27 lines
767 B
Go
27 lines
767 B
Go
// shellcraft_winexec demonstrates winpwn's first shellcraft template:
|
|
// position-independent x64 shellcode that resolves kernel32 via the PEB
|
|
// (no leak/hardcoded base needed) and calls WinExec. Useful as the payload
|
|
// at the end of a ROP chain, or to drop directly into a hijacked function
|
|
// pointer / vtable entry.
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"winpwn"
|
|
)
|
|
|
|
func main() {
|
|
code, err := winpwn.ShellcodeWinExec("putty.exe")
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
fmt.Printf("%d bytes of shellcode, ready to splice into a payload:\n%x\n", len(code), code)
|
|
|
|
// Validating it actually runs (rather than just trusting the bytes)
|
|
// before landing it via a real exploit primitive:
|
|
if err := winpwn.ExecuteShellcode(code); err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
}
|