Most operating systems ship with a massive number of files that have not been modified since the initial release. These files can be used to develop small service-pack independent shellcode. The trick is to use a single LoadLibraryA call to get the module base, and then call the IAT functions directly using hard-coded offsets. The result is a reverse-connect/download-shellcode payload that is 179 bytes and works on every service pack of Windows 2000.
H D Moore managed to get a null-free version right around 200 bytes, but any small XOR encoder will work as well. This technique, dubbed 'Vampiric Imports' is implemented in the following code:
- http://metasploit.com/sc/win2000_vampiric_connector.asm
