So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough memory to load the second object: One .doc file that has a shellcode embedded in an ActiveX file (activex1.bin).

enter image description here

In this picture we can see the NOP-Sled and how the first stage of the shellcode is trying to XOR some bytes in memory. The problem is, ECX points to 82849735 and it is out of memory.

I need to extract second stage of the shellcode. I tryed WinHex to see if there was something in that position but I didn's succed.

Aclaration: I got to this point using jmp2it with the activex1.bin directly, so it is not the "context" of all the things the RTF file did (The heap spray and so on) and maybe it is important. I don't know how to proceed since it's a RTF file and I cannot just put that in the debugger.

Edit/Update: I tried jmp2it to load the shellcode, and as you can see here: Getting Handle. It uses GetFileSize to check for a file handle (the rtf file). The problem is: If I launch jmp2it with the handle option, and point to that rtf, even though the shellcode will run properly, I will not have time to attach a debugger to the process (and I would lose the initial things).

So I don't know if there is a way or a tool that will let me stop a proccess anytime it calls a function?

I tried to load the rtf and attach a debugger but it doesn't work. Everything I tried does not work because most of the tools are for .exe's but most importantly because when I tried to launch the shellcode with anyother tool it fails since all the things (ASLR bypass for example) that .RTF does didn't happen.

  • 2
  • I edited the post, since the tools I tried didn't work. Problem seems to be that I can take two paths: Run the shellcode and failing to extract second stage cause its out of memory or try something since the beggining with the .rtf file. – peterlagunas Dec 10 '17 at 21:56

Jmp2it has option to pause before shellcode executes so you have time to attach debugger

  • 2
    Maybe add a bit more on how to use it in this case. – Paweł Łukasik Feb 4 '18 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.