This is a shellcode (PIC) that pop a calc.exe, in order to accomplish this task the shellcode uses the PEB method to locate the baseAddress of the required module and the Export Directory Table to locate symbols. Also the shellcode uses a hash function to gather dynamically the required symbols without worry about the length. Finally the shellcode pop the calc.exe using WinExec and exits gracefully using TerminateProcess.
- Author: h4pp1n3ss
- Date: Wed 09/22/2021
- Tested on: Microsoft Windows [Version 10.0.19042.1237]
This shellcode uses two Windows API
UINT WinExec(
LPCSTR lpCmdLine, -> EBX
UINT uCmdShow -> EAX
);and
TerminateProcess Function Prototype
BOOL TerminateProcess(
HANDLE hProcess, -> 0xffffffff
UINT uExitCode -> EAX
);