#include 
#include 
int
main
(
)
{
HMODULE hUser32
=
LoadLibraryA
(
"user32.dll"
)
;
FARPROC pMessageBoxA
=
GetProcAddress
(
hUser32
,
"MessageBoxA"
)
;
printf
(
"MessageBoxA address: 0x%p\n"
,
pMessageBoxA
)
;
PVOID pMemory
=
VirtualAlloc
(
NULL
,
256
,
MEM_COMMIT
,
PAGE_EXECUTE_READWRITE
)
;
char
*
caption
=
(
char
*
)
pMemory
+
100
;
char
*
text
=
(
char
*
)
pMemory
+
120
;
strcpy
(
caption
,
"Shellcode Works!"
)
;
strcpy
(
text
,
"test"
)
;
unsigned
char
shellcode
[
50
]
;
int
pos
=
0
;
shellcode
[
pos
++
]
=
0x6A
;
shellcode
[
pos
++
]
=
0x00
;
shellcode
[
pos
++
]
=
0x68
;
memcpy
(
shellcode
+
pos
,
&
caption
,
4
)
;
pos
+=
4
;
shellcode
[
pos
++
]
=
0x68
;
memcpy
(
shellcode
+
pos
,
&
text
,
4
)
;
pos
+=
4
;
shellcode
[
pos
++
]
=
0x6A
;
shellcode
[
pos
++
]
=
0x00
;
// тут вызываю messagebox
shellcode
[
pos
++
]
=
0xB8
;
memcpy
(
shellcode
+
pos
,
&
pMessageBoxA
,
4
)
;
pos
+=
4
;
// call eax
shellcode
[
pos
++
]
=
0xFF
;
shellcode
[
pos
++
]
=
0xD0
;
// ret
shellcode
[
pos
++
]
=
0xC3
;
memcpy
(
pMemory
,
shellcode
,
pos
)
;
HANDLE hThread
=
CreateThread
(
NULL
,
0
,
(
LPTHREAD_START_ROUTINE
)
pMemory
,
NULL
,
0
,
NULL
)
;
if
(
hThread
)
{
WaitForSingleObject
(
hThread
,
INFINITE
)
;
CloseHandle
(
hThread
)
;
printf
(
"Shellcode executed successfully\n"
)
;
}
VirtualFree
(
pMemory
,
0
,
MEM_RELEASE
)
;
FreeLibrary
(
hUser32
)
;
return
0
;
}