Notes on an ASM X64 Reverse Shell

  Notes an ASM X64 Reverse Shell

This article is a collection of Resources that i used to create a x64 reverse shell in pure ASM.

Furthermore you can find the code that I wrote commented line by line.

 

The Resources:

The starting point

Windows X64 calling convention

GetProcAddress

WSAstartup

WSASocketA

Sockaddr

WSAConnect

CreateProcessA

STARTUPINFOA

ExitProcess

The Steps:

1. Finding Kernel32.dll Address
2. Parsing Kernel32.dll to find GetProcAddress API 
3. Using GetProcAddress to find LoadLibrary API
4. Loading the ws2_32.dll
5. Using GetProcAddress to locate and store WSAStartup address
6. Using GetProcAddress to locate and store WSASocketA address
7. Using GetProcAddress to locate and store WSAConnect address
8. Using GetProcAddress to locate and store CreateProcessA address
9. Using GetProcAddress to locate and store ExitProcess address
10. Calling WSAstartup()
11. Calling WSASocketa()
12. Creating the sockaddr structure
13. Calling WSAConnect()
14. Pushing cmd.exe string to stack
15. Setting STARTUPINFOA Structure
16. Calling CreateProcessA()
17. Calling ExitProcess(0)

The Code:

You can find the fullcode here

Please DO NOT test the shell on VirusTotal et simila

The Result:

antiscan.me results (0/26)