/* writehello-core.c by Charles Stevenson <core@bokeoa.com> 
 *
 * I made this as a chunk you can paste in to make modular remote
 * exploits.  I use it to see if my dup2_loop worked.  If you don't
 * get "Hello core!n" back it's a good indicator your shell won't
 * be functional the way you'd like.
 */
char hellcode[] = /* write(0,"Hello core!n",12); linux/x86 by core */
"x31xdb"              // xor  %ecx,%ecx
"xf7xe3"              // mul  %ecx
"x53"                  // push %ecx
"x68x72x65x21x0a"  // push $0xa216572
"x68x6fx20x63x6f"  // push $0x6f63206f
"x68x48x65x6cx6c"  // push $0x6c6c6548
"xb2x0c"              // mov  $0xc,%dl
"x43"                  // inc  %ebx
"x89xe1"              // mov  %esp,%ecx
"xb0x04"              // mov  $0x4,%al
"xcdx80"              // int  $0x80
// not needed.. makes it exit cleanly
// 7 bytes _exit(1) ... 'cause we're nice >:) by core
"x31xc0"              // xor  %eax,%eax
"x40"                  // inc  %eax
"x89xc3"              // mov  %eax,%ebx
"xcdx80"              // int  $0x80
;

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte (w/optional 7 byte exit) write(0,"Hello core!\n",12); linux/x86 by coren",
         strlen(hellcode));
  shell();
  return 0;
}

// www.Syue.com [2005-11-09]