security - Running windows shell commands NASM X86 Assembly language -

i writing simple assembly program execute windows commands. attach current working code below. code works if hard code base address of winexec function kernel32.dll, used program called arwin locate address. reboot breaks because of windows memory protection address space layout randomization (aslr)

what looking find way execute windows shell commands without having hard code memory address code change @ next reboot. have found similar code around nothing either understand or fits purpose. know can written in c using assembler keep size small possible.

thanks advice/help.

;just runs simple netstat command. ;compile nasm -f bin cmd.asm -o cmd.bin  [bits 32]  global _start  section .text  _start: jmp short command           function:                 ;label  ;winexec("command execute",null) pop     ecx xor     eax,eax push    eax push    ecx mov     eax,0x77e6e5fd  ;address found arwin winexec in kernel32.dll call    eax  xor eax,eax push    eax mov eax,0x7c81cafa call    eax  command:                  ;label call function db "cmd.exe /c netstat /naob" db 0x00 

just update found way referencing windows api hashes perform action want in stack. negates need hard code memory addresses , allows write dynamic shellcode.

there defenses against still work against myriad of un-patched , out of date machines still around.

the following 2 sites useful in finding needed:

http://blog.harmonysecurity.com/2009_08_01_archive.html

https://www.scriptjunkie.us/2010/03/shellcode-api-hashes/