v0.1 - initial commit

workspace/demos/shellcraft_winexec/main.go

@@ -0,0 +1,26 @@
+// shellcraft_winexec demonstrates winpwn's first shellcraft template:
+// position-independent x64 shellcode that resolves kernel32 via the PEB
+// (no leak/hardcoded base needed) and calls WinExec. Useful as the payload
+// at the end of a ROP chain, or to drop directly into a hijacked function
+// pointer / vtable entry.
+package main
+
+import (
+	"fmt"
+	"log"
+	"winpwn"
+)
+
+func main() {
+	code, err := winpwn.ShellcodeWinExec("putty.exe")
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Printf("%d bytes of shellcode, ready to splice into a payload:\n%x\n", len(code), code)
+
+	// Validating it actually runs (rather than just trusting the bytes)
+	// before landing it via a real exploit primitive:
+	if err := winpwn.ExecuteShellcode(code); err != nil {
+		log.Fatal(err)
+	}
+}