rootshell

 # cat rootshell.c
#include <stdio.h>

int main(int argc,char **argv){
unsigned char rootshell[]= "\x31\xd2\xb2\x0a\xb9\x6f\x75\x21\x0a\x51\xb9
\x63\x6b"
"\x20\x79\x51\x66\xb9\x66\x75\x66\x51\x31\xc9\x89\xe1"
"\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\x31"
"\xdb\x40\xcd\x80";
printf(rootshell);
return 0;
}
 # gcc -o rootshell rootshell.c
rootshell.c: In function ‘main’:
rootshell.c:8:1: warning: format not a string literal and no format arguments [-Wformat-security]
 printf(rootshell);
 ^
 # ./rootshell > rootshell.bin
 # objdump -D -b binary  -m i386  ./rootshell.bin

./rootshell.bin:     file format binary


Disassembly of section .data:

00000000 <.data>:
   0:	31 d2                	xor    %edx,%edx
   2:	b2 0a                	mov    $0xa,%dl
   4:	b9 6f 75 21 0a       	mov    $0xa21756f,%ecx
   9:	51                   	push   %ecx
   a:	b9 63 6b 20 79       	mov    $0x79206b63,%ecx
   f:	51                   	push   %ecx
  10:	66 b9 66 75          	mov    $0x7566,%cx
  14:	66 51                	push   %cx
  16:	31 c9                	xor    %ecx,%ecx
  18:	89 e1                	mov    %esp,%ecx
  1a:	31 db                	xor    %ebx,%ebx
  1c:	b3 01                	mov    $0x1,%bl
  1e:	31 c0                	xor    %eax,%eax
  20:	b0 04                	mov    $0x4,%al
  22:	cd 80                	int    $0x80
  24:	31 c0                	xor    %eax,%eax
  26:	31 db                	xor    %ebx,%ebx
  28:	40                   	inc    %eax
  29:	cd 80                	int    $0x80