win32 Beep Shellcode (SP1/SP2) 35 bytes

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : win32 Beep Shellcode (SP1/SP2) 35 bytes
# Published : 2006-04-14
# Author : xnull
# Previous Title : linux/x86 if(read(fd,buf,512)<=2) _exit(1) else buf(); 29 bytes
# Next Title : linux/x86 portbind (port 64713) 86 bytes

/*
Shellcode can be changed to work with any windows distribution by changing the address of Beep in kernel32.dll
Addresses for SP1 and SP2

-xnull
*/

#include <stdio.h>

unsigned char beepsp1[] =
"x55x89xE5x83xECx18xC7x45xFC"
"x10xC9xEAx77"                      //Address x10xC9xEAx77 = SP1
"xC7x44x24x04"
"xE8x03"                              //Length xE8x03 = 1000 (1 second)
"x00x00xC7x04x24"
"xE8x03"                              //Frequency  xE8x03 = 1000
"x00x00x8Bx45xFCxFFxD0xC9xC3";

unsigned char beepsp2[] =
"x55x89xE5x83xECx18xC7x45xFC"
"x53x8Ax83x7C"                      //Address x53x8Ax83x7C = SP2
"xC7x44x24x04"
"xD0x03"                              //Length xD0x03 = 2000 (2 seconds)
"x00x00xC7x04x24"
"x01x0E"                              //Frequency x01x0E = 3585
"x00x00x8Bx45xFCxFFxD0xC9xC3";

int main()
{
    void (*function)();
    *(long*)&function = (long)beepsp1;
    function();
}

// www.Syue.com [2006-04-14]