii, ImportDeclaration.h, ImportWrapper.hpp, usr_imports.asm 23 | -------------------------------------------------------------------------------- /cc_shellcode.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2013 4 | VisualStudioVersion = 12.0.21005.1 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cc_shellcode", "cc_shellcode\cc_shellcode.vcxproj", "{A24AE05E-430D-4699-8141-4C37E761DA12}" 7 | EndProject 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libc", "LIBC\libc.vcxproj", "{6B090B01-76A1-4521-902D-6011FE9AA4ED}" 9 | EndProject 10 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "loader", "LOADER\loader.vcxproj", "{8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}" 11 | EndProject 12 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE", "CVE\CVE.vcxproj", "{444C9878-7D1A-4028-8416-3C7D8672FDEB}" 13 | EndProject 14 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Core", "Core\Core.vcxproj", "{8F56699B-2357-48BC-A739-D831F3421C97}" 15 | EndProject 16 | Global 17 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 18 | Debug|Mixed Platforms = Debug|Mixed Platforms 19 | Debug|Win32 = Debug|Win32 20 | Debug|x64 = Debug|x64 21 | Release|Mixed Platforms = Release|Mixed Platforms 22 | Release|Win32 = Release|Win32 23 | Release|x64 = Release|x64 24 | EndGlobalSection 25 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 26 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 27 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Mixed Platforms.Build.0 = Debug|Win32 28 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Win32.ActiveCfg = Debug|Win32 29 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|Win32.Build.0 = Debug|Win32 30 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Debug|x64.ActiveCfg = Debug|Win32 31 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Mixed Platforms.ActiveCfg = Release|Win32 32 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Mixed Platforms.Build.0 = Release|Win32 33 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Win32.ActiveCfg = Release|Win32 34 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|Win32.Build.0 = Release|Win32 35 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.ActiveCfg = Release|x64 36 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.Build.0 = Release|x64 37 | {A24AE05E-430D-4699-8141-4C37E761DA12}.Release|x64.Deploy.0 = Release|x64 38 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 39 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Mixed Platforms.Build.0 = Debug|Win32 40 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Win32.ActiveCfg = Debug|Win32 41 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|Win32.Build.0 = Debug|Win32 42 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.ActiveCfg = Debug|x64 43 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.Build.0 = Debug|x64 44 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Debug|x64.Deploy.0 = Debug|x64 45 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Mixed Platforms.ActiveCfg = Release|Win32 46 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Mixed Platforms.Build.0 = Release|Win32 47 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Win32.ActiveCfg = Release|Win32 48 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|Win32.Build.0 = Release|Win32 49 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.ActiveCfg = Release|x64 50 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.Build.0 = Release|x64 51 | {6B090B01-76A1-4521-902D-6011FE9AA4ED}.Release|x64.Deploy.0 = Release|x64 52 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 53 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Mixed Platforms.Build.0 = Debug|Win32 54 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Win32.ActiveCfg = Debug|Win32 55 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|Win32.Build.0 = Debug|Win32 56 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Debug|x64.ActiveCfg = Debug|Win32 57 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Mixed Platforms.ActiveCfg = Release|Win32 58 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Mixed Platforms.Build.0 = Release|Win32 59 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Win32.ActiveCfg = Release|Win32 60 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|Win32.Build.0 = Release|Win32 61 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.ActiveCfg = Release|x64 62 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.Build.0 = Release|x64 63 | {8EB9E40F-F3CD-469E-83FF-78C7FB2E6DBE}.Release|x64.Deploy.0 = Release|x64 64 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 65 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Mixed Platforms.Build.0 = Debug|Win32 66 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Win32.ActiveCfg = Debug|Win32 67 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|Win32.Build.0 = Debug|Win32 68 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|x64.ActiveCfg = Debug|x64 69 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Debug|x64.Build.0 = Debug|x64 70 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Mixed Platforms.ActiveCfg = Release|Win32 71 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Mixed Platforms.Build.0 = Release|Win32 72 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.ActiveCfg = Release|Win32 73 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.Build.0 = Release|Win32 74 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|Win32.Deploy.0 = Release|Win32 75 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.ActiveCfg = Release|x64 76 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.Build.0 = Release|x64 77 | {444C9878-7D1A-4028-8416-3C7D8672FDEB}.Release|x64.Deploy.0 = Release|x64 78 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 79 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Mixed Platforms.Build.0 = Debug|Win32 80 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Win32.ActiveCfg = Debug|Win32 81 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|Win32.Build.0 = Debug|Win32 82 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|x64.ActiveCfg = Debug|x64 83 | {8F56699B-2357-48BC-A739-D831F3421C97}.Debug|x64.Build.0 = Debug|x64 84 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Mixed Platforms.ActiveCfg = Release|Win32 85 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Mixed Platforms.Build.0 = Release|Win32 86 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Win32.ActiveCfg = Release|Win32 87 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|Win32.Build.0 = Release|Win32 88 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|x64.ActiveCfg = Release|x64 89 | {8F56699B-2357-48BC-A739-D831F3421C97}.Release|x64.Build.0 = Release|x64 90 | EndGlobalSection 91 | GlobalSection(SolutionProperties) = preSolution 92 | HideSolutionNode = FALSE 93 | EndGlobalSection 94 | EndGlobal 95 | -------------------------------------------------------------------------------- /cc_shellcode.v12.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k33nteam/cc-shellcoding/HEAD/cc_shellcode.v12.suo -------------------------------------------------------------------------------- /cc_shellcode/cc_shellcode.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {A24AE05E-430D-4699-8141-4C37E761DA12} 23 | Win32Proj 24 | cc_shellcode 25 | 26 | 27 | 28 | Application 29 | true 30 | v120 31 | Unicode 32 | 33 | 34 | Application 35 | true 36 | v120 37 | Unicode 38 | 39 | 40 | Application 41 | false 42 | v120_xp 43 | true 44 | Unicode 45 | Static 46 | 47 | 48 | Application 49 | false 50 | v120 51 | true 52 | Unicode 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | true 73 | 74 | 75 | true 76 | 77 | 78 | false 79 | false 80 | $(SolutionDir)/out/ 81 | 82 | 83 | false 84 | false 85 | false 86 | .exe 87 | 88 | 89 | 90 | 91 | 92 | Level3 93 | Disabled 94 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 95 | true 96 | 97 | 98 | Console 99 | true 100 | 101 | 102 | 103 | 104 | 105 | 106 | Level3 107 | Disabled 108 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 109 | true 110 | 111 | 112 | Console 113 | true 114 | 115 | 116 | 117 | 118 | Level3 119 | 120 | 121 | MinSpace 122 | true 123 | true 124 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 125 | true 126 | $(WindowsSDKDir)\Include\um\;$(WindowsSDKDir)\Include\shared\;$(SolutionDir);%(AdditionalIncludeDirectories);$(SolutionDir)/boost/libs/integer/include;$(SolutionDir)/boost/libs/functional/include;$(SolutionDir)/boost/libs/detail/include;$(SolutionDir)/boost/libs/move/include;$(SolutionDir)/boost/libs/intrusive/include;$(SolutionDir)/boost/libs/static_assert/include;$(SolutionDir)/boost/libs/preprocessor/include;$(SolutionDir)/boost/libs/mpl/include;$(SolutionDir)/boost/libs/type_traits/include;$(SolutionDir)/boost/libs/exception/include;$(SolutionDir)/boost/libs/utility/include;$(SolutionDir)/boost/libs/config/include;$(SolutionDir)/boost/libs/assert/include;$(SolutionDir)/boost/libs/smart_ptr/include;$(SolutionDir)/boost/ 127 | false 128 | Size 129 | false 130 | false 131 | StreamingSIMDExtensions2 132 | false 133 | false 134 | false 135 | 136 | false 137 | MultiThreaded 138 | false 139 | StdCall 140 | Default 141 | 142 | 143 | Console 144 | true 145 | true 146 | true 147 | true 148 | libcmt.lib; mscvrt.lib 149 | Main 150 | 151 | false 152 | 4096 153 | false 154 | $(SolutionDir)cve\$(Configuration)\; 155 | $(SolutionDir)loader\$(Configuration)\usr_imports.obj;Gate.obj;Door.obj;$(WindowsSDKDir)\Lib\winv6.3\km\x86\libcntpr.lib; 156 | false 157 | false 158 | $(SolutionDir)imports.def 159 | /FILEALIGN:4096 %(AdditionalOptions) 160 | 161 | 162 | 163 | 164 | Level3 165 | 166 | 167 | MinSpace 168 | true 169 | true 170 | _WIN64;_AMD64_;AMD64;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 171 | true 172 | $(SolutionDir);$(WindowsSDKDir)\include\km\;%(AdditionalIncludeDirectories);$(SolutionDir)/boost/libs/integer/include;$(SolutionDir)/boost/libs/functional/include;$(SolutionDir)/boost/libs/detail/include;$(SolutionDir)/boost/libs/move/include;$(SolutionDir)/boost/libs/intrusive/include;$(SolutionDir)/boost/libs/static_assert/include;$(SolutionDir)/boost/libs/preprocessor/include;$(SolutionDir)/boost/libs/mpl/include;$(SolutionDir)/boost/libs/type_traits/include;$(SolutionDir)/boost/libs/exception/include;$(SolutionDir)/boost/libs/utility/include;$(SolutionDir)/boost/libs/config/include;$(SolutionDir)/boost/libs/assert/include;$(SolutionDir)/boost/libs/smart_ptr/include;$(SolutionDir)/boost/; 173 | false 174 | false 175 | FastCall 176 | false 177 | false 178 | Size 179 | false 180 | 181 | NotSet 182 | true 183 | false 184 | MultiThreaded 185 | 186 | false 187 | true 188 | false 189 | 190 | 191 | Console 192 | true 193 | true 194 | true 195 | Main 196 | true 197 | libcmt.lib; msvcrt.lib 198 | Gate.obj;Door.obj; 199 | $(SolutionDir)/loader/$(Platform)/$(Configuration)/;$(SolutionDir)/cve/$(Platform)/$(Configuration)/;$(SolutionDir) 200 | 201 | DefaultThreadingAttribute 202 | 203 | false 204 | false 205 | 64 206 | 207 | 208 | false 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | {444c9878-7d1a-4028-8416-3c7d8672fdeb} 217 | 218 | 219 | {6b090b01-76a1-4521-902d-6011fe9aa4ed} 220 | 221 | 222 | {8eb9e40f-f3cd-469e-83ff-78c7fb2e6dbe} 223 | 224 | 225 | 226 | 227 | 228 | 229 | -------------------------------------------------------------------------------- /cc_shellcode/cc_shellcode.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /cc_shellcode/cc_shellcode.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | TestSign 5 | CN="WDKTestCert zer0mem,130478420001425861" | CE6D60774354F593A55495B6DDA6BAC1EA809F2F 6 | 7 | -------------------------------------------------------------------------------- /cc_shellcode/src/main.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #define USER 5 | 6 | #ifdef USER 7 | #include 8 | #include 9 | #include 10 | #else 11 | #include 12 | #include 13 | #include 14 | #endif 15 | 16 | #include 17 | 18 | #include 19 | 20 | //all final compilation settings are set in this lib 21 | //code it is just wrapper to your custom Project (CVE) which exports exploit function! 22 | 23 | #include 24 | 25 | bool 26 | main() 27 | { 28 | exploit(); 29 | return true; 30 | }; 31 | -------------------------------------------------------------------------------- /imports.def: -------------------------------------------------------------------------------- 1 | EXPORTS 2 | _ZwQuerySystemInformation@16 3 | DbgPrint 4 | _RtlInitUnicodeString@8 5 | _IoQueueWorkItem@16 6 | _IoGetDeviceObjectPointer@16 7 | _IoFreeWorkItem@4 8 | _IoDetachDevice@4 9 | _IoAllocateWorkItem@4 10 | @ObfReferenceObject@4 11 | @ObfDereferenceObject@4 12 | @IofCallDriver@8 13 | _ExFreePoolWithTag@8 14 | _ExAllocatePoolWithTag@12 15 | _stricmp 16 | 17 | _vsnprintf 18 | _RtlUnicodeToMultiByteN@20 19 | _RtlRaiseException@4 20 | _OutputDebugStringA@4 21 | _HeapReAlloc@16 22 | _HeapFree@12 23 | _HeapAlloc@12 24 | _GetProcessHeap@0 25 | _GetModuleHandleW@4 26 | _GetCommandLineW@0 27 | _strnicmp 28 | --------------------------------------------------------------------------------